Bitchat Android v2.1.0

Highlights

• Spam filtering for public mesh and geohash chats, enabled by default. Phone users can disable it in settings.
• More reliable geohash participant lists, nicknames and blocking, including removal of blocked users' messages.
• Corrected Cashu ecash amount formatting for fiat-denominated tokens.
• Clearer light-mode voice-note waveforms, improved onboarding layouts and consistent QR scan controls.
• Basque language support and spam-filter translations.
• Improved incoming-message autoscroll and verification-sheet layering.
• QR scanner initialization fixes for minified releases, plus concurrency fixes for security-cache cleanup and relay snapshots.
• Panic reset confirmation and accurate reporting of wipe outcomes.
• Wear OS: swipe right from chat for the app menu, including a confirmed Quit action.
• Privacy and security hardening: exclude app data from backup/device transfer, validate message fragments and encoded data, check verification QR timestamps, and limit APK downloads and decoded packet sizes.
• Prevent recipient-less Nostr private-message envelopes from exposing a stable mesh identity.
• Updated bundled Nostr relays.

Versions and downloads

Phone 2.1.0 (41) requires Android 8.0/API 26 or newer. Wear OS 0.1.6 (1000000007) requires API 33 or newer. Both use com.bitchat.droid and target API 37, from commit b8016545e00cc7317fd9dc938b8cb7796db190ff.

• bitchat-android-arm64.apk: most modern Android phones.
• bitchat-android-universal.apk: compatibility fallback.
• bitchat-android-x86_64.apk: x86_64 devices and emulators.
• bitchat-android-wear.apk: direct Wear OS installation.
• bitchat-android-play-upload.aab: signed phone bundle for Play.
• bitchat-android-wear-play-upload.aab: signed Wear OS bundle for its separate Play track.

Only signed binaries and reproducibility metadata are attached. No unsigned APKs or AABs are published.

Reproducible-build verification

Requirements: Git, Docker (at least 16 GiB memory), and GitHub CLI.

git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
git checkout v2.1.0
tools/reproducible-builds/build-in-container.sh .reproducible-build/verify-2.1.0
gh release download v2.1.0 --repo permissionlesstech/bitchat-android \
  --pattern BITCHAT_BUILDINFO.json --pattern BITCHAT_SHA256SUMS.unsigned \
  --dir .reproducible-build/metadata-2.1.0
gh attestation verify .reproducible-build/metadata-2.1.0/BITCHAT_BUILDINFO.json \
  --repo permissionlesstech/bitchat-android
gh attestation verify .reproducible-build/metadata-2.1.0/BITCHAT_SHA256SUMS.unsigned \
  --repo permissionlesstech/bitchat-android
cmp .reproducible-build/verify-2.1.0/SHA256SUMS.unsigned \
  .reproducible-build/metadata-2.1.0/BITCHAT_SHA256SUMS.unsigned

To check downloaded release-file integrity:

gh release download v2.1.0 --repo permissionlesstech/bitchat-android --dir release-files
(cd release-files && shasum -a 256 -c BITCHAT_SHA256SUMS)

Signing certificates (SHA-256)

• GitHub APKs and Play upload: 3b03fa66a5451321100792f5b55a7b4966d5c8dc10c6daa40aa95ea489531bca
• Google Play app signing: 5e651dd0c80d1f57f2617964955085e28949dd04addac7b53fe9d2f11e172aa2

Google Play signs delivered APKs separately; their bytes need not match the GitHub APKs.

Validation scope

Phone unit tests: 762 passed, 3 existing skips. Wear unit tests: 238 passed. Contract tests and two synthetic minified-scanner runtime tests passed. Two independent local canonical builds matched byte-for-byte.

Both independent builds in the tagged release workflow also matched byte-for-byte. All eight canonical binaries and both public build-metadata subjects passed GitHub provenance verification against the exact tag, source commit and release workflow. APK signing is deterministic; existing signing-certificate continuity and signed AAB payload comparisons passed.

Existing lint findings remain; the six targeted translation errors were fixed. Changed-line coverage is unavailable because its Gradle task is not wired. Physical-device, cross-client/endurance and Play-delivered upgrade tests were not completed for this release; these gates were explicitly waived. This is not a claim that those checks passed.

Full changelog

Changes since v2.0.3

Bitchat Android 2.0.3

Signed phone and Wear OS builds from v2.0.3 (source commit dfc67dad41691128bc6e7425bd69f2f409cb5bbf). Canonical unsigned outputs were built independently twice and matched byte-for-byte before local signing.

Highlights

• Smoother busy chats: reduce UI stalls during bursts of geohash presence and mesh activity, batch identity updates, and compose participant lists lazily.
• Bounded resource use: cap packet-processing queues and pace sync responses to keep heavy traffic from creating an unlimited backlog.
• More reliable connectivity: continue retrying Nostr relays after network and DNS failures, with refreshed relay data.
• Messaging correctness and security: verify incoming geohash event signatures before duplicate detection; preserve original compressed packet bytes for cross-client signature verification and forwarding; improve duplicate detection and geohash channel routing.
• Safer panic wipe: remove the private-conversation database files if normal conversation erasure fails.
• Wear OS polish since 0.1.1: shape-aware layouts for small round displays and larger fonts, compact fading chat headers, steadier scroll controls and autoscroll, refreshed icons, and an ongoing activity for returning to the mesh session.

History retention

Public chat and channel timelines now retain the latest 1,000 messages each, with up to 20 recently active channel timelines in memory. Older public messages are not archived by this change. Private-conversation history keeps its existing persistent retention policy.

Versions

• Phone: 2.0.3 (40), minimum API 26, target API 37.
• Wear OS: 0.1.5 (1000000006), minimum API 33, target API 37.
• Both use application ID com.bitchat.droid.

The Wear layout, icon, and ongoing-activity changes above are new relative to the previous GitHub release, but were already included in the separate Play Wear 0.1.4 release. Wear 0.1.5 additionally incorporates the shared mesh, sync, and identity fixes.

Verification and known limitations

Independent local and tagged CI builds matched. Exact-tag provenance, signatures, signing continuity against prior artifacts, bundle validation, payload comparisons, and release checksums passed. Unit and contract checks passed (860 tests passed, 3 skipped). A clean installation and an in-place upgrade from the signed 2.0.1 APK launched to onboarding on a disposable emulator.

Known issue: QR scanner initialization can crash in this release; the pending crash fixes are not included. Full physical-device/cross-client/endurance and Play-delivered install/upgrade testing have not been completed. Existing lint errors and unavailable changed-line coverage remain; these are not claimed as passes.

Downloads and signing

Only four signed APKs, the two signed Play-upload AABs, and three reproducibility metadata files are attached. No unsigned APK or AAB is published; BITCHAT_SHA256SUMS.unsigned contains their canonical hashes, not binaries.

• bitchat-android-arm64.apk — modern Android phones.
• bitchat-android-universal.apk — compatibility fallback.
• bitchat-android-x86_64.apk — x86_64 devices and emulators.
• bitchat-android-wear.apk — direct Wear OS installation.
• bitchat-android-play-upload.aab — signed phone bundle for Google Play.
• bitchat-android-wear-play-upload.aab — signed bundle for the dedicated Wear OS track.

Certificate SHA-256 fingerprints:

• GitHub APK and existing Play upload certificate: 3b03fa66a5451321100792f5b55a7b4966d5c8dc10c6daa40aa95ea489531bca.
• Google Play app-signing certificate: 5e651dd0c80d1f57f2617964955085e28949dd04addac7b53fe9d2f11e172aa2.

Google signs Play-delivered APKs with its separate app-signing key; those APKs are not expected to be byte-identical to GitHub APKs.

Reproducible-build verification

Use Git, Docker with sufficient memory, and the GitHub CLI:

git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
git checkout v2.0.3
tools/reproducible-builds/build-in-container.sh .reproducible-build/verify-v2.0.3
gh release download v2.0.3 --pattern 'BITCHAT_BUILDINFO.json' --pattern 'BITCHAT_SHA256SUMS*' --dir .reproducible-build/metadata-v2.0.3
gh attestation verify .reproducible-build/metadata-v2.0.3/BITCHAT_BUILDINFO.json --repo permissionlesstech/bitchat-android
gh attestation verify .reproducible-build/metadata-v2.0.3/BITCHAT_SHA256SUMS.unsigned --repo permissionlesstech/bitchat-android
cmp .reproducible-build/verify-v2.0.3/SHA256SUMS.unsigned .reproducible-build/metadata-v2.0.3/BITCHAT_SHA256SUMS.unsigned

To verify all downloaded release files without rebuilding:

gh release download v2.0.3 --repo permissionlesstech/bitchat-android --dir .reproducible-build/download-v2.0.3
(cd .reproducible-build/download-v2.0.3 && shasum -a 256 -c BITCHAT_SHA256SUMS)

Full changelog: v2.0.1...v2.0.3

Bitchat Android 2.0.1

Highlights

• Bitchat for Wear OS: join the nearby mesh from your watch, use public chat and encrypted direct messages, browse People, manage favorites and verification, receive notifications, record voice notes, and receive images and files.
• New chat styles: choose the classic Matrix layout or peer-colored message bubbles, including bubble-aware media, timestamps, and delivery indicators.
• Live push-to-talk: stream voice in public channels and encrypted direct messages on Android and Wear OS, with improved recording feedback, waveforms, haptics, and slide-to-cancel controls.
• Cashu support: recognize and preview Cashu eCash tokens, use /pay, and redeem with a compatible external wallet or web flow. Cashu tokens are bearer instruments; anyone who obtains a token may be able to redeem it.
• Persistent private conversations: keep conversation history, unread state, aliases, favorites, and previews across restarts, with clearer controls for deleting conversations.
• Offline geohash globe: explore geohash channels with a native animated 3D globe, country borders, cities, polar coverage, and adjustable render quality.
• Language picker: change the app language from within Bitchat, with expanded translations.
• Local-first APK sharing and updates: share an installed APK nearby and resume signature-verified update downloads with clearer progress and rate-limit handling.
• Reliability and privacy: stronger queued-message delivery and ordering, Noise session recovery and identity binding, more reliable receipts and peer lifecycle handling, safer Wi-Fi Direct cleanup, bounded payload processing, quieter sensitive logging, and a more complete panic wipe of in-memory networking state.

First reproducible full-app release

This is Bitchat Android's first reproducible full-app release. The unsigned phone and Wear OS APKs and Android App Bundles were built twice in independent GitHub Actions jobs using the pinned container environment, and every canonical byte matched before the release artifacts were promoted for local signing.

The release includes the signed phone and Wear OS APKs, the signed Play upload bundles, BITCHAT_BUILDINFO.json, the attested BITCHAT_SHA256SUMS.unsigned manifest, and the final BITCHAT_SHA256SUMS. The canonical unsigned binaries are intentionally not attached; their exact hashes are committed by the attested unsigned manifest and they can be rebuilt from the signed source tag. The signed APK and AAB payloads were checked against those canonical unsigned builds before publication.

To rebuild and verify everything from source (requires Git, GitHub CLI, Docker with Linux/amd64 support, and 16 GiB of memory recommended for Docker):

git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
git checkout v2.0.1
gh release download v2.0.1 --pattern 'BITCHAT_BUILDINFO.json' --pattern 'BITCHAT_SHA256SUMS*' --dir .reproducible-build/release-metadata-v2.0.1
gh attestation verify .reproducible-build/release-metadata-v2.0.1/BITCHAT_BUILDINFO.json --repo permissionlesstech/bitchat-android
gh attestation verify .reproducible-build/release-metadata-v2.0.1/BITCHAT_SHA256SUMS.unsigned --repo permissionlesstech/bitchat-android
tools/reproducible-builds/build-in-container.sh .reproducible-build/verify-v2.0.1
cmp .reproducible-build/verify-v2.0.1/SHA256SUMS.unsigned .reproducible-build/release-metadata-v2.0.1/BITCHAT_SHA256SUMS.unsigned

To verify the checksums of the published signed files without rebuilding:

gh release download v2.0.1 --dir .reproducible-build/download-v2.0.1
(cd .reproducible-build/download-v2.0.1 && shasum -a 256 -c BITCHAT_SHA256SUMS)

Most phones should use bitchat-android-universal.apk; bitchat-android-arm64.apk is a smaller download for modern ARM64 phones. Install bitchat-android-wear.apk directly on a Wear OS device. The Play upload bundles are signed separately for Google Play and are not intended for direct installation.

Full changelog: 1.7.4...v2.0.1

What's Changed

• Fix foreground service start eligibility by @callebtc in #714

Full Changelog: 1.7.3...1.7.4

What's Changed

• Fix request sync duplicate public messages by @callebtc in #707
• fix(sync): resolve hash alignment and early break bugs on GCS filter trimming by @a1denvalu3 in #708
• Fix Android security parity from iOS audit by @callebtc in #709
• Wifi aware refactor mesh core by @callebtc in #711
• feat: disable Wi‑Fi Aware by default by @callebtc in #712

Full Changelog: 1.7.2...1.7.3

What's Changed

• bump 1.7.1 by @callebtc in #661
• chore: update license from MIT to GPLv3 by @callebtc in #674
• Unit tests for BinaryProtocol by @rollforsats in #678
• fix: use CSPRNG for heartbeat intervals by @a1denvalu3 in #685
• Add 'Send private message' action to chat user sheet by @a1denvalu3 in #649
• fix: add input validation for protocol decoding and fragment reassembly by @0x0v1 in #666
• update version by @callebtc in #688

New Contributors

• @rollforsats made their first contribution in #678
• @0x0v1 made their first contribution in #666

Full Changelog: 1.7.1...1.7.2

What's Changed

• Fix location updates in notes and Nostr subscription leaks by @callebtc in #636
• fix(geohash): cleanup sampling subscriptions when closing location sheet by @a1denvalu3 in #659
• fix: pause geohash heartbeat (kind 20001) sampling when backgrounded by @a1denvalu3 in #660

Full Changelog: 1.7.0...1.7.1

• source routing: more efficient direct messages
• geohash presence: count online people in region-city
• update arti to 1.9.0 and add 32 bit builds
• geocoder for de-googled phone via openstreetmap
• fixes several issues identified by security audit firm cure53
• many ui improvements and fixes

What's Changed

• Implement Geohash Presence (Heartbeats) by @callebtc in #576
• Gossip mesh topology + source-based routing by @callebtc in #445
• Feat/graph force by @callebtc in #581
• visual logger refactor by @callebtc in #583
• Update arti to 1.9.0 and produce 32 bit builds by @callebtc in #585
• Move PrivateChatSheet hosting into ChatDialogs and unify sheet state by @yet300 in #586
• use bluetooth icon by @callebtc in #597
• Fix/nostr dm bottom sheet by @callebtc in #598
• Fix and Improve LocationManager logic by @callebtc in #599
• OSM fallback for geocoding by @callebtc in #611
• security: prevent storage exhaustion by saving incoming files to cache by @a1denvalu3 in #606
• feat: Stable BLE Peer Identity via Scan Response by @callebtc in #613
• Refactor: Implement Hybrid Location Provider (System/Fused) by @callebtc in #612
• fix(security): Clear in-memory keys during panic mode by @callebtc in #596
• Improve QR Verification UI by @callebtc in #615
• Implement iOS-compatible Direct Peer Detection (TTL Logic) by @callebtc in #574
• fix: centralize and strictly enforce connection limits by @callebtc in #618
• Fix: Correctly parse recipient/sender IDs in broadcaster to enable unicast by @callebtc in #619
• security: ensure media files are deleted during panic mode by @a1denvalu3 in #607
• fix: Ensure empty neighbor lists in newer announcements clear mesh edges by @callebtc in #620
• fix(ui): Show acquiring location state instead of unavailable by @a1denvalu3 in #621
• Fix/590-Private-key-stored-as-Plain-text by @anupamjhabbl in #603
• Refactored BottomSheetTopBar to BitchatSheetTopBar by @yet300 in #601
• spacing for geohash sheet text by @callebtc in #623
• feat: Introduce Gradle property to control APK splits by @moehamade in #560
• bump to 1.7.0 by @callebtc in #624

New Contributors

• @anupamjhabbl made their first contribution in #603

Full Changelog: 1.6.0...1.7.0

new

• background persistence: bitchat can now run in the background to support the mesh even if you leave the app
• improved tor: self-compiled arti library reduces APK size from 150 MB to 15 MB
• QR code contact verification
• fixes and improvements

What's Changed

• bump targetSdk to 35 by @callebtc in #526
• Prevent quit notification from reappearing by @callebtc in #530
• fix: wifi aware socket binding by @aidenvalue in #533
• Revert "fix: wifi aware socket binding" by @callebtc in #535
• Fix notification user try 2 by @callebtc in #541
• Fix: Add @ConscryptMode annotation to resolve test failures by @rebroad in #543
• Fix small-screen header clipping (#519) by @Kargatharaakash in #532
• QR and Verification feature by @yet300 in #529
• Enforce mandatory packet signature verification by @callebtc in #546
• Revert "Fix small-screen header clipping (#519)" by @callebtc in #548
• fix: location channel manager by @callebtc in #516
• fix: sync notification peer count with sidebar by @callebtc in #547
• bump versioncode to 28 by @callebtc in #551
• FIX: verify signature only for ANNOUNCE, MESSAGE, and FILE_TRANSFER like ios by @callebtc in #552
• versioncode bump to 29 by @callebtc in #553
• Fix/foreground permissions scanning by @callebtc in #556
• drop duplicate announces based on TTL by @callebtc in #558
• scan duration fix by @callebtc in #557
• feat: Build and release per-architecture APKs by @moehamade in #550
• bump vc to 30 by @callebtc in #559

New Contributors

• @aidenvalue made their first contribution in #533
• @rebroad made their first contribution in #543
• @Kargatharaakash made their first contribution in #532

Full Changelog: 1.6.0-rc1...1.6.0-rc3

new

• background persistence: bitchat can now run in the background to support the mesh even if you leave the app
• improved tor: self-compiled arti library reduces APK size from 150 MB to 10 MB
• QR code contact verification
• bug fixes and improvements

What's Changed

• feat: Tablet orientation fix for landscape mode by @developerchunk in #490
• mesh optimization: suppress relay of reassembled packets by setting TTL=0 by @callebtc in #492
• refactor app constants: service UUID for BLE by @callebtc in #494
• Fix direct peer detection by binding on per-connection first ANNOUNCE and never dropping ANNOUNCE as duplicates by @callebtc in #502
• fix connection attempt counter tracker by @callebtc in #503
• Fix: do not reject empty packets that arent message type by @callebtc in #510
• refactor app constants: service UUID for BLE by @callebtc in #500
• Add Network permission requirement to README by @Mafiadoener36 in #522
• feat: add product flavors and TorProvider abstraction by @moehamade in #508
• Migrate from LiveData to Kotlin Flow by @yet300 in #518
• Background persistence by @callebtc in #505
• bump version 1.6.0 by @callebtc in #524
• bump targetSdk to 35 by @callebtc in #526
• Prevent quit notification from reappearing by @callebtc in #530
• fix: wifi aware socket binding by @aidenvalue in #533
• Revert "fix: wifi aware socket binding" by @callebtc in #535
• Fix notification user try 2 by @callebtc in #541
• Fix: Add @ConscryptMode annotation to resolve test failures by @rebroad in #543
• Fix small-screen header clipping (#519) by @Kargatharaakash in #532
• QR and Verification feature by @yet300 in #529
• Enforce mandatory packet signature verification by @callebtc in #546
• Revert "Fix small-screen header clipping (#519)" by @callebtc in #548
• fix: location channel manager by @callebtc in #516
• fix: sync notification peer count with sidebar by @callebtc in #547
• bump versioncode to 28 by @callebtc in #551
• FIX: verify signature only for ANNOUNCE, MESSAGE, and FILE_TRANSFER like ios by @callebtc in #552
• versioncode bump to 29 by @callebtc in #553

New Contributors

• @Mafiadoener36 made their first contribution in #522
• @aidenvalue made their first contribution in #533
• @rebroad made their first contribution in #543
• @Kargatharaakash made their first contribution in #532

Full Changelog: 1.5.1...1.6.0