The government switched off the internet — and this chat app kept working anyway, by turning every phone in the crowd into a tiny radio tower

Picture the moment the internet dies.

Not your Wi-Fi dropping — the whole thing. A government flips a switch, the mobile networks go quiet, and every app on your phone that needs a signal turns into a frozen loading spinner. It happens more than you’d think: during protests, coups, and “national security” blackouts, authorities routinely pull the plug on entire countries’ internet.

Now picture your phone buzzing anyway. A message arrives — “police moving up the east side, go west” — sent by someone three streets over. No cell tower touched it. No server saw it. It hopped, quietly, from one phone to the next through the crowd, like a whispered rumour passed hand to hand.

That’s not a thought experiment. It’s an app called Bitchat, and this month it topped GitHub’s trending charts again and crossed 3 million downloads. It is one of the most genuinely clever pieces of consumer tech to appear in years.

It also can’t yet promise the one thing its users most need it to. Let’s start with why it’s a marvel — then the catch its own creator put in writing.

✨ The wonderful part: it turns a crowd into the network

Every messaging app you’ve ever used — WhatsApp, iMessage, Signal, Telegram — works the same way: your message travels up to a company’s servers, then back down to your friend. Cut the internet and that road is gone. The app is useless.

Bitchat throws that model out. Released in July 2025 by Jack Dorsey — co-founder of Twitter and Block — it uses a Bluetooth mesh network. Every phone running the app becomes a tiny relay: your message leaps by Bluetooth to the nearest Bitchat phone, which passes it to the next, and the next — up to 7 hops — until it reaches whoever you’re talking to.

Each hop only reaches about 30 feet, but chain enough phones together and a message can cross a whole protest, a stadium, or a blacked-out neighbourhood — with no internet, no phone number, and no account anywhere in the loop. There’s nothing to sign up for. You open it and you’re on.

What makes it more than a party trick:

Properly encrypted. Private messages are wrapped end-to-end with the Noise Protocol — the same well-regarded framework used inside serious tools — using modern ciphers like Curve25519 and AES-256-GCM.

An internet mode too. When you do have a connection, it hops onto the decentralised Nostr network to reach people worldwide, then falls back to Bluetooth the instant the signal dies.

A panic button. A triple-tap instantly wipes everything on the device — built for the moment a phone is about to be taken.

Free and open. The entire codebase is public, so anyone can inspect it, build it, and verify it.

And people don’t just admire it — they rely on it when it matters most.

During the Nepal protests of September 2025, the government banned 26 social platforms and the network went dark. The country’s Gen Z protesters turned to Bitchat to keep organising, and it saw more than 48,000 downloads at the peak — over a third of all its installs to that point (Forbes). When the internet is the thing being used against you, an app that doesn’t need it stops being a novelty and becomes a lifeline.

It feels like magic. Which is exactly the moment to slow down — because the same story has a second half.

A quick word from today’s sponsor — then straight back to the story.

— ADVERTISEMENT —

The tech behind the headlines, decoded once a day. itscybernews explains the tools quietly reshaping your phone, your money, and your privacy — in plain English, no jargon, no hype. The wonder and the trapdoor, every single morning.

→ Forward this to one curious friend — it’s the single best way to help us grow.

🎭 The trapdoor: it can’t yet prove you’re talking to you

Here’s the uncomfortable truth, and it comes straight from the app’s own creator.

When Dorsey launched Bitchat, the tech press swooned — one outlet even claimed it beat WhatsApp and Signal on security. Security researchers took one look under the hood and winced. Within days, a TechCrunch headline said it plainly: Jack Dorsey says his “secure” new Bitchat app has not been tested for security. Dorsey himself had put a warning right in the code — this software hadn’t had an external security review, so don’t rely on it (TechCrunch).

Then a researcher proved why that warning mattered. Alex Radocea demonstrated a man-in-the-middle attack: Bitchat’s system for verifying who you’re actually talking to was broken. By intercepting the digital “handshake” that binds an identity to a person, an attacker could impersonate a trusted contact — sitting invisibly in the middle of your conversation, reading and relaying messages while both sides believe they’re talking privately (Futurism).

This is the nightmare scenario for a protest tool. The whole point is trusting that “police moving east” really came from your friend — not from someone who slipped into the chain to feed the crowd false directions. Radocea’s warning was blunt: some people could rely on it for their safety, and in its state at the time, the project could endanger them.

The independent security firm Trail of Bits reviewed the whole debate and reached a sober verdict: the flaws were real and serious, and users should “absolutely not rely on Bitchat for sensitive communications in its current state” (Trail of Bits).

Ouch. But — and this is the part most hot takes skipped — that’s not the end of the story either.

🌀 The plot twist: “secure” is a process, not a sticker

Here’s where it gets more interesting than “app good” or “app bad.”

Dorsey’s real mistake wasn’t shipping imperfect code — almost everything ships imperfect. His mistake was talking up dangerous use cases like protests while his own README quietly said don’t. When you’re one of the most amplified people in tech, that gap between the marketing and the fine print is the actual danger.

But look at what happened after the criticism, because it’s the template for how this is supposed to work. He open-sourced the entire thing, which is the only reason researchers could find the flaws at all. He patched a buffer-overflow bug in under four hours of it being reported. And within a week, he rebuilt the app around the battle-tested Noise Protocol, directly targeting the authentication weakness.

Trail of Bits’ takeaway is the one worth remembering: security is a process, not a binary state. The right question isn’t “was it perfect on day one?” — nothing is — it’s “does it get fixed in the open, fast?” A brand-new app being torn apart by experts in public and patched within hours is, weirdly, a healthier sign than a slick app nobody is allowed to inspect.

Two quieter catches are worth knowing, too. Metadata leaks even when messages don’t: the mesh uses a persistent per-device identifier, so while your words are encrypted, a nearby radio can still notice that a device is present and chattering. And fake copies are a real risk: because the app has faced takedown demands, unverifiable “mirrors” pop up — so the project now ships a way to check any build against a per-release fingerprint.

So: a real marvel, with real teeth, maturing in real time. Which means the smart move isn’t “install it” or “avoid it” — it’s to use it for the right job, the right way.

🛡️ How to use an app like this without getting burned

Think of Bitchat like a brilliant CB radio for the smartphone age: incredible when the normal channels are down, wonderful for casual local chatter — but not the thing you’d trust with a secret that could get someone hurt. A few firm rules keep it on the right side of that line.

1. Match the tool to the stakes. For “the internet is down and I need to reach people nearby,” it’s superb. For “if this message leaks, someone goes to jail,” reach for a mature, audited tool like Signal instead — and treat Bitchat as the backup for when Signal can’t connect.

2. Only install the real thing. Get it from the official App Store listing or build it from verified source — never a link someone messaged you, and never a random “mirror.” A fake privacy app is worse than no privacy app.

3. Verify your people another way. The whole weak spot is “am I really talking to my friend?” Confirm identities in person, or over a channel you already trust, before you act on a high-stakes message.

4. Learn the panic button before you need it. Know that a triple-tap wipes everything, and practise it once. If a phone is about to leave your hands, that’s when it earns its keep.

5. Assume your presence is visible. Encrypted content is not the same as invisibility — a nearby device can tell someone is running the app. Encryption hides the what, not always the that.

6. Watch how it matures, not how it’s marketed. Ignore breathless “more secure than WhatsApp” claims. Follow whether it keeps getting audited and patched in the open. The update history tells you more than the sales pitch.

✅ The takeaway

Bitchat is a genuine leap: a free, open app that turns a crowd of phones into its own private internet, keeps working when a government pulls the plug, and has already helped real people stay in touch when every other app went dark. That’s a category of tool the world quietly needs more of — and 3 million people have now downloaded it.

But the same story carries its own warning label, written by the app’s own creator: it hasn’t cleared the bar that battle-tested tools like Signal spent a decade clearing, and a researcher showed it could be tricked into letting a stranger pose as your friend. The reassuring part is that its flaws are being hunted and fixed in the open, fast — which is exactly how security is supposed to grow up.

So don’t treat it as magic, and don’t dismiss it as broken. Treat it as what it is: a brilliant, still-maturing lifeline. Use it when the internet fails and the stakes are low, lean on Signal when the stakes are high, install only the real copy, and check who you’re really talking to. Do that, and you get the marvel without the trapdoor.

The most powerful message on earth is one no server can switch off. Just make sure it’s really your friend on the other end.

This is a plain-English safety briefing about a new technology, not security advice for a specific threat. If your safety genuinely depends on a message staying private, use tools built and audited for exactly that.

Was this useful? Forward it to the one friend who’d love a chat app that works with the internet switched off — they’ll want the safety half too.