Bitchat, a free app from Jack Dorsey, sends encrypted messages straight from one phone to another over Bluetooth. It needs no internet, no mobile signal, no phone number and no account. I’m installing it. I don’t expect to use it every day. I’m installing it because of what it says about who controls the systems we rely on.
What bitchat actually is
Bitchat launched in July 2025 as a weekend project by Dorsey, the Twitter co-founder, with an open-source developer known as Calle building the Android version. It’s free and open source, and it runs on iPhone, Mac and Android.
Every phone running the app acts as a relay. A message hops from device to device, up to seven hops, until it reaches the person you’re writing to. It never touches a server. There’s no sign-up and no contact list harvested from your phone. Private messages are end-to-end encrypted using the Noise protocol, an established framework. A triple tap wipes everything.
When you do have a connection, bitchat can also route messages over Nostr, a decentralised network of relays popular with the Bitcoin crowd. That gives it location-based chat rooms and a fallback for private messages when the person you want isn’t within Bluetooth range.
Where it has already mattered
The adoption figures tell the story better than the marketing.
When Nepal blocked 26 social media platforms in September 2025, bitchat downloads went from about 3,300 a week to nearly 49,000. It spiked again during protests in Indonesia and Madagascar. When Hurricane Melissa hit Jamaica in October 2025, it became the second most downloaded free app on the island while connectivity was down to around 30% of normal. In January 2026 it topped the app charts in Uganda as the internet was cut ahead of the election, and it was used in Iran during a shutdown too.
Then India. After shutdowns in Delhi this July, India briefly accounted for about 85% of global downloads. The government first told GitHub to restrict the code. This month it had the app removed from Apple’s and Google’s Indian stores, citing law and order and the difficulty of “lawful interception”. A challenge is before the Kerala High Court, listed for 11 November.
A government blocking a messaging app, not for anything said on it, but because it can’t see or switch it off, is worth noticing.
Why a CFO cares about this
My job is to find the single points of failure before they find the business. A supplier you can’t replace. A bank facility with one lender. A finance system nobody else understands.
Communications are a single point of failure most businesses never look at. WhatsApp, Teams, email and mobile networks all depend on someone else’s servers and someone else’s masts. Usually that’s fine. But power cuts, network outages and packed venues where the masts give up are not exotic events. Anyone who has tried to send a text from a sold-out grandstand on race day knows the feeling. Races are won in the garage, and the boring prep is where you decide how you’ll cope when it goes wrong.
A messenger that works with nothing but the phones in the room is a cheap backup. It costs nothing and takes a minute to set up. That’s my main reason for installing it.
The privacy point, made carefully
The second reason is the direction of travel.
HMRC can already take money directly from bank accounts under its Direct Recovery of Debts powers. Today that applies only to established debts over £1,000, owed by people who have repeatedly ignored HMRC, and it must leave at least £5,000 across their accounts. It has been consulting on extending the power to smaller debts, collected as monthly deductions, and The Times reported this week that the Chancellor is expected to announce changes in the Budget.
Let me be clear: people should pay the tax they owe, and bitchat won’t hide anyone from HMRC. That isn’t the point. The point is that the state’s reach into our financial lives is getting deeper and more automated. Each step is reasonable on its own. Together they make it more important that ordinary people have tools that don’t run through a central switch. When HMRC’s figure is wrong, and sometimes it is, the safeguards matter. The same goes for communications.
Bitcoin and bitchat come from the same idea: systems that keep working without anyone’s permission. You don’t have to be a zealot to see the value of having a spare.
What it isn’t
Bitchat is not a replacement for Signal or WhatsApp, and I wouldn’t use it for anything sensitive yet. Its early versions had real security flaws. Researchers showed in July 2025 that an attacker could impersonate a trusted contact. The developers moved to the Noise framework, commissioned an audit from Cure53, a respected German security firm, and patched the findings in January 2026. That’s encouraging, but the full audit report hasn’t been published. The app also uses a persistent device identifier that someone nearby with the right kit can observe.
Range is limited too. Bluetooth reaches tens of metres, so the mesh only works when there are enough other users nearby. In a field with three people, it’s a walkie-talkie for close friends.
And it has no followers, no feed and no profile, so it’s useless as a broadcast channel. You won’t find me building an audience on it.
My take
Install it, tell your family and your team where it is, and forget about it until the day the network goes down. Treat it like a fire extinguisher, not a phone.
The bigger lesson is about dependencies. Every business I’ve worked with has relied on something it didn’t control and hadn’t thought about. The cost of a backup is small. The cost of not having one only shows up when it’s too late.