XChat – Elon Musk’s Alternative to WhatsApp?

Elon Musk is promising another shake-up, this time in the field of instant messaging. The topic is the launch of XChat on the X platform (formerly Twitter). The platform’s owner has already labeled his new service as a “WhatsApp alternative.” Personally, I’m not inclined to participate. I don’t see a reason to be part of yet another experiment from Musk, who often promises revolutionary changes that usually turn out as expected. More details are provided below.

TABLE OF CONTENTS:

What is known

The X platform (formerly Twitter) has launched XChat, a new “encrypted” messenger that is positioned as a potential competitor to WhatsApp, Signal, and Telegram. On paper, the features appear comprehensive: end-to-end encryption, voice and video calls, disappearing messages, and unrestricted file sharing.

Musk is promoting XChat as part of his broader plan to turn X into an “everything app” – essentially a Western version of China’s WeChat. This is where caution is warranted. While consolidating multiple services into a single platform may seem convenient, it can also introduce significant risks.

I have no plans to switch to XChat. The reasons I already limited my own use of the X platform haven’t disappeared – in fact, they’ve become even more apparent.

The issue isn’t only the technical shortcomings of the new messenger (which exist and are significant). The concern runs deeper: it’s a matter of trust. Trust in the person who controls the platform.

In recent months, Musk has taken numerous actions that have eroded that trust – ranging from erratic decisions and hands-on moderation to unusual political statements and a clear disregard for user security. Someone who changes the rules based on their mood is not the person I would feel comfortable entrusting with my private conversations.

XChat: Security that doesn’t guarantee safety

Let’s start with the technical side of XChat – this is the area that should raise concerns for anyone even minimally concerned about privacy. Musk loudly claims the system is built on “Bitcoin-style” encryption and is written in Rust. It sounds impressive, almost revolutionary. The problem is that, as usual, Musk’s flashy statements tend to obscure what really matters: the vulnerabilities the company prefers not to discuss.

To begin with, the private keys are controlled by the platform rather than the user. In its current form, XChat cannot be considered a secure messenger – and this is not an exaggeration. The core issue lies in a fundamental architectural decision.

Users’ private keys are stored on X’s servers, rather than on their devices as Signal does. Technically, the keys are protected by a four-digit PIN, but they remain fully under Musk’s company’s control.

This means that if X decides tomorrow to “inspect,” “enhance security,” “optimize,” or simply comply with a “partner request,” access to the keys is already available – which automatically grants access to the messages themselves.

The concerns don’t stop there. X’s documentation explicitly states that XChat does not protect against man-in-the-middle (MITM) attacks.

For context: a MITM attack is one of the simplest ways to intercept encrypted messages by impersonating one of the participants in a conversation. It’s a problem Signal solved years ago, yet X isn’t even attempting to address it.

By comparison, Signal offers safety checks, QR code verification, and key comparison – basic mechanisms that let users confirm they are talking to the intended person. XChat offers none of these.

There’s another point that should make any cautious user step back: the lack of Perfect Forward Secrecy (PFS).

For context: in Signal, Perfect Forward Secrecy ensures that even if someone manages to obtain a private key, they can read at most one recent message – nothing more. XChat lacks this protection as well.

This means that if a key is ever exposed, an attacker could potentially access the entire message history. Imagine using a messenger for years and having everything suddenly accessible. A concerning definition of “security,” to say the least.

And one final detail: XChat’s implementation is fully closed. The source code is not public. Independent experts cannot review it. There is no audit, no transparency, and no external oversight.

In contrast, Signal publishes its code, undergoes regular independent audits, and has long been considered an industry standard precisely because anyone can verify its cryptography.

XChat, on the other hand, asks users to take Musk at his word – a risky proposition, given his track record of decisions that raise concerns about privacy, security, and consistency.

Metadata: the part you don’t see – and the part that can hurt you most

Even if we momentarily assume that XChat’s messages are somehow properly encrypted (they aren’t), the issue of metadata quickly brings us back to reality. And in this area, XChat looks even weaker than its competitors – significantly weaker.

Metadata is the seemingly “harmless” information most users overlook or underestimate. Who messaged whom, at what time, from which location, on what device, how often, what files were exchanged, and how long a call lasted. These details may not reveal the content of a conversation, but they can easily expose patterns of behavior, relationships, movements, and personal habits. In many cases, metadata can be more sensitive than the messages themselves.

This isn’t just a set of technical leftovers – it’s a complete digital profile of your life. Metadata can reveal your relationships, routines, movements, work patterns, personal matters, and even your fears or intentions. In some cases, it can predict your future actions more accurately than you can yourself.

X openly acknowledges that its metadata is not protected by end‑to‑end encryption. In other words, the company has full access to all of it – at any time, for any reason. This isn’t a minor drawback; it’s a fundamental privacy failure.

How do others handle this? Signal addressed the metadata issue years ago with its Sealed Sender mechanism, which hides even the fact of who is messaging whom. Even Signal itself cannot determine the sender.

WhatsApp is far from perfect, but it doesn’t expose metadata in such an unrestrained and easily accessible way. Its protections aren’t ideal, but at least there is a coherent security philosophy behind them.

Against this backdrop, XChat stands out for all the wrong reasons: it offers virtually no meaningful protection for metadata. Zero. Absolutely none.

And metadata – not message content – is often the most valuable asset. For advertisers, it’s a highly profitable resource. For intelligence services, it’s a ready-made map of your social connections. For cybercriminals, it’s a blueprint of your daily life.

Imagine a real scenario: a journalist communicates with a source in an authoritarian country. Even if the message content remains unreadable, metadata tells the entire story – the fact of the contact, how often the two communicate, their locations, and their activity patterns.

That alone can be enough to identify and silence the source. There’s no need to read the messages; simply knowing that the connection exists may be sufficient. Signal is designed to mitigate exactly these risks. XChat, by contrast, accepts them – and doesn’t even attempt to hide it.

Musk’s “Everything App” vision: Convenience as bait, control as the real goal

Elon Musk has long stated his intention to turn X into an “everything app,” modeled loosely on China’s WeChat.

In China, WeChat is far more than a messenger. It is used for communication, in-store payments, food delivery, taxi services, news consumption, and even dating. Essentially, it replaces dozens of separate services with a single platform.

It may sound convenient, but there’s a major drawback: WeChat is one of the most powerful tools for monitoring individuals. It collects nearly all available data – personal information, locations, payment histories, conversations, behavioral patterns, and even biometric data – much of which can be accessed by the state.

WeChat lacks end-to-end encryption like Signal or WhatsApp, allowing authorities to read messages, monitor transactions, and track the topics users discuss. Research from Citizen Lab has shown that accounts discussing “undesirable” topics can be blocked, and those conversations are used to train censorship systems.

Musk aims to create a similar ecosystem in the West. X is already introducing its own payment system, X Money, with XChat positioned as its central hub.

The concern is that an “all-in-one” platform gives the owner immense control over users’ data and communications. In Musk’s case, this could become a tool for influence and pressure – only instead of a government, control rests with a single billionaire, who is increasingly aligned with far-right political forces and authoritarian allies.

Read also: What’s Wrong with AI Browsers?

A person I cannot trust

XChat’s security issues are serious on their own, but they are not the main concern. The core threat is Elon Musk. As the person controlling all of X, he has full access to the platform’s systems and could, at any moment, change the rules, open access to data, or “share” information with political allies – not because he has to, but because he chooses to.

Recent months have shown a simple truth: Musk cannot be relied upon when it comes to free speech, privacy, or basic responsibility. His shift from eccentric tech billionaire to a public political agitator on the far-right spectrum is a warning sign for any user who does not want their data in the hands of someone with such views.

Musk has actively echoed Kremlin narratives about the war in Ukraine, calling it a “meat grinder,” repeating claims about the “impossibility of victory,” and advocating for a ceasefire on Russian terms. This rhetoric aligns entirely with Moscow’s position and serves its interests.

And it doesn’t stop there. Musk has openly supported the idea of the U.S. leaving NATO – the main guarantor of European security and a key deterrent against Russian aggression. He shared a post from a U.S. right-wing commentator calling for withdrawal from NATO and the UN, adding, “I agree.” For Europe, and especially for Ukraine, statements like this are not mere populism – they represent a real threat.

At the same time, he has intervened in the internal politics of European countries, supporting far-right parties, including Germany’s AfD. These are parties widely regarded as toxic, pro-Russian, and dangerous to democratic institutions.

And you are expected to trust this individual with your private conversations, contacts, photos, and metadata? To place the logic of all your communications in his hands? This is not just a risk – it is a fundamentally flawed concept.

A future we do not want

Musk presents his “everything app” concept as a technological evolution. In reality, it points to a very different future – one in which a single billionaire controls the core infrastructure of the digital lives of hundreds of millions of people. It’s a world where our conversations, transactions, media consumption, work, and privacy pass through the servers of someone who supports authoritarian leaders, spreads disinformation, and uses their platform to influence elections in other countries.

We have already seen where this can lead. Consider China: WeChat has become a vast control mechanism – every message is scanned, every transaction analyzed, every action tracked. Dissidents and critics are identified within seconds. Content is automatically blocked. Authorities have unrestricted access to all data. It is not merely a messenger, but a country-scale digital surveillance system.

Now imagine that same model – executed by Elon Musk. A future where he has access to your chats, financial transactions, metadata, location, and social connections. A person who publicly belittles foreign ministers of allied countries. Someone advocating for the U.S. to leave NATO. Someone openly supporting far-right parties in Europe. A person who has threatened to shut down critical infrastructure during a war simply because they were dissatisfied with the actions of a country fighting for survival.

And we are supposed to trust this individual with our digital lives? No, thank you. I have no intention of being part of that scenario. I will not hand over control of my communications and data to someone who repeatedly demonstrates that their political biases and personal grievances take precedence over user security, truth, and basic democratic principles. This is a future we do not want – and it is not worth the risk.

Thank you, I won’t be using it

I will genuinely miss the old Twitter – the place where ideas collided, where breaking news appeared faster than in traditional feeds, and where people from different countries could communicate directly. But that platform is gone. It wasn’t destroyed by users or time; it was changed by the decisions of a single owner.

Today, X is no longer a forum for discussion or a media platform. It is a tool for political influence, a disinformation engine, a space where algorithms serve one person rather than the community. XChat is a logical extension of this transformation.

XChat is not a secure messenger. It is a simulation of privacy. It is another piece of the project to build a “Western WeChat” – an all-in-one app giving its owner control not only over content but also over finances, communications, personal connections, and the digital lives of users. And all of this is in the hands of someone who consistently belittles Poland, its politicians, and its strategic interests.

Anyone who wants to remain part of the X ecosystem is free to make that choice. I won’t judge. But I hope these facts at least prompt some reflection.

Should you trust your private conversations to someone who devalues users from Eastern Europe? To someone who publicly supports the U.S. leaving NATO, putting the entire region at risk? To someone whose platform has become a breeding ground for bots, propaganda, and manipulation?

My answer has been obvious for a long time: I’m not going to use XChat. I see no reason to hand over my data, my contacts, or my conversations to a person who can’t be trusted even with basic responsibility for his own statements.

There are better platforms. There are messaging apps built by people who aren’t constructing a political cult around themselves. Signal, Wire, even WhatsApp – despite all its flaws – offer more respect for your privacy than XChat ever will. They don’t harvest your data to train AI without consent. They don’t hand over your metadata in response to political pressure. They don’t turn the user into a product.

In a world where privacy has become a luxury, choosing a messenger isn’t just picking another app on your phone. It’s choosing who you trust with your life, your relationships, your vulnerabilities, and your security.

Elon Musk keeps proving, time and time again, that he cannot be trusted. And XChat is just the latest confirmation of that. I don’t want to be part of that vision of the future – and I sincerely hope you won’t want to be, either.

Read also: