bitchat

Every mainstream messenger quietly assumes the network will be there. bitchat starts from the opposite premise. The tower is overloaded, the venue Wi-Fi has buckled under a crowd’s worth of phones, or someone has switched the internet off on purpose. What remains is the hardware in people’s pockets, and bitchat turns that hardware into the network.

The project is credited to Verse Communication PBC and grew out of permissionless tech circles associated with Twitter and Block co-founder Jack Dorsey. It is a free, open-source, decentralized peer-to-peer messenger that runs primarily over a Bluetooth Low Energy mesh. Onboarding barely exists, by design. There is no account, phone number, email address or password, and no central server keeping a record of who talks to whom. Phones find nearby peers automatically.

Its market position is unusual and deliberate. Its real rival is the dead zone. The scenarios the project names are crowded events, disasters, internet shutdowns and places without coverage, which are exactly the moments conventional apps fail. When a connection does exist, the app reaches further through Nostr relays. Those relays add location-based public channels and a fallback path for private messages, so a conversation does not die the moment someone walks out of Bluetooth range.

Reception on iOS is solid. On the US App Store, the listing, titled “bitchat mesh”, holds a 4.7 out of 5 from 525 ratings. Users praise the simple setup, the absence of ads and the steady flow of updates. The app also carries a political profile few utilities have. Apple pulled it from the Chinese App Store at the request of China’s Cyberspace Administration, and press coverage of that removal highlighted its appeal wherever networks are censored or shut down.

That profile sits uneasily next to a blunt disclaimer in the project’s own README. The software has not had an external security review and should not be used for sensitive purposes yet. The scenarios that make bitchat compelling are often the scenarios where that warning matters most.

• Bluetooth LE mesh with seven-hop relaying: Phones discover nearby peers on their own and pass messages along for up to seven hops, which stretches reach well past a single Bluetooth link.
• Zero-identity onboarding: There are no accounts, phone numbers, email addresses or central servers, and nothing ties a chat to a real-world identifier.
• Nostr relay support: With internet access, messages can travel over Nostr relays and extend the app beyond local radio range.
• Geohash location channels: Public chat rooms are scoped to a geographic area, from a single city block up to a wider region.
• Layered direct-message delivery: DMs try Bluetooth first, fall back to Nostr, and wait in a queue when neither path is available.
• Noise Protocol encryption: Private messages are end-to-end encrypted.
• IRC-style commands: The text-first interface is modeled on IRC, with commands such as /msg, /who and /slap.
• Triple-tap emergency wipe: Three taps delete all data instantly.
• Power and bandwidth tuning: LZ4 message compression and adaptive battery modes reduce the cost of keeping a radio mesh alive.
• Free and open source: The app costs nothing and its code is public on GitHub.

The Mesh: Range Borrowed From Strangers

One Bluetooth Low Energy link covers a short distance. bitchat answers that limit with relaying. Every phone running the app becomes a router, and a message can pass through up to seven of them. In a dense crowd, that turns a room-sized radio into something that can span a venue. App Store users single out this long-distance reach through relays, with no internet involved, as a key strength.

The seven-hop ceiling is a sensible engineering compromise. Unlimited relaying would let a single message bounce around a large crowd indefinitely and multiply radio traffic and battery drain for everyone in it. Capping hops gives up some maximum reach in exchange for a mesh that should stay usable as it grows.

The catch is structural. Each hop needs another bitchat user physically standing in the gap. An internet messenger needs your friends to install it. A mesh messenger needs strangers between you and your friends to install it, which is a much harder network effect to bootstrap. That explains the most common App Store complaint: few people nearby use it, so the mesh is often empty. In ordinary daily life, expect the Bluetooth layer to be quiet. The calculus flips at a festival where a group installs it in advance, or in a community that adopts it as a preparedness tool.

The Hybrid Layer: Nostr and Geohash Channels

The Nostr integration is the project’s pragmatic concession. When a connection exists, messages can travel over Nostr relays, and that powers geohash location channels. These are public rooms tied to a geographic cell that can be as tight as a city block or as broad as a region. This is a clever answer to the empty-mesh problem. People in the same area can find each other even when they are too far apart for Bluetooth, and the app has a use on an ordinary connected day.

It also changes what the product is in those moments. A message carried by internet relays is no longer the off-grid, purely local exchange that defines bitchat’s pitch. It now depends on connectivity and on infrastructure outside the phones involved. Location channels are also public by design, so posting in a block-level channel tells everyone in it that you are near that block. Granularity works as a privacy dial, and the tightest settings deserve caution. Users have asked for a compass-based location option, which suggests appetite for richer location tools on top of the current system.

Delivery Logic

Direct messages follow a clear ladder: Bluetooth first, Nostr second, queue last. This is the most convincing piece of systems design in the app. Nobody has to pick a transport or understand one. The app tries the local, server-free route, escalates to the internet only when it must, and holds messages instead of dropping them when both paths fail. For a tool built for unstable conditions, queuing decides whether a message arrives late or never arrives at all.

Security: Sound Primitives, Unaudited Code

Private messages are end-to-end encrypted with the Noise Protocol, a respected framework for building secure channels. The app also has no accounts and no phone numbers, which leaves it with an unusually small identity footprint. There is no central registry of users for anyone to leak, scrape or demand. The triple-tap emergency wipe shows threat modeling that most messengers skip. It plans for device seizure as well as interception and makes erasure a reflex.

The README’s warning undercuts all of this in one sentence: no external security review, no sensitive use yet. Strong cryptographic building blocks do not guarantee a correct implementation, and relaying traffic through strangers’ devices creates attack surface of its own. Shutdowns, censored networks and disasters are high-stakes by definition, and the project itself says the software is not ready for sensitive work. We credit the developers for that candor. It still means anyone whose safety depends on confidentiality should treat bitchat as promising, not proven. Encryption covers private messages. Public channels are public.

Interface: IRC Rebuilt for Thumbs

The interface is modeled on IRC, and the familiar /msg, /who and /slap commands make the lineage plain. Anyone who grew up in chat rooms gets something fast, legible and charming. A text-first, command-driven design also suits the medium, because mesh bandwidth is scarce and short lines of text ask little of it.

For everyone else, the IRC framing is a barrier. Mainstream users expect buttons, not syntax, and typing slash commands on a phone keyboard is slower than tapping. That narrows the audience at the moment a crisis tool most needs broad uptake. The person who most needs bitchat during a blackout may be the person least likely to know what /who does. User requests for a way to send images over low-bandwidth Bluetooth show where a text-first mesh hits its limit.

bitchat’s interface is its art direction, and that interface is IRC: text-forward, command-driven and uninterested in ornament. The restraint fits the product. A tool meant to work on a crowded, degraded or absent network should not spend bytes or attention on decoration, and a chat-room layout makes channels and messages the visual hierarchy. The cost is warmth and approachability for newcomers. User requests for more custom fonts and colors suggest the presentation layer is sparse and that some users want to make it their own.

Running a Bluetooth mesh is expensive in principle. The radio has to keep discovering peers, and every phone in a chain spends power forwarding traffic that is not addressed to it. bitchat targets both costs. LZ4 compression shrinks messages so each transmission is shorter, and adaptive battery modes let the app scale its activity up or down. Those are the correct levers for this architecture. By design, battery cost should rise with mesh density and relay load, and multi-hop delivery should be slower than a direct link because each hop adds a leg to the trip. Keeping payloads to small text messages is the right default for a medium where bandwidth is the scarcest resource.

• Pricing: Free on both iOS and Android, and App Store users specifically praise the absence of ads.
• iOS: Appears on the App Store as “bitchat mesh”, rated 4.7/5 from 525 ratings. Availability is not universal. The removal from the Chinese App Store shows that a store gatekeeper can cut off a censorship-resistant tool at the distribution layer, even when its code is open.
• Android: Offers the same free, open-source app, and the public GitHub repository applies equally to both platforms.
• Input: On both platforms the design relies on touch, which makes the IRC command model more cumbersome than it is on a physical keyboard.
• Background behavior: Each mobile operating system sets its own rules for background Bluetooth activity, so how a phone sitting in a pocket behaves as a relay depends partly on Apple and Google, not only on the app.

A mesh is only as dense as its install base, so shipping on both major mobile platforms is the minimum requirement for the idea to work at all.

bitchat gets the hard parts of its design mostly right. The mesh relay, the layered delivery ladder and the refusal to collect identity data form a coherent answer to a real problem: communicating when the network is missing, overloaded or hostile. The Nostr layer and geohash channels give it a use on connected days. The emergency wipe reflects threat modeling most messengers skip, and the app costs nothing.

Two limits hold it back. The first is density. A mesh messenger is only as good as the number of strangers standing between you and the person you want to reach, and App Store users say that crowd is often missing. The second is trust. The developers themselves warn that the code has not been externally reviewed, and that matters most in the shutdown and censorship scenarios that built bitchat’s reputation. Apple’s removal of the app from the Chinese App Store shows how seriously some governments take it. An independent audit would let at-risk users take it just as seriously.

We recommend it to the right audience: install it alongside the people you would need to reach in an emergency, and treat it as a coordination tool rather than a vault for secrets. That is the sensible way to use a project this promising at this early stage of its security story.