X Chat: encrypted messaging on X with big privacy promises and real security questions

X has quietly turned its experimental encrypted direct messages into a standalone product called Chat, positioning it as the company’s answer to ultra-secure messaging apps like Signal and WhatsApp.

Built on top of X’s existing messaging infrastructure, Chat is pitched as a place for private conversations, sensitive files and everyday chats that users supposedly do not want tracked or monetised.

The headline promise is end-to-end encryption for messages and file sharing, so that only the people in a conversation should be able to read its contents. On top of that, Chat adds disappearing messages, the ability to edit or delete what you have already sent, and a privacy mode that blocks screenshots and flags any attempt to capture the screen. X repeatedly emphasises there are no ads, no behavioural tracking and a focus on keeping conversations off the company’s usual data-hungry radar.

Functionally, Chat behaves like a modern, full-featured messenger. Users can start one-to-one or group conversations, place voice and video calls, and soon will be able to send short voice memos when typing is inconvenient. For people already living inside X all day, having this layer of communication bundled into the platform could feel convenient: no extra app, no separate username, just an existing X identity.

However, the security story is more complicated than the marketing suggests. In its own documentation, X admits that Chat does not yet defend against classical man-in-the-middle attacks, in which an attacker – or even an insider with access to infrastructure – silently sits between two users and decrypts traffic. In that scenario, neither side would necessarily realise that their supposedly private conversation had been compromised.

For a product built around strong privacy claims, this is not a minor detail. Mature encrypted messengers rely on mechanisms such as safety numbers or key verification to make these attacks extremely difficult and to alert users when something looks wrong. X says it is working on a similar system so that interception should be hard, and that both sender and recipient will be warned if an attack is detected, but that solution is still a promise rather than a finished feature.

There is also the question of trust. Users have learned to be sceptical when a big social platform suddenly talks about total privacy while refusing to open-source its code or offer independent audits. Some early reactions point out that the absence of ads does not automatically mean the absence of monetisation: a service can still learn from how, when and with whom you communicate, even if it never scans the literal message content.

That tension helps explain why the launch of yet another chat app has been met with as much eye-rolling as excitement. Many people already juggle several messengers that claim to be secure, and some are understandably tired of creating accounts everywhere only to discover the privacy story has caveats. For X, the challenge will be to prove that Chat is more than a marketing label and that its protections will actually stand up to scrutiny.

On the practical side, Chat is available today through the X mobile app on iOS and in the web interface, with an Android release promised in the near future. If X follows through on its roadmap – hardening encryption, shipping voice memos and closing the remaining security gaps – Chat could evolve into a serious option for people who already rely on X and want their conversations to live in the same ecosystem. Until then, it remains an interesting but imperfect experiment in private messaging from a company still trying to rebuild trust.