Bitchat's French surge is a trust signal, not a security guarantee

Why would so many people install a chat app that only works with people standing near them, when nothing has been cut off? That is the odd question behind Bitchat's moment in France, and the answer says more about trust than about Bluetooth.

What happened: a "just in case" download wave

According to France 24, Bitchat mesh ranked first among App Store apps on Thursday, amid high-school mobilization and protests over purchasing power. BFMTV notes that no shutdown is currently planned, yet calls on social media to download the app keep multiplying, fueled by rumors of social media bans.

The app was created by Jack Dorsey and announced in July 2025. It sends messages over Bluetooth Low Energy mesh networks, with no internet, accounts or phone numbers.

The spike measures anxiety, not need

Nobody is being cut off in France right now. People are installing a fire extinguisher before any fire. In our view, that is the real story: a rumor was enough to make a share of users treat their usual messengers as something that might be switched off or watched.

That is rational in a limited way. Backup channels are cheap, and Bitchat's track record is the reason it comes to mind. Wikipedia's entry says it has been used during local internet shutdowns in countries such as Madagascar, Iran, Uganda, Nepal and India. France is not in that category, and we think it is worth saying so plainly. Borrowing the aura of those cases is not the same as facing their conditions.

Mesh chat is only as good as the crowd around you

The physical limits are not a footnote. The dev.to write-up describes relays of up to seven hops, and puts the Bluetooth link between devices at around 30 meters. Another explainer, on malware.news, says Bluetooth works within about 10 to 100 meters. Either way, this is a chat for a street or a square, not a city.

The second limit is density. A mesh needs other people running the app nearby, and installing it the night before a march does not guarantee that. Our prediction: many of this week's downloads will sit unopened, and in a crowd of strangers the network may be patchy. The app also uses the internet-based Nostr protocol for wider reach, and per Wikipedia, direct messages fall back to it when Bluetooth is unavailable. Useful, but then it is no longer purely offline.

"Encrypted" is not the same as "safe for sensitive use"

Here we would be most careful. Wikipedia reports that shortly after the TestFlight launch, a researcher found it was possible to impersonate another user. Dorsey then said the project was a work in progress, had not received an external security review, and might not meet its security goals. A separate Medium post by a self-described security researcher claims critical flaws, including identity spoofing and weak key storage. That is one person's unverified claim, and we can't confirm it, but it points the same way.

Strong cryptography does not help if you can't be sure who is on the other end. Features like random peer IDs per session and a triple-tap panic wipe are good design signs. They are not an audit.

Our verdict

Install it if you are curious, and treat it as a backup for talking to people physically near you if networks get congested or fail. Don't treat it as an anonymity tool, and don't send anything that would hurt you if it were exposed. Agree with friends beforehand on how you will verify each other, and keep your regular messenger too.

The more interesting lesson is for the big platforms. When a Bluetooth chat with IRC-style commands topped the App Store charts over a rumor, the problem was not Bitchat's polish. It is how fragile people feel their everyday channels are.