Elon Musk spent his Friday engaging with criticism directed at competitors following the launch of the XChat app, a stand-alone messaging option for users of X. Among the messages he shared was a claim that “Signal, WhatsApp, Telegram, and iMessage all have serious security problems,” positioning XChat as “the only secure, encrypted messaging app.” However, encryption experts have voiced cautious skepticism regarding XChat’s security measures, defending established platforms like Signal as reliable alternatives.
One notable concern surrounding XChat is its requirement for users to link an existing X account to access the messaging service. Maria Villegas Bravo, counsel at the Electronic Privacy Information Center, expressed her reservations, stating, “I’m a little suspicious of that, because the more data points you connect together about a person, the more you can track what they’re doing.” Bravo also highlighted Musk’s previous criticisms of other messaging apps as potentially self-serving.
Last year, when Musk first introduced XChat as an encrypted version of direct messages on X, security experts raised questions about the app’s design, particularly its decision to store users’ cryptographic keys on X’s servers rather than on-device, as is the practice with Signal. Cooper Quintin, a senior staff technologist at the Electronic Frontier Foundation, advised caution, saying, “Given XChat’s history of security vulnerabilities, I would hesitate to use this until it’s received a thorough outside auditing.” While Musk may aim to spark a debate over which encrypted messaging app reigns supreme—XChat, Signal, or WhatsApp—the reality is that XChat’s functionality may evoke memories of a less glamorous competitor: Facebook’s Messenger.
Late Launch
The XChat team initially announced a wide release earlier this month, with the anticipated launch date on Apple’s App Store set for April 17. However, this date experienced multiple shifts, moving from April 23 to April 24, and even suggesting April 25 and April 27 before the app unexpectedly launched on the 24th. As of now, an official launch date for Android remains unconfirmed.
During the prelaunch phase, users encountered difficulties locating the correct app, as another application with the same name, designed in Russian and unrelated to Musk, surged to prominence on Apple’s free download charts. One user review cautioned, “Scam app, this is not the real XChat.” When XChat finally became available, the rollout appeared disorganized; while users in the US could access the app, those in the UK faced delays. Nikita Bier, head of product at X, responded to user frustrations on social media, stating, “UK should be live soon; had one snag.” Early adopters also reported confusion during the onboarding process, prompting Bier to suggest they “blame Apple” for the app’s requirements.
First Impressions
Upon downloading XChat, I found myself uncertain about whom to message first. A glance through my iMessage history revealed that none of my top five contacts even had X accounts. This initial experience underscored XChat’s niche appeal, raising questions about its practicality for everyday messaging needs. In an effort to connect, I revisited old DMs and reignited three previous conversations. After sending my messages, a pop-up confirmed, “This conversation is now end-to-end encrypted.” However, the lack of responses left me with only emoji reactions to show for my efforts.
Beyond the limited scope of messaging only those with X accounts, the features of XChat appeared poorly executed. Users have the option to enable “block screenshots,” but this setting is not activated by default and must be manually adjusted for each new conversation. For those seeking encrypted messaging solutions, established platforms already offer reliable options. As Quintin succinctly stated, “If what you want is good security, use Signal. If you want to talk to pretty much anybody using encrypted messages, use WhatsApp.” He added, “If your whole life is based around X, I guess this is better than nothing.”
The app’s privacy measures also raised eyebrows. While the download page for XChat claims, “No tracking. Total privacy,” the accompanying information suggests otherwise, listing “data linked to you” that includes contacts, identifiers, and usage data. Furthermore, clicking on the “developer’s privacy policy” redirects users to the general X page rather than a specific policy for XChat.
Another Messenger
XChat’s privacy policy is not the only aspect it shares with X. Accessing the Help tab in XChat opens X’s help center in a browser window outside the app, mirroring the experience of navigating other essential documents like the Terms of Service and Cookie Use policy. A button in the lower left corner of the XChat app is solely designed to redirect users back to the X app.
This realization led me to conclude that XChat bears a striking resemblance to Facebook’s Messenger. Both platforms provide encrypted messaging, with Messenger set to make encryption the default for most chats in 2024. Similar to XChat, Messenger requires users to create a Facebook account, linking the two together. Messenger also features a button that quickly returns users to the Facebook app, paralleling XChat’s design.
Ultimately, XChat seems to echo the pointlessness of Messenger for many users. With Messenger, I often find myself engaging with relatives who send me unhinged videos or dubious news articles, despite having my cell phone number and other means of communication. I suspect I may miss messages on XChat as well, as it appears to be yet another niche player in the crowded messaging landscape. Outside of dedicated X users, XChat risks being perceived as a frivolous platform lacking the necessary appeal to carve out a significant space in the market.
