Version 1.7.1 combines a local mesh with Nostr relays
bitchat has two delivery systems under one chat interface. Version 1.7.1 uses Bluetooth Low Energy for nearby discovery and relaying, then can fall back to Nostr for internet delivery. Direct mesh conversations establish Noise sessions, while the Nostr path wraps private messages in bitchat's own encrypted envelope. There are no phone numbers or project accounts. That makes the app useful during an outage, though Nostr relays and Apple's location services still become outside parties when users enable internet and geohash features.
Public mesh packets can travel up to 7 hops, and the README describes more than 440 Nostr relays for wider delivery. The app chooses Bluetooth first for a reachable peer, falls back to Nostr when it has the recipient's public key, and queues a message when neither route is available. Location channels use geohashes with block, neighborhood, city, province, and broader regional precision. Private envelopes only work between bitchat clients because the format does not implement NIP-17, NIP-44, or NIP-59.
What happened when we ran it
Our sandbox installed 479 Rust packages in 57 seconds under localPackages/Arti/, the vendored Tor implementation used by the Swift package. That Rust code built successfully in 119 seconds. We ran commit 9b84b36 inside an unprivileged container with 3 CPUs and 12 GB of RAM. This was the buildable project our Debian harness found, rather than the root Apple application, so the success should not be read as an iOS or macOS compile result.
Cargo test completed in 14 seconds and reported 0 passed and 0 failed of 0. The repository contained 633 files, roughly 156,642 lines of source, and used 46.6 MB before installation. Our structural scan found 5 CI workflows, no Dockerfile, and no directory literally named tests. The source tree does contain a sizeable bitchatTests SwiftPM target. Running that suite requires the Apple toolchain, and Bluetooth behavior needs physical hardware beyond a simulator.
Public messages and radio metadata remain observable
The July 2026 privacy assessment is more useful than the usual privacy slogan. It says public mesh, board, bridge, and geohash content is visible to participants. Nearby observers can see timing, traffic volume, and radio characteristics. The fixed Bluetooth service UUID also identifies that bitchat is in use. A persistent peer identifier derived from the Noise key can let a receiver recognize the same device across sessions and places.
Private content gets stronger protection, with Noise for live mesh sessions and XChaCha20-Poly1305 on the proprietary Nostr fallback. Metadata remains. Undelivered private messages and courier envelopes can persist for up to 24 hours, public gossip can remain for 6 hours, and managed media has a 100 MB quota plus a 7-day age limit. Panic wipe covers the listed stores. An unlocked seized device can still reveal retained conversations, relationships, media, and selected locations.
Version 1.7.1 repaired concrete identity and media flaws
The v1.7.1 release bound Noise sessions to claimed peer identities, encrypted private media before Bluetooth fragmentation, pinned announcement signing keys, moved identity keys to device-only storage, and made panic wipe deterministic. It also changed identity continuity: deleting the app or moving to a new phone no longer preserves the same identity. Those fixes are meaningful because they address impersonation, relay visibility, and device extraction rather than rearranging the interface. Older versions do not receive security patches under the project's policy.
A busy tracker is still part of the buying decision. GitHub listed 144 combined issues and pull requests. Issue 1518 reports Android-to-iOS photos and voice notes failing while text and the reverse media direction worked in the reporter's tests. Recent open pull requests also discuss identity-change warnings, read-receipt consent, radio metadata, and packet limits. The activity shows people working on real failures; it also shows a protocol and client set that are still being hardened.
Release manifests verify source, while mirror binaries remain untrusted
Each tagged release includes a source manifest with a SHA-256 entry for every tracked file. The verification guide explains how to compare file hashes, detect extra untracked files, check a git tree hash, and verify the manifest's GitHub attestation. That is careful advice for software used during network shutdowns, when users may encounter hurried mirrors. Building the verified source still calls for a Mac and full Xcode.
The chain stops at compiled copies outside the App Store. The project says there is no published signing-key fingerprint, no reproducible build pipeline, and no independent non-GitHub source mirror. A v1.7.1 archive obtained from an unofficial forum therefore cannot be compared with an authenticated expected binary. The recommended choices are the App Store or a self-built app from checked source. For sensitive use, a familiar icon and working chat screen provide no evidence that a mirror has left keys and plaintext alone.
Five workflows and an August push show active maintenance
GitHub recorded 36,111 stars, 144 open issues and pull requests, and a last push on August 30, 2026. The latest release was v1.7.1 on July 31, following v1.7.0 on July 8 and v1.6.0 on July 7. Combined with 5 workflow files and detailed privacy and security documents, those dates show an active project with frequent review. The combined open count includes proposed changes, so it should not be described as 144 bugs.
For an ordinary user, the official build offers a rare mix: nearby mesh chat, encrypted direct messages, and internet fallback without a registration system. For a developer or high-risk organization, our 479-package Arti build and zero-test Cargo result leave the main app unverified. Run the Swift suite, test several physical devices, verify identities, assume public channels are monitored, and decide whether fixed radio identifiers and proprietary Nostr envelopes fit the actual threat model before relying on bitchat during an emergency.