Sideload, carefully

How to install the bitchat APK

These steps are for the signed v2.0.1 files on the download page. Phone menus differ on Pixel, Samsung, Xiaomi, and other skins. The names below are the usual Android wording. If a label differs, search settings for “unknown apps” or “install unknown”.

1. Choose the file once

Download the universal APK if you are not sure. Download ARM64 if you want the smaller file and the phone is a normal recent handset. Leave the Wear OS APK for a watch. Installing the wrong one is the most common failed setup, and it is easy to avoid.

Before opening the file, compare its SHA-256 with the hash printed next to that download. The check is the whole point of using a known release instead of a forwarded file.

2. Allow your browser or Files to install it

Android blocks APK installs until you allow the specific app that is trying to open the file. You do not need a universal “unknown sources” switch on current versions.

• Open Settings, then Apps, then Special app access, then Install unknown apps.
• Tap the app you used to download, usually Chrome, Firefox, or Files.
• Allow installs from that app.
• Open the APK from the notification or from the Downloads folder and confirm the install.

On older Android 8 phones the switch may sit under Security. After bitchat is installed, you can turn the permission off again. Leaving it on does not make bitchat work better.

3. If Play Protect shows a warning

Play Protect scans sideloaded packages. A warning means “this did not come from Play”, not automatically “this hash is wrong”. Go back and check the SHA-256 if you have not already. If the hash matches the GitHub release, you are looking at the maintainer’s signed build. If it does not match, delete the file.

Do not install a second APK that someone promises will “skip the scan”. That is how modified packages spread.

4. First launch permissions

The project says the app asks at runtime for Bluetooth, location, and notifications. Each one has a job:

• Bluetooth and, on Android 12 and newer, Nearby devices let the phone discover peers and relay mesh packets.
• Location is required by Android itself before an app may scan for Bluetooth Low Energy devices. Denying it usually means the offline mesh cannot see anyone. It is a separate choice from joining a geohash room.
• Notifications matter if you want to hear about messages while the app is in the background. The project uses a foreground service so the mesh can stay up within Android’s background limits. Some phones still kill that service unless you disable aggressive battery optimization for bitchat.

5. See another phone

Stand within ordinary Bluetooth range of someone who also has the app open and Bluetooth on. Walls, pockets, and a crowded 2.4 GHz room all shorten range. One relay phone in between can extend a conversation, up to the seven-hop limit described in the project. If nobody is nearby, the mesh has nothing to join. That is not a failed install.

Geohash rooms are the online path. They need a working network. Read how those rooms are sized before you treat a city channel as a private group.

6. Update or remove it

To update, install a newer signed release over this one after you check that release’s hash. Android keeps the app’s data when the signing certificate matches. To remove bitchat, use the normal uninstall in Settings. Uninstall deletes the app’s local data on that phone. It cannot delete copies of messages that other phones already relayed.

The 2.0.1 notes also describe sharing the installed APK with a nearby phone and checking the signature on update downloads. Useful in a place with one good internet connection and many phones. The phone that already has a verified copy is the one that should share it.