Elon Musk spent Friday retweeting criticism of rivals after the launch of the XChat app, a private messaging option for X users. “Signal, WhatsApp, Telegram, and iMessage all have serious security issues,” the message Musk retweeted read, in part. “XChat is the only secure, encrypted messaging service.” Encryption experts I spoke to before the launch expressed serious skepticism about XChat’s execution and defended other social media platforms, such as Signal, as stronger options.
One of the red flags of XChat is that users must connect an existing X account to log in and initiate messages. “I suspect that, because the more information you have about a person, the more you can see what they are doing,” said Maria Villegas Bravo, a consultant at the Electronic Privacy Information Center. Bravo considers Musk’s past attacks on other apps troubling and self-serving.
Last year, when Musk introduced XChat as a revamped, encrypted version of direct messaging on X, security experts questioned the effectiveness of storing users’ cryptographic keys on X’s servers instead of using Signal. “Given XChat’s history of security vulnerabilities, I would hesitate to use this until it receives a thorough external investigation,” said Cooper Quintin, senior staff expert at the Electronic Frontier Foundation.
While Musk wants the conversation to be about which messaging app is better—XChat vs. Signal vs. WhatsApp—that’s the wrong comparison. After downloading XChat and compatibility, there is another, more fun chat app that reminds me of it: Facebook Messenger. That app you might have on your phone because of the obligation to text your grandma every once in a while? Of course. Instead of launching a new messaging app with private text, Musk dropped an unusual, featureless extension of his social media platform that happens to include encrypted messaging.
Late Launch
When the XChat team posted earlier this month about the app’s wide release, the “anticipated” launch date listed on Apple’s App Store page was April 17. This date changed several times before the release, shifting from the original date to April 23, then April 24. The app also showed April 25 and April 27 as possible launch dates, before they were dropped. unexpectedly on the 24th. (An official Android launch date has not been announced.)
At this time of launch, the correct app did not always appear when searching for its name. The app, which also goes by the name “XChat App,” although it has a Russian-language design and is not linked to Musk, has risen to at least seventh place on Apple’s free download charts in the social media category. “Scam app,” read one user review, “This is not the real XChat.”
When the XChat app finally arrived, the launch seemed like a no-brainer. Initially, people in the US could access the app, while those in the UK could not. “UK should be live soon; one snag,” wrote Nikita Bier, head of product at X, in response to frustrated posters on social media. When early downloaders again complained of confusion during the onboarding process, Bier told them to “blame Apple” and its app requirements.
First impressions
When I first downloaded the XChat app, I wasn’t sure who to message first. Looking at my iMessage history, none of the top five friends and family members who text me often even have X accounts. So, on the surface, XChat felt very niche for my actual messaging needs, setting aside any encryption concerns.
Lost and trying to find someone, anyone to message on XChat, I spent my afternoon scrolling through old DMs and decided to restart three previous conversations. After I send my nudge, a pop-up appears in the chat log, “This chat is now locked to the end.” Although I didn’t really need it because no one sent me a text message while I was testing the XChat app—I only received sad heart and fire emoji reactions in my messages.
