Hardware-grade end-to-end encryption for Web and Native Android. Currently in active Alpha development. No phone numbers. No email harvesting. Identifiable solely by cryptographic wallet hashes.
Every layer of Xat is architected to eliminate tracking vectors, protect metadata, and ensure mathematical privacy.
All messages, GIFs, and media attachments undergo client-side encryption before touching any network socket. The server only sees encrypted ciphertext.
AES-GCM // 128-bit TagUpon secondary login, 2 random digits are pre-filled with masked tokens (●). Any single incorrect digit triggers immediate session teardown and purge.
Anti-Brute Force ProtectionNo phone numbers. No email sign-ups. Identities are 160-bit cryptographic wallet hashes. You start with a clean slate and invite peers by hash alone.
160-bit Hex IdentifiersPayloads are compressed with maximum zlib deflate compression prior to encryption. This minimizes payload size, boosts transmission speed, and hides entropy.
Zlib L9 Pre-CompressionBuilt in 100% Kotlin with modern Android Jetpack Compose and Material 3 design. Features real-time state reactivity and pitch-black OLED dark mode.
120Hz Fluid UISynchronized worldwide across Cloudflare’s low-latency edge network. Seamlessly switch between your phone and your PC in real-time.
Sub-50ms Global LatencyWhy mathematical zero-knowledge provides absolute protection against government subpoenas, server seizures, and SIM-swap confiscation.
| Security Vector / Architecture | XAT MESSENGER | Signal | Telegram | |
|---|---|---|---|---|
| Identity / Registration | ✓ 0% Phone / Wallet Hash | ⚠ Phone Required | ⚠ Phone Required | ⚠ Phone Required |
| Government Subpoena Resistance | ✓ Mathematically Immune | Sealed Sender Logs | ✗ Cloud Plaintext Access | ✗ Metadata & Graph Subpoenas |
| Server Metadata Retention | ✓ Zero Metadata Stored | Minimal Account Info | ✗ Centralized Cloud DB | ✗ Full Contact Graph |
| Encryption Mechanism | AES-256-GCM + ECDH P-256 | Double Ratchet | MTProto (Non-standard) | Signal Protocol |
| Server Trust Model | ✓ 100% Untrusted Blind Relay | Trusted Server Enclave | Trusted Cloud Servers | Meta Corporate Infrastructure |
| In-Memory Auto-Purging Voice Notes | ✓ Encrypted WebM Opus | Cached on Disk | Stored on Cloud | Cached on Disk |
| SIM Swap / Carrier Takeover Risk | ✓ Impossible (No SMS) | ⚠ Vulnerable via SMS | ⚠ Vulnerable via SMS | ⚠ Vulnerable via SMS |
| Web & Android Client Parity | ✓ 100% Identical Ciphers | Electron / Native | Web / Native | Web / Native |
Need a new identity provisioned, or want to discuss enterprise cryptographic channels? Send an inquiry directly to operations.
Choose your preferred client to establish your secure cryptographic node.
Direct APK install with hardware-backed encryption & inline WebM voice notes.
Instant zero-install access from PC, Mac, or mobile browser.