Plug your phone into this computer and set up Kapo Guard as Device Owner, your privacy apps and hardened settings in one go. Everything runs in this browser tab: nothing to install on your computer, and nothing about your phone is sent to us.
Browser check passed: this browser can talk to USB devices.
This browser can't connect to USB devices. Open this page in Chrome or Edge on a Windows, Mac, Linux or ChromeOS computer.
The installer's code could not load, so this page can't run. It comes from cdn.jsdelivr.net, which may be down or blocked on this network. Nothing has been done to your phone. Reload the page to try again, or try another network.
★Start with a protocol (optional)
Pick a ready-made setup and it ticks the apps and settings below for you. You can still change anything before you run it.
1Prepare the phone
Get a paid licence key first. This installer is free, but Kapo Guard stays on its Activate screen until you enter a key. With Device Owner the lockdown already applies (no factory reset from Settings, no Safe Mode), and Finish setup and Remove protection are behind that screen, so without a key the way out is a factory reset from the recovery menu.
For Android 12 or newer. Tested on Pixel phones running GrapheneOS, including a real erase. On Samsung, Xiaomi and other brands, triggers may misfire or not fire at all: test everything in TEST mode, and do not use WIPE mode on those phones until you have.
Factory reset the phone (or start from a brand-new one).
Go through the setup screens. Do not add a Google account and skip the PIN for now. Connect to Wi-Fi.
Settings → About phone → tap Build number 7 times.
Settings → System → Developer options → turn on USB debugging.
Close other phone tools on this computer (Android Studio, or run adb kill-server), then plug the phone in with a good USB cable.
2Choose apps
Kapo Guard is always installed. The rest is optional. Apps offered here are copies we host and may be older than the maker's newest version, so update them after setup.
3Choose privacy settings
Applied once during setup. You can change any of them later in Settings.
Kapo Guard
4Connect and install
When the phone asks "Allow USB debugging?", unlock it and tap Allow.
Not connected
Technical log
✓ Setup finished. You can unplug the phone.
You unticked "Pre-approve Kapo Guard's permissions". Turn on Accessibility for Kapo Guard yourself (phone Settings → Accessibility, "Kapo Guard - Duress code and triggers"), or the duress and private profile codes won't work.
Kapo Guard is open on the phone. Enter your licence key to activate it.
Set your real screen lock in Settings → Security. Set a number PIN, not a password or pattern: the duress and private profile codes are typed on the number pad, and with anything else they may not be recognised. It must not contain your duress code, or a normal unlock would set it off. It must not contain your private profile code either, or a normal unlock would open the private profile, in front of anyone watching.
Turn Auto-confirm unlock OFF (phone Settings, under your screen lock). If it is on, Android can send the PIN by itself while you are still typing: the digits so far count as a wrong PIN attempt, which can take an intruder photo, trigger a reboot or count toward Wrong PIN wipe, and your duress or private profile code may not be recognised.
Set your duress code and choose which triggers to arm. Test each one in TEST mode first. Wrong PIN wipe has no TEST mode: it is always a real erase. The duress code fires whenever its digits are typed in a row, even inside something longer, so it must not sit inside your real PIN or your private profile code. Kapo Guard can't check this for you. If you arm the power button trigger, note that Android's Emergency SOS starts at 5 presses: turn it off in Settings → Safety & emergency if you don't want it to start too.
Using an eSIM? It can't be switched on over the cable. On GrapheneOS: Settings → Network & internet → eSIM support ON (it needs Google Play, installed from the App Store app), then restart. On stock Android eSIM already works. Do this before you switch on Fake home, which hides the real Settings.
Last of all, once everything is done and tested, finish Kapo Guard's setup. It then turns USB debugging off for good, so nobody can plug in a cable to remove it, and this page can't run setup on the phone again.
Your private profile
The normal phone is now the decoy. Its screen lock is the PIN you can give up if forced.
Lock the phone and type your private profile code on the lock screen. Your private profile opens.
Tap the "Set a screen lock" notification there and choose a strong PIN (8+ digits) or password. Use a different one from the decoy PIN, and don't let it contain your duress code. Turn Auto-confirm unlock OFF here too.
Your apps are in there. Turning the screen off closes it and the phone returns to the decoy.
In Kapo Guard on the decoy: Privacy → Fake home, choose your way in and switch it on.
Gboard was not set as your keyboard, because it could not be confirmed on the phone. It isn't installed for you: if you want it, install it first (see the apps list), then pick it in Settings.
Keyboard — 30 seconds on the phone
Gboard is set as your keyboard. Its own settings live inside Gboard and can't be set over the cable — open Gboard → Settings once:
Preferences: turn Number row ON and Show border around keys ON.
Text correction: turn OFF Auto-correction, Next-word suggestions, Show suggestion strip and Spell check.
Theme: pick a dark theme.
Trouble connecting?
No phone in the pop-up: try another cable or port (many cables only charge). Check USB debugging is on.
"Unable to claim interface" / device busy: another program is using the phone. Close Android Studio / phone managers, or run adb kill-server, then unplug and replug.
Windows doesn't see the phone: install the Google USB driver (Windows Update → Advanced options → Optional updates).
"Allow USB debugging?" never appears: unplug, tap "Revoke USB debugging authorisations" in Developer options, plug back in.
This installer is free to use. Kapo Guard itself needs a paid licence key, entered inside the app, never here. Every app file is checked against its SHA-256 fingerprint before it touches your phone.