Best Custom ROMs
Last update : 13/12/2023
Introduction
Here's my list of best custom ROMs for those who still needs to use Android. Keep in mind that this is my own opinion, and this page ignores any issues with hardware and/or firmware as they cannot be modified / audited to become trustworthy.
For those who has no use for Android devices, there's only one recommendation : Discard them... ok that's 2, considering DigDeeper's link (which I hypocritically & ironically agree with despite my site's Android contents).
Best for security buffs
If you take security really seriously & would like to keep using Android in any form, stop reading any further, get the latest "affordable" Pixel (regardless of my disdain for them nowadays), and flash GrapheneOS (despite my obvious issues with it).
If you're asking for alternatives for GrapheneOS, don't bother. Here's the alleged "alternatives" (most supports verified boot except for /e/) & reasons why I don't recommend them (as far as I experienced) :
- CalyxOS : No security hardening by default (aside from relockable bootloader), too much prebuilt "privacy-friendly" bloat by default (they can be not installed using the setup wizard, but their codes remain active in the ROM), and does not change default connections (or provide options to change them) such as captive portal & network time. The latter 2 points are troublesome, especially since CalyxOS claims to cater to privacy-conscious users.
- DivestOS : DivestOS focuses on applying their additional security & privacy patches to most LineageOS-supported devices, and releases them without any 1st-party testings (at least for devices not personally owned by the lone developer, though I am unable to confirm as an outsider). As a result, devices that are broken as a result of these patches (such as Pixel 3 & above - 12/9/2023 Update : Pixel 3 & 4 works again) might never be fixed (such as the broken camera in their Poco F1 build, which was also marked as [help needed]). And to make it worse, DivestOS only supports the latest Android build that the supported devices can use (and not considered experimental). For example, a functional A11 build for Pixel 3 will never be available in lieu of the permanently broken A13 build (which is fixed in September 2023 build). However, if it works for your device, it's a workable alternative.
- /e/OS : Epic fail. From hardcoded (and undocumented) default connections to being unrepentingly behind in security patches, feel free to pick why.
- Stock ROM : Might as well directly give your data away to some cybercriminals (instead of having them buy it from Go-ogle and/or whoever else). In addition to Goolag bloat, you also get Facebook, along with whatever else the manufacturer slaps on.
If you also care about privacy (in addition to security), here's a few tips I would offer up for those GrapheneOS users :
- Do not use the sandboxed Play Services, or don't allow them any network access if you use them. GrapheneOS does not have any spyware mitigation other than security restrictions, so be careful of which online-only apps you're using as well.
- Don't use apps dependent on Play Services whenever possible. I have my own list for apps I use, and most* are not dependent on Play Services.
*: "Most" excludes Nova Launcher Prime unlocker, though it only depends on Play Services (but not microG) for license verifications.
Least worst for now
For me, the least terrible ROM is crDroid, at least for A12L & A13. Here's a short-ish list (actually a rehash of its advantages, but a bit more personal) of why I believe it's the least terrible :
- Customizations
- Monet settings (Settings > crDroid Settings > User Interface > Monet settings) allows me to customize the theme to my liking, including the option to not use wallpaper-based colors. The settings' placement could be better, but at least we have something.
- crDroid is the only ROM I know to offer an option to change the QS background opacity in Settings > crDroid Settings > Quick settings > Background transparency.
- In addition to changing the navbar layout to a more usable one (from left to right - recents, home, back), the navbar's looks can be changed.
- Of course, rich selections of icons & fonts. Not essential, but niceties are niceties.
- Per-app data restriction - not as effective as GrapheneOS' network permission, but at least it allows you more control for either mobile data and/or wi-fi. I still believe the latter should be the default (and incorporated in upstream AOSP so I don't have to write about this at all).
- microG compatibility, in case I want to play a certain game that demands it. However, the microG vs. GmsCompat debate is still not solved at the time of writing.
- Based off the solid base known as LineageOS, so it "just works" for me.
- This report goes from A12 to A13, which means I don't really have to think of which ROM I'd go to if I am forced to switch to A13... at least if there's no other ROMs I would consider. Fortunately crDroid provides the latest archive for older Android builds, so my consideration simply goes between security & usability.
- Some devices (such as X3P & OnePlus 9 "Pro") comes with their default brand's camera (MIUI Camera(ANX) & OOS Cam respectively) for those who needs a vendor-optimized camera for whatever reason.
However, there are a few issues that keeps me from fully shilling for crDroid (if at all) :
- Random issues with headset volume (at least on newer devices like the X3(N/P)) - When raising headset volume above a certain level (usually 50% on the X3P), it will try to warn me about raising it, citing hearing damage as the reason. Tapping on "yes" removes these warning, at least for a while. However, after some time (at least 20 hours of listening in "unsafe volumes"), the volume instantly drops (down to the maximum limit the ROM considers "safe") without any warning, and raising the headset volume demands me to re-undo the warning (which can only be done with the screen enabled btw) without a way to permanently disable these warnings whatsoever (at least without SystemUI Tuner which requires ADB / root to grant its permissions; also results are mixed so don't rely on it).
On its own, this is barely worth any mention in advantages / disadvantages. However, for someone who frequently uses the jack (sometimes with the M50X, which doesn't get loud enough on most cellphones IMO (particularly the aforementioned X3P), unless pushed past the "safe" limit), this becomes an issue. This is also an issue for those who use their headphone jack to connect to their (car and/or portable) speakers as it often requires going past the "safe" volume limit.
16/3/2023 Update : turns out this shit was demanded by EU (and integrated into Android's internal alert just because Goolag could; so it's now an Android-wide issue).
- Questionable site with cuckflare & JS/XHR dependency (in addition to a somewhat permissive but annoying BlockAdBlock implementation). If all you care about is getting the ROM, you can just ignore that site & get the SourceForge link (which is cuckflared as well, but at least you get the ROM).
- Questionable status on Vanilla/GApps. Currently, most builds are Vanilla-only, with the exceptions being the GApps-only OnePlus 7T "Pro" & Poco F4. Mi 9T & OnePlus 9 "Pro" had GApps-only A11, but they switched to Vanilla-only as of A12 & has not turned back ever since.
- crDroid does not change any default connections whatsoever (or, at the very least, document them where people can easily see them), requiring users to mitigate this themselves. This probably isn't an issue if you are either never going to connect the device into the internet or manually change them every clean flash, but still.
- No inbuilt applock (in A12L), which can be an issue if you frequently lend your device to others (or leave them where others can freely access them; or even got some thug demanding access to your device) & hope they don't start digging into whatever you don't want them to see.
- No sensors permission (or network permission to replace per-app data restriction; it's technically there but without the toggle needed to validate it)
- crDroid has the ability to spoof the user's device as a Pixel XL (enabled by default, can be disabled in Settings > crDroid Settings > Miscellaneous > Unlimited Photos Storage), allowing it to get unlimited Goolag Photos storage in return for CPU power drains.
In addition, crDroid has integrated several Pixel-exclusive features (such as live caption, adaptive connectivity, Now Playing) & Goolag's Settings Services (which replaces AOSP's Settings Suggestions).
- Includes the unneccessary bloat known as Game Space, which could encourage letting some unwanted options enabled (we obviously hope this won't be the case).
- 16/3/2023 Update : In addition to Goolag spoofing, crDroid adds in an option to spoof device for Netflix. Why bother kowtowing to some corpo that wants you to lick their dirty feet before you can even start renting their shit?
If I were to have any other alternatives worth mentioning, I would have already made sure to list them above. Here are those that could have been my choice, yet couldn't :
- ArrowOS : Previously known as my "best ROM" for A11. A12L completely destroyed this image & A13 couldn't fix it, since the entire project was stalled (no longer stalled, but so far only applock returned).
- DivestOS : What could have been a potent competitor for my recommendations were dragged down by uneven device support & inability to edit partition for debloating. More below.
- HavocOS : The first microG-compatible ROM I've ever used. Unfortunately, development seems stalled. 15/9/2023 Update : Development no longer stalled, though they seem to have mutated into GApps-only.
- LineageOS : To be honest, LineageOS is still the most practical choice for custom ROMs, especially considering the fact that it is a popular base for many ROMs, crDroid included. However, it is the most predictable & boring option compared to other custom ROMs.
- LMODroid : Almost made the cut as an alternative, if not for being mostly LineageOS with less reliable downloads & advertising itself as a "privacy-focused" ROM without everything expected from one.
- SparkOS : Offers too much stuff that got in the way, even more than crDroid.
And, moving to the 2nd fiddle for both security buffs & me, DivestOS. Previously, I dismissed it due to uneven device support. However, I forgot to look at it from a more positive stance, so here it is.
First off, let's start with its benefits :
- Maintained all the way down to Nougat, complete with monthly security patches. Sure, there might be missing patches especially for older versions (especially the ones dropped by upstream AOSP), but the effort's there.
- Removes proprietary blobs, increasing security & privacy at the cost of added usability issues.
- Supports bootloader relocking for devices that support it.
- Provides network & sensors permission on top of LineageOS' per-app data restriction. Sure, that sounds a bit redundant, but at least there's a robust option.
- microG support (toggle in Settings > Security > Unprivileged microG enablement & reboot required after enabling)
It ain't GmsCompat, but at least there's something for that one game. By the way, latest microG is mandatory for this one.
- An actually good site - JS only for emails, no cuckflare (aside from official GitLab repo but I digress), and 1st-party downloads (require enabling other in uMatrix for Chromium browsers)
And, here are its issues :
- Uneven device support, notable examples listed below :
- Poco F1 : Camera doesn't function - device reboots when camera is booted.
- Pixel 3 : Works in A11, then doesn't work in A12(L) & A13 for unknown reasons, then worked again since September 2023 A13 build for unknown reasons... again.
- Doesn't provide older Android version for devices. Granted, this is something most ROMs do, but it kinda stings, especially when the last build (which just so happens to be an older version) worked & the current one don't.
- No monet customizations for ≥A12 - in A13 you get those shit pastel palette as "basic" colors & we know how I feel about it.
- No applock (aside from Trebuchet's Hidden & Protected apps) - but then again most custom ROMs do this (and I don't really need it in the first place, but still).
- The most egregious issue for me : DivestOS can ignore all modifications made to system partitions (either that, or the system won't boot after modifications), making it a no-go if I wanted to daily drive it (unless I contend with uninstalling the bloat one by one using pm uninstall commands, which I'd rather not do on devices with TWRP recovery).
- And, the 2nd most egregious one : DivestOS is a one-dev-show. Sure, the developer did put in the effort to maintain DivestOS. However, in the possible case he couldn't continue? That's it for DivestOS, unless someone forks it & continues developing it in the exact same way the previous developer did.
Can we make an even better one?
Since every ROMs suck to a degree (though not as bad as phones are), let's throw some insight on the truly perfect custom ROM. Or, in other words, how we can do better.
To start, we'll use LineageOS, as it's easier to fix than crDroid (despite being the least worst).
Mandatory additions
Starting with the custom ROM :
- First off, about the base. Personally, I can't really decide for the best ones, so here's a list for you to decide.
- A10 : A continuation of Pie, but with AppOps integrated to permission manager. Arguably the best (ignoring device compatibility), especially if later Android APIs & security patches are properly implemented without fucking up the UX, /data access, & keyboard vibrations. Remember those previous parts, because it will be a mandatory addition to everything else.
- A11 : A10 with power menu on top section instead of the right (where the power button might be)? Anyway, same note as A10. By the way, most 3.x-kerneled Android phones can't go beyond A11 without unresolved issues (whether it's from jumping to 4.x kernel or something else), so there's that as well.
- A12(L) : This is where the UX went to both good & shit (2 good additions, and everything else went to shit). More mature settings icon at the cost of fonts following the theme, "basic" pastel colors replacing most (and decent colors being either inbuilt or requiring an app from Goolag Play Store?), stupid wobbly effects on scrolling, and a less efficient quick settings (though I actually kinda liked it as I didn't really use more than 3 QS buttons - though the blanket opaque black background is trash). On top of my A10 notes; cut out the wobbly shit, weld full color customizations (similar to the one found on crDroid; not just a bunch of "basic" pastel shit) to Wallpaper & style, and revert that opaque black QS background to clear (or, at the very least, 80&37#; opacity by default; no blur.). Also, make sure there's an option to make the font stay uncolored in dark/black theme (high contrast text makes the font black & white in some colored parts).
- A13 : And Goolag worsened everything, as predicted. Bluetooth, UWB, and SdkSandbox is an /apex dependency; and now touch vibration settings (in Settings > Sound & vibration > Vibration & haptics > Touch feedback) also targets keyboard vibration (finer vibration control is fucked, but system default vibration duration mitigates this). If you look at my A12(L) (and previous) notes above, y'all know what I'll say about A13 at this point... actually, let's add one more thing (something I should've said in A11, but with more emphasis on A13 due to obvious reasons) : fucking delete /apex.
- Remove the internal alert limiting headphone volume to 50%. Simply granting a method to mitigate this is unnecessary if it re-enables itself anyway, so it has to go (though if the warning does not re-enable itself at all we'd probably be fine with that). By the way, this should be mandatory for upstream Android, especially if it can't tell the difference between an earphone that starts damaging someone's ears from 40%, a big ol' Harman Kardon speaker that would only start being audible beyond 75% without Bluetooth & its own line of issues, and a casual over-ear headphone that starts sounding nice somewhere above 50%.
This issue applies to Android devices released ≥2021 - ≤2018 devices (AFAIK) doesn't suffer from the internal alert issue so there's that.
- Add in applock & don't force the users to use the default launcher for this feature. No "Hidden & Protected Apps" from Trebuchet (or whatever stock launcher), please. Just Settings > Security > App Lock.
- Add in sensors permission toggle, to fully ensure no app could abuse the sensors without user permission. Set it to disabled by default so the app has to ask for it if it thinks sensor usage is important (such as Android games, native and/or emulator). In fact, this should be mandatory for upstream Android.
- Replace per-app network restriction with GrapheneOS' network permission toggle & set it to disabled by default so the app must ask for it if it thinks it needs internet. In fact, this should be mandatory for upstream Android. Per-app data restriction isn't as robust & reliable as toggleable network permission. Just don't feature BOTH per-app network restriction & network toggle at the same time - it's confusing.
- All stable officials must run user builds. eng / userdebug is fine for alpha / beta; but not for stable, especially when the user may run security-sensitive apps (online games are an unfortunate example for this).
- ADB must not re-enable itself if it's disabled. Enabling it on 1st boot by default is probably fine if it's alpha / beta; not for "stable" official release. Most custom ROMs nowadays does have this, so this point here serves as a reminder.
- For devices with relockable bootloaders (and only for those devices) : Make sure the bootloader is relockable when running this ROM; otherwise it doesn't deserve the official tag.
- Change default connections to actual privacy-respecting alternatives. Of course, documentations are important for this one, so make sure to add it in the website / wiki / docs page.
- Integrate a setting that allows changing default connections (such as captive portal) to the user's preferences (not just an on/off toggle).
- Provide an option to enable / disable AGPS, SUPL, & PSDS in location settings. For custom real-world geolocation servers, we're not seeing any reliable & private alternative yet, so we'll leave it out for the moment.
- Provide a bare ad-blocking hosts (or a bare minimum fullset privacy hosts like mine). Don't provide a toggle for it though - this isn't for the normies (though maybe they could use a build without the hosts).
- Bluetooth & telephony must be optional, not a dependency that destroys the OS if deleted (doubly true for Bluetooth & uwbresources since I couldn't boot every time I delete any of them in A13 - both are Android dependency in /system/apex). In fact, this should be mandatory for upstream Android.
Come to think of it, Fused Location is also an Android dependency, in /system/priv-app. It should also be optional. I mean, has anyone heard of an Android device exclusively used for console emulation? That thing doesn't seem to need GPS and/or telephony.
- For theming, the ROM must provide theming options (just like the one found in crDroid) in Settings > Wallpaper & style (and use actual colors, not those fucking pastel ones). This will also actualize LineageOS' promise on individuality, which they kinda broke since A12 (LineageOS promised to push for user personalization right in their index page but didn't go all the way by not providing monet settings since A12).
- Provide background transparency options in statusbar settings.
&
Optional additions
Here's the optional addition - the niggles that I'm cool not having, but very welcome if it's there.
Starting with the custom ROM :
- Maybe add in an in-device-MitM firewall / network monitor / adblocker (like the iode app). Optional since we have AFWall+ & PCAPdroid, though it only works with root access.
- Go hard on security & inject as much GrapheneOS security enhancements as possible into the ROM. Of course, this is optional since most maintainers might not like having to implement & debug these enhancements.
- Go crazy with customizations & provide options for fonts & icons. Or go like CarbonROM & provide a custom font engine?
- Between GmsCompat & microG, I'd rather have unprivileged microG (GmsCompat is alright but not preferred; privileged microG is just asking for more issues - and supporting both GmsCompat & microG is redundant so pick only one & stick with it). But still, having either would help for those who still needs Goolag dis-services.
Then, for the website; which is not that important in itself (hence being made optional) but may also keep our red flags off :
- First off, get every part of the site off cuckflare (archive.org) if the site is cuckflared.
- While Lineage gets a point for hosting their own ROMs through their own server, they also don't archive the last previous Android build, which sucks for those not looking for latest Android. Lineage-microG mostly solves this (and also uses a more efficient webpage; though it also doesn't archive older Android builds), so we should mostly copy them for 1st-party. 3rd-party providers can & should be used to archive older Android builds especially if 1st-party server costs get out of control.
Forbidden additions
Additions I don't want to see at all in the "perfect" ROM.
Starting with the custom ROM itself (most of which are already present at my custom ROM rules (major & minor), so this is mostly a recap) :
- No SELinux switchers whatsoever (let alone Permissive SELinux at "stable" builds) - all "stable" official releases has to be released with Enforcing SELinux; otherwise they stay at alpha & are considered unofficial.
- Don't add system app removers by default - if users could boot a custom recovery where system is mounted as RW, that'll suffice... though at that point they're on their own. Also don't make those modifications not apply.
- No need for a GApps build, especially if GmsCompat / microG (or even both; God forbid) support is present in the system.
- ADB re-enabling itself on boot? Alpha & Unofficial. Git back there & get it right.
- Spoofings for passing SafetyNet and/or whatever DRM from whoever demands it in the name of "security"? Yeah right, like I'd fuck my system up for your "security".
Back to top
How to select a custom ROM
Index - cellphone
Main Page