Guide · updated 2026-10-05
Check a bitchat APK before you install it
A download button can be copied onto a lookalike page. The SHA-256 of the file cannot, unless the attacker also replaces the page you are comparing against. This guide is the check. The download page is where the hashes for v2.0.1 are printed in full.
What you are comparing
Each signed file on the GitHub release has a published digest. bitchat.cc stores a copy of those same bytes and prints the same digest next to the button. After a refresh of the mirror, the file on this server is checked against that digest before it stays linked. Your job, on your own machine, is to compute the digest of the file you actually received.
The upstream release also carries a BITCHAT_SHA256SUMS file. Use it as the second column. Two independent pages that show the same 64-character string are much harder to fake together than either page alone. If this site and GitHub disagree, install nothing until you know which copy moved.
Compute the hash
Leave the filename alone so you know which build you hashed.
- macOS or Linux: in the download folder, run
shasum -a 256orsha256sumand then the file name. - Windows PowerShell:
Get-FileHash .\file.apk -Algorithm SHA256.
Compare every character. A hash that matches except for the last few letters is a mismatch. Upper or lower case does not matter. Added spaces do. The universal file is 49.5 MB (51,911,404 bytes) and the ARM64 file is 19.1 MB. A file that is a few hundred kilobytes, or hundreds of megabytes, is not this release even if someone named it bitchat.
What Play Protect is actually saying
Play Protect scans packages that did not come from Play. The warning means the install path is a sideload. It does not mean the hash failed, and it does not mean the hash passed. Go back to the digest if you skipped it. If the digest matches the GitHub release, you have the maintainers’ signed build, and the warning is about the path. If the digest does not match, delete the file. Do not look for a second APK whose only promise is that it will silence the scanner.
Android also shows the package name after install. The phone app is com.bitchat.droid, version 2.0.1. A different package name is a different app that borrowed the word bitchat. Uninstall it.
Files this name gets stuck on
The Android project states that it is released into the public domain. That license covers the project’s source. It does not bless every APK that uses the name. Turn down any of these:
- A “premium”, “pro”, or “unlocked” build. The app does not have that edition.
- A package that asks you to disable Play Protect and also skips the hash.
- An AAB, which is a Play upload bundle, not a file you install by hand.
- A debug build, or a repack with extra ads injected around the chat.
- A forward from a group chat when the sender cannot point at the release it came from.
bitchat.cc does not host those. If you find one linked from this domain, that is a bug in the mirror. Use the contact form and do not install it.
After the numbers match
Then follow the install steps: allow the browser or Files app to install unknown packages, open the APK, and grant Bluetooth when the app asks. The hash check does not grant those permissions for you. It only tells you the bytes are the release you meant to trust.