RepoDaily · 2026-07-27 · Security tool

bitchat: A Bluetooth-Mesh Messenger That Treats the Internet as Optional

#2 Security tool Swift +1,198 permissionlesstech/bitchat Open repository

bitchat pairs a Bluetooth LE mesh with Nostr relays to deliver account-free, IRC-style chat that still works when the network is gone, jammed, or hostile.

Repo typeSecurity tool
Best forOffline-first communicators, field and disaster-response teams, and privacy-focused users who want IRC-style chat without phone numbers or servers.
Risk levelMedium — volunteer-maintained, proprietary Nostr envelope format, and documented metadata exposure on the mesh.
Time to evaluate1–2 hours to install from the App Store, run `/who` and `/msg` over BLE, and read WHITEPAPER.md plus SECURITY.md.

Primary question: Does the BLE-plus-Nostr dual transport fit your threat model better than a standard end-to-end encrypted messenger?

89/100

RepoDaily adoption score

RepoDaily rates this as 89/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.

Directional score from RepoDaily sources and adoption notes, not a benchmark.Risk: Medium
100Evidence quality

5 source(s) across 4 source category/categories, plus a RepoDaily-specific evidence module when available.

92Installability

7 workflow step(s), 6 next-action step(s), and 1 command/install signal(s) were detected.

70Maintenance confidence

Trending momentum is +1,198 stars, with maintenance/release/issue signals counted when present.

96Production readiness

Risk is marked medium, with 7 security note(s) and 4 explicit skip condition(s).

100Differentiation

3 opportunity lens item(s), 4 alternative(s), and 3 type-specific section(s) support differentiation.

82License clarity

License source or license wording is present.

60Agent / AI fit

2 AI/agent-related signal(s) were detected in the article text and metadata.

Project overview

bitchat is a decentralized peer-to-peer messaging app written in Swift and shipped as a universal iOS and macOS application. Its hook is a dual transport architecture: a local Bluetooth Low Energy mesh for offline communication, and the Nostr protocol over the internet for global reach. The README pitches it bluntly as “the side-groupchat” — no accounts, no phone numbers, no central servers.

The offline path is where bitchat differentiates itself. Devices discover each other over Bluetooth LE and relay messages across up to seven hops, so a message can travel well beyond a single radio's range without any infrastructure. When internet is available, the app falls back to Nostr relays — more than 290 of them, according to the README — and uses geohash coordinates to create location-based channels that span the globe.

Security is not an afterthought. Private messages use the Noise Protocol over the mesh, while Nostr private traffic rides inside BitChat-specific encrypted envelopes. The app exposes familiar IRC-style commands (`/slap`, `/msg`, `/who`), includes a triple-tap emergency wipe, and ships with LZ4 message compression plus adaptive battery modes. The repository has also attracted takedown demands, which the README cites as the reason for a per-release hash manifest in docs/VERIFYING-A-BUILD.md.

Problem it solves

  • Standard messengers depend on central servers and phone-number identity, which fails when infrastructure is down or when registries are surveilled.
  • Disaster scenarios, protests, and remote field work often have no reliable internet path at all.
  • Many “private” apps still leak metadata through phone-number discovery, push-token registries, or relay-side account binding.
  • Existing mesh tooling is often platform-fragmented, hard to verify, or unsupported on iOS and macOS.

How it works

  1. Install from the App Store (bitchat-mesh, id6748219622) or build from source you have verified using docs/VERIFYING-A-BUILD.md.
  2. Generate a local identity key — no phone number or account is required.
  3. Nearby devices discover each other over Bluetooth LE and form a mesh; messages relay through peers up to a documented maximum of 7 hops.
  4. Private messages over the mesh use Noise Protocol sessions with forward secrecy for live sessions.
  5. When internet is reachable, the app falls back to Nostr relays, wrapping private payloads in BitChat private envelopes inside kind-1059 events.
  6. Join geohash-based location channels or use IRC-style commands such as `/who`, `/msg`, and `/slap` to interact.
  7. Trigger a triple-tap emergency wipe if you need to instantly clear all local data.

Architecture Read: How the Dual Transport Actually Connects

  • Bluetooth LE mesh handles offline communication with peer discovery, multi-hop relay, and a documented maximum of 7 hops.
  • Mesh private messages use the Noise Protocol with forward secrecy on live sessions; store-and-forward mail is sealed without forward secrecy, as noted in the README's reference to the whitepaper.
  • Nostr transport connects to 290+ relays for global reach and uses geohash coordinates to create location-based channels.
  • Private Nostr traffic uses BitChat private envelopes inside kind-1059 events whose `v2:`-prefixed content is a BitChat-specific XChaCha20-Poly1305 construction — explicitly not NIP-17, NIP-44, or NIP-59.
  • Ephemeral keys are generated per geohash area, limiting linkability across locations.
  • Performance work includes LZ4 message compression, adaptive battery modes, and a binary packet format tuned for Bluetooth LE constraints.

Try-It Path: Verifying a Build Before You Trust It

The README is explicit that a compiled build from anywhere other than the App Store or your own verified source cannot be checked. Start from the App Store listing at apps.apple.com/us/app/bitchat-mesh/id6748219622, or clone permissionlesstech/bitchat and follow docs/VERIFYING-A-BUILD.md to compare source against the per-release hash manifest.

With two devices in Bluetooth range, open a `mesh #bluetooth` channel, run `/who` to list nearby peers, and send a private message with `/msg` to confirm Noise session setup. Then disable internet on both devices and verify that messages still relay across hops. Finally, re-enable network and confirm that a geohash channel reaches Nostr relays. The triple-tap emergency wipe should be tested last so you can confirm all local data is destroyed.

Maintenance Risk: Volunteer Project, Narrow Scope

  • SECURITY.md states plainly that bitchat is volunteer-maintained, with acknowledgement aimed at under one week and no bug bounty.
  • Fixes ship only to the latest App Store release and the `main` branch; older releases are not patched.
  • The repository has been the target of takedown demands, and unverified mirrors may appear if the repo or releases page disappears.
  • Historically, confirmed protocol and key-handling issues have been fixed within days, per SECURITY.md.

Who should pay attention?

Good fit if

  • Field teams, disaster-response groups, and event staff who need chat when cellular and Wi-Fi are unreliable.
  • Privacy-focused users who want messaging without phone numbers, accounts, or central servers.
  • iOS and macOS users looking for a native, IRC-style command interface inside a mesh messenger.
  • Security researchers who want to inspect Noise-over-BLE and the proprietary Nostr envelope format.

Skip for now if

  • Teams that need guaranteed multi-day message delivery and server-side search.
  • Users who require NIP-17, NIP-44, or NIP-59 interoperability with other Nostr clients.
  • Organizations that need a vendor SLA, paid support, or a formal bug bounty program.
  • Anyone uncomfortable with the documented fact that BLE proximity and mesh announces are observable by design.

Risks and cautions

Medium

Strong threat-model fit for offline-first use, but volunteer maintenance and a proprietary Nostr envelope limit scale and interoperability.

  • Volunteer-maintained with no bug bounty, per SECURITY.md.
  • Private Nostr envelopes are BitChat-specific and explicitly not NIP-17, NIP-44, or NIP-59.
  • Mesh announces, nicknames, public keys, and geohash channel content are public by design.
  • Older releases are unsupported; only the latest App Store release and `main` receive fixes.
  • Takedown demands mean users must verify builds against docs/VERIFYING-A-BUILD.md before trusting binaries.
  • Noise Protocol is used for end-to-end encryption over the Bluetooth mesh, with forward secrecy on live sessions.
  • Nostr private messages use BitChat private envelopes — a proprietary XChaCha20-Poly1305 construction inside kind-1059 events, not NIP-44.
  • No accounts, phone numbers, or central servers are required by design.
  • Triple-tap emergency wipe is in scope under SECURITY.md and must actually destroy what it claims to destroy.
  • Downgrade paths — anything that silently moves traffic from an encrypted path to plaintext — are explicitly in vulnerability scope.
  • Tor routing correctness and supply-chain integrity of vendored binaries are both named as in-scope security properties.
  • Public mesh announces, BLE proximity, mesh flooding, and third-party relay behavior are documented as out of scope, not vulnerabilities.

Alternatives to compare

ApproachWhen to useTrade-off
Briar
When you need a mature, cross-platform mesh messenger with Tor-based internet transport and long-form forums.Free, GPL-licensed.
Signal
When you want the most audited end-to-end encrypted messenger and do not need offline mesh.Free.
Nostr clients (e.g. Damus)
When your priority is native NIP-17/NIP-44/NIP-59 interoperability across the broader Nostr ecosystem.Free.
Bridgefy
When you need a commercial Bluetooth mesh messenger with broader device reach and paid support.Free with commercial tiers.

What this trend reveals

Offline-first field communication

The BLE mesh with up to 7 hops and no internet requirement fits disaster response, events, and remote work where infrastructure is unavailable.

Run a two-device test in airplane mode and confirm message delivery through `/who` and `/msg` over `mesh #bluetooth`.

Censorship-resistant group chat

No accounts or phone numbers and the option to fall back to 290+ Nostr relays lower the surface for surveillance and takedown.

Confirm geohash channel reach over Nostr with internet enabled, then verify the triple-tap wipe clears state.

Security research surface

The proprietary BitChat envelope and Noise-over-BLE path are concrete targets for protocol and key-handling review.

Read WHITEPAPER.md, then file findings through GitHub private vulnerability reporting as SECURITY.md requires.

Best next action

Install, verify, and run a two-device BLE smoke test

Start from the App Store or a source build you have verified, then exercise the offline path before trusting the app in any sensitive setting.

  1. Install bitchat from the App Store listing (bitchat-mesh, id6748219622) or build from `main` after checking docs/VERIFYING-A-BUILD.md.
  2. Read WHITEPAPER.md for identity and metadata exposure, and SECURITY.md for what is and is not in vulnerability scope.
  3. Put two devices in Bluetooth range, open a `mesh #bluetooth` channel, and run `/who`, `/msg`, and `/slap`.
  4. Disable internet on both devices and confirm multi-hop relay still delivers messages.
  5. Re-enable internet, join a geohash channel, and confirm Nostr fallback reaches a relay.
  6. Test the triple-tap emergency wipe last to confirm all local data is destroyed.

RepoDaily verdict

bitchat is a genuinely distinctive Swift messenger: BLE mesh offline, Nostr online, IRC-style commands, no accounts. Its proprietary Nostr envelope, volunteer maintenance, and documented mesh metadata exposure make it a strong fit for offline-first and censorship-resistant use, but not a drop-in replacement for mainstream encrypted chat.

Sources