AnalysisPublished 5 Jun 2026

Elon Musk’s XChat: how secure is the new messaging app? | Kaspersky official blog

Source Kaspersky Security Blog

Description

Breaking down Elon Musk’s XChat: how its end-to-end encryption works, why experts have slammed its PIN system, and how the new service stacks up against Signal, WhatsApp, and Telegram.

Impact

The main impact is the reduced confidentiality of user communications due to private keys being stored on XChat servers rather than exclusively on user devices. This design allows the service operator or an attacker who compromises the servers to potentially access private keys and decrypt user messages. The weak four-digit PIN protecting these keys is susceptible to brute-force attacks, increasing the risk of unauthorized access or permanent loss of encrypted chat history. Additionally, initial message requests sent without encryption expose metadata and message content to interception. These factors collectively undermine the privacy and security assurances typically expected from end-to-end encrypted messaging apps.

Defensive guidance

Users should avoid using predictable or easily guessable PINs, such as birth years or common sequences like '1234'. It is critical not to forget the PIN, as losing it results in permanent loss of access to encrypted chat history. Users are advised to store their PIN securely in a password manager rather than in insecure notes. Until improvements or official fixes are released, users requiring strong privacy should consider using established secure messaging apps like Signal or WhatsApp instead of XChat.

Summary

XChat, Elon Musk's messaging app launched in April 2026 for iOS, claims to use 'Bitcoin-style encryption' and end-to-end encryption but stores users' private keys on its servers within hardware security modules (HSMs). This contrasts with apps like Signal, which keep private keys solely on user devices. XChat protects these server-stored keys with a four-digit PIN, which is vulnerable to brute force due to its short length and the app allowing 20 attempts. The app requires users to follow or have interacted before enabling encrypted chats; otherwise, initial messages are sent unencrypted. Users must create a PIN to decrypt past messages, but the app prompts for this PIN before setup, causing confusion and potential loss of chat history if the PIN is forgotten or reset. Experts criticize this architecture as weakening privacy guarantees and making the app less secure than established encrypted messengers.

References

kaspersky.com/blog/xchat-privacy-security-risks/55930/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jun 2026, 14:24 UTC

References

Community reviews