vault / bitchat-android / v2.1.0

bitchat-android @ v2.1.0

integrity

size: 15.8 MiB
downloaded: 2026-10-26 22:54 UTC
last checked: 2026-10-26 22:54 UTC

source https://github.com/permissionlesstech/bitchat-android · available · github

release notes

Bitchat Android v2.1.0

Highlights

Spam filtering for public mesh and geohash chats, enabled by default. Phone users can disable it in settings.
More reliable geohash participant lists, nicknames and blocking, including removal of blocked users' messages.
Corrected Cashu ecash amount formatting for fiat-denominated tokens.
Clearer light-mode voice-note waveforms, improved onboarding layouts and consistent QR scan controls.
Basque language support and spam-filter translations.
Improved incoming-message autoscroll and verification-sheet layering.
QR scanner initialization fixes for minified releases, plus concurrency fixes for security-cache cleanup and relay snapshots.
Panic reset confirmation and accurate reporting of wipe outcomes.
Wear OS: swipe right from chat for the app menu, including a confirmed Quit action.
Privacy and security hardening: exclude app data from backup/device transfer, validate message fragments and encoded data, check verification QR timestamps, and limit APK downloads and decoded packet sizes.
Prevent recipient-less Nostr private-message envelopes from exposing a stable mesh identity.
Updated bundled Nostr relays.

Versions and downloads

Phone 2.1.0 (41) requires Android 8.0/API 26 or newer. Wear OS 0.1.6 (1000000007) requires API 33 or newer. Both use com.bitchat.droid and target API 37, from commit b8016545e00cc7317fd9dc938b8cb7796db190ff.

bitchat-android-arm64.apk: most modern Android phones.
bitchat-android-universal.apk: compatibility fallback.
bitchat-android-x86_64.apk: x86_64 devices and emulators.
bitchat-android-wear.apk: direct Wear OS installation.
bitchat-android-play-upload.aab: signed phone bundle for Play.
bitchat-android-wear-play-upload.aab: signed Wear OS bundle for its separate Play track.

Only signed binaries and reproducibility metadata are attached. No unsigned APKs or AABs are published.

Reproducible-build verification

Requirements: Git, Docker (at least 16 GiB memory), and GitHub CLI.

git clone https://github.com/permissionlesstech/bitchat-android.git
cd bitchat-android
git checkout v2.1.0
tools/reproducible-builds/build-in-container.sh .reproducible-build/verify-2.1.0
gh release download v2.1.0 --repo permissionlesstech/bitchat-android \
  --pattern BITCHAT_BUILDINFO.json --pattern BITCHAT_SHA256SUMS.unsigned \
  --dir .reproducible-build/metadata-2.1.0
gh attestation verify .reproducible-build/metadata-2.1.0/BITCHAT_BUILDINFO.json \
  --repo permissionlesstech/bitchat-android
gh attestation verify .reproducible-build/metadata-2.1.0/BITCHAT_SHA256SUMS.unsigned \
  --repo permissionlesstech/bitchat-android
cmp .reproducible-build/verify-2.1.0/SHA256SUMS.unsigned \
  .reproducible-build/metadata-2.1.0/BITCHAT_SHA256SUMS.unsigned

To check downloaded release-file integrity:

gh release download v2.1.0 --repo permissionlesstech/bitchat-android --dir release-files
(cd release-files && shasum -a 256 -c BITCHAT_SHA256SUMS)

Signing certificates (SHA-256)

GitHub APKs and Play upload: 3b03fa66a5451321100792f5b55a7b4966d5c8dc10c6daa40aa95ea489531bca
Google Play app signing: 5e651dd0c80d1f57f2617964955085e28949dd04addac7b53fe9d2f11e172aa2

Google Play signs delivered APKs separately; their bytes need not match the GitHub APKs.

Validation scope

Phone unit tests: 762 passed, 3 existing skips. Wear unit tests: 238 passed. Contract tests and two synthetic minified-scanner runtime tests passed. Two independent local canonical builds matched byte-for-byte.

Both independent builds in the tagged release workflow also matched byte-for-byte. All eight canonical binaries and both public build-metadata subjects passed GitHub provenance verification against the exact tag, source commit and release workflow. APK signing is deterministic; existing signing-certificate continuity and signed AAB payload comparisons passed.

Existing lint findings remain; the six targeted translation errors were fixed. Changed-line coverage is unavailable because its Gradle task is not wired. Physical-device, cross-client/endurance and Play-delivered upgrade tests were not completed for this release; these gates were explicitly waived. This is not a claim that those checks passed.

Full changelog

Changes since v2.0.3

download

unix · zip

curl -fL -o v2.1.0.zip https://ratatoskr.space/pkg/bitchat-android/v2.1.0.zip
                    printf '%s  %s\n' 'b595988cb3a230e72642c9a791461f277c2bdfd55c4570d468b890d63586474c' 'v2.1.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/bitchat-android/v2.1.0.zip"
$out = "v2.1.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "b595988cb3a230e72642c9a791461f277c2bdfd55c4570d468b890d63586474c") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v2.1.0.tar.gz https://ratatoskr.space/pkg/bitchat-android/v2.1.0.tar.gz
                    printf '%s  %s\n' '5dd24f90a2e3b4f2cdc6d753d0e5925badfff07d60a76bd4f9b704e80d5baafc' 'v2.1.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/bitchat-android/v2.1.0.tar.gz"
$out = "v2.1.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "5dd24f90a2e3b4f2cdc6d753d0e5925badfff07d60a76bd4f9b704e80d5baafc") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v2.1.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.zip
                    printf '%s  %s\n' 'b595988cb3a230e72642c9a791461f277c2bdfd55c4570d468b890d63586474c' 'v2.1.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.zip"
$out = "v2.1.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "b595988cb3a230e72642c9a791461f277c2bdfd55c4570d468b890d63586474c") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v2.1.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.tar.gz
                    printf '%s  %s\n' '5dd24f90a2e3b4f2cdc6d753d0e5925badfff07d60a76bd4f9b704e80d5baafc' 'v2.1.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.tar.gz"
$out = "v2.1.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "5dd24f90a2e3b4f2cdc6d753d0e5925badfff07d60a76bd4f9b704e80d5baafc") { throw "sha256 mismatch" }

artifact	format	size	hashes
v2.1.0.zip	zip	16.3 MiB	blake3-24 17eba6f09e81d4d3c82577ccde052974a85c13b4e42d69de sha256 b595988cb3a230e72642c9a791461f277c2bdfd55c4570d468b890d63586474c sha1 5d7dabf5d49c57e9ea4ff19e3c0e92067b67a89a
v2.1.0.tar.gz	tar.gz	15.9 MiB	blake3-24 46c642ecdb348dd214db0e6109624cee677862be24e8f593 sha256 5dd24f90a2e3b4f2cdc6d753d0e5925badfff07d60a76bd4f9b704e80d5baafc sha1 8f9f4f9ec0802915e86ddff7057b50a3182522ee

install

bazel

http_archive(
    name = "bitchat-android",
    urls = ["https://ratatoskr.space/pkg/bitchat-android/v2.1.0.tar.gz"],
    integrity = "sha256-XdJPkKLjtPLNxtdT0OWSW63/8H1gp2vU+bcE6A1bqvw=",
    strip_prefix = "bitchat-android-v2.1.0",
)

zig

.url = "https://ratatoskr.space/pkg/bitchat-android/v2.1.0.tar.gz",

install via yggdrasil mesh

bazel

http_archive(
    name = "bitchat-android",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.tar.gz"],
    integrity = "sha256-XdJPkKLjtPLNxtdT0OWSW63/8H1gp2vU+bcE6A1bqvw=",
    strip_prefix = "bitchat-android-v2.1.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/bitchat-android/v2.1.0.tar.gz",

v2.0.3 →