Elon Musk launches XChat messenger for iOS users

X Corp has officially released its XChat messenger on the App Store.

The app is available on iOS and is closely integrated with X's main social network. A release date for the Android version has not been announced.

According to analysts, XChat's main competitive advantage over other messengers is that it does not require a phone number. An active X account is enough to start a conversation.

The service supports end-to-end encryption (E2EE), which users can enable by tapping a lock icon. XChat also offers messages that disappear after five minutes and a built-in screenshot block.

Despite the advertised security features, cybersecurity researchers have criticised the app's architecture. The main concern is that private encryption keys are stored directly on X Corp's servers.

Unlike Signal, XChat protects these keys with only a four-digit PIN. X has previously acknowledged that this setup technically allows company insiders to access user conversations.

Another major weakness is the scale of metadata collection. The app records IP addresses, search history, behavioural patterns, and contact lists.

Researchers at Endor Labs found that XChat does not strip technical metadata from images sent through the app. An intercepted photo retains precise GPS coordinates and the device model, even when the conversation itself is encrypted.

Under the current privacy policy, the collected data may be shared with third-party partners and advertisers. Researchers believe some of it is also used to train the company's own AI model, Grok.

Experts recommend using XChat only for everyday communication where a leak would cause no harm. For corporate, financial, or medical information, they advise relying on open-source solutions.