XChat is X's new direct messaging system, called Chat inside the X app and available as a separate X Chat app. It encrypts messages, links, media and reactions on your device before they're sent, protects your keys with a 4-digit PIN, and adds disappearing messages, unsend, voice notes and an optional X Number people can use to reach you.
If you've opened your messages on X recently and been asked to set a passcode, that's Chat. It's a bigger change than a new inbox design, and a few of its rules can catch you out, so here's what X's own help page says.
How Chat works
The first time you enter Chat, X creates a private and public key pair for you and asks you to set a PIN. X says the PIN never leaves your device. Your private key is then stored on X's systems in a protected form, so you can recover your conversations on any new device as long as you know the PIN.
You can register for Chat in two ways: open the Chat tab in the X app or on the web, or download the separate X Chat app and sign in with your X login. Only existing X accounts can sign in to the X Chat app, so you still create your account in the main X app or on the website.
When a message is encrypted, and when it isn't
Encryption only applies when both people have registered for Chat. If you message someone who hasn't, the message goes unencrypted, and X shows an icon next to the send button to tell you. A few other things stay readable to X:
- Metadata: who a message went to and when it was created aren't encrypted.
- Message requests: requests stay unencrypted until the other person accepts.
- Grok: anything you send to Grok, or any chat where Grok is added as a member, isn't encrypted from that point.
- Shared posts: X keeps a record when posts are shared into an encrypted chat.
X is also upfront that its system isn't yet forward secure: if a device's private key were ever compromised, past encrypted messages sent and received on that device could be decrypted. It says it's working on key rotation. My earlier guide to how encrypted DMs on X work covers the first version of this feature.
The PIN rule that can wipe your history
This is the single most important thing to know about Chat. X says that after 20 incorrect PIN attempts, your encrypted chat history becomes permanently inaccessible, even if you remember the PIN later. X can't look the PIN up or recover it for you.
If you forget it, you have two routes:
- Change your PIN from a phone where you already use Chat. Go to your Chat inbox, tap the gear icon, then Change passcode. You keep your history.
- Reset your PIN if you don't have a phone signed in to Chat. You'll lose your encrypted history, though unencrypted messages aren't affected.
X's own advice: store the PIN in a password manager and stay signed in to Chat on at least one phone.
How your keys are protected
X uses the open-source Juicebox protocol. Your key is split into shares stored across three independent servers X calls realms, all currently run by X. Two of them are hardware-backed, using hardware security modules, and recovering your key needs at least two of the three shares. The 20-guess limit is enforced inside that hardware, which is why X says even it can't brute-force your PIN. X also says a third party has audited the Chat protocol and published its findings.
Message request limits by plan
Chat limits how many message requests you can send to people who don't follow you in a 24-hour period. X lists these limits:
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
| Your X plan | Message requests per 24 hours |
|---|---|
| Free | 7 |
| Premium | 35 |
| Premium Plus | 75 |
| Premium Business | 500 |
If you use X for outreach, that free-plan limit of seven is the number to plan around.
What an X Number is
An X Number is an optional private code you can share so people can message or call you even if you don't follow them and your inbox is closed. Their conversation goes straight to your inbox, not message requests. It isn't a phone number. You can turn it on or off, share it, refresh it to a new one, or hide it from people you've already chatted with. You'll find it by opening Chat, entering your PIN, opening the inbox menu and tapping Number.
Other Chat features
| Feature | How X describes it |
|---|---|
| Disappearing messages | Pick a duration in the conversation info screen; messages are deleted from devices and X's servers after it |
| Unsend | Removes a message from the recipient's inbox, for encrypted messages only |
| Group chat invites | Share a public link; people join only if an admin approves them |
| Voice notes | Record, listen back and then send |
| Safety numbers | Compare them with the other person to check the chat is really with them |
| Grok in Chat | Premium Plus users can add @Grok to a conversation |
One more thing that surprises people: logging out of X deletes your messages, including encrypted ones, from that device. If you use both the X app and the X Chat app, you have to sign out of both. If you're curious about Grok's role, here's whether Grok is free to use.
My verdict
Chat is a real step up for privacy on X, and the X Number is a clever way to stay reachable without opening your inbox to everyone. The risks are on your side of the screen: set a PIN you won't forget, keep one phone signed in, and remember that adding Grok to a conversation ends the encryption for it. For business use, the message request limits matter more than the encryption, so check your plan before you rely on cold DMs.
Frequently asked questions
Is XChat the same as X DMs?
Chat is X's new direct messaging feature. It works inside the X app and on the web, and in a separate X Chat app you sign in to with your X account.
What happens if I forget my XChat PIN?
Change it from a phone where you already use Chat to keep your history, or reset it and lose your encrypted history. After 20 incorrect attempts the encrypted history becomes permanently inaccessible.
Are XChat messages end-to-end encrypted?
Messages, links, media and reactions are encrypted when both people have registered for Chat. Metadata such as the recipient and time isn't encrypted, and anything shared with Grok isn't either.
How many message requests can I send on XChat?
X lists 7 a day on the free plan, 35 on Premium, 75 on Premium Plus and 500 on Premium Business.
