# A bit more on Twitter/X's new encrypted messaging

DevFeed: [A bit more on Twitter/X's new encrypted messaging](<https://devfeed.tech/articles/a-bit-more-on-twitter-x-s-new-encrypted-messaging-29091.md>)

Original publisher: [Read original article](<https://blog.cryptographyengineering.com/2025/06/09/a-bit-more-on-twitter-xs-new-encrypted-messaging/>)

Author: Matthew Green

Published: 2025-06-09T18:22:31Z

Content type: article

Language: en

Sources: [Matthew Green](<https://devfeed.tech/sources/matthew-green.md>)

Topics: [End-to-End Encryption](<https://devfeed.tech/topics/end-to-end-encryption.md>), [X (Twitter)](<https://devfeed.tech/topics/twitter.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [public key](<https://devfeed.tech/topics/public-key.md>), [Ratchet](<https://devfeed.tech/topics/ratchet.md>), [Server](<https://devfeed.tech/topics/server.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Meta](<https://devfeed.tech/topics/meta.md>)

Tags: [e2e](<https://devfeed.tech/tags/e2e.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [instagram](<https://devfeed.tech/tags/instagram.md>), [messaging](<https://devfeed.tech/tags/messaging.md>), [messenger](<https://devfeed.tech/tags/messenger.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [protocols](<https://devfeed.tech/tags/protocols.md>), [public-key](<https://devfeed.tech/tags/public-key.md>), [secret-storage](<https://devfeed.tech/tags/secret-storage.md>), [security](<https://devfeed.tech/tags/security.md>), [signal](<https://devfeed.tech/tags/signal.md>), [technology](<https://devfeed.tech/tags/technology.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article examines XChat, X's end-to-end encrypted messaging protocol, focusing on its lack of forward secrecy and its server-side storage of user private keys. It explains the Juicebox key-storage design and argues that the security of the system depends heavily on its deployment and server protections.

## Source excerpt

Update 6/10: Based on a short conversation with an engineering lead at X, some of the devices used at X are claimed to be using HSMs. See more further below. Matthew Garrett has a nice post about Twitter (uh, X)'s new end-to-end encryption messaging protocol, which is now called XChat. The TL;DR of Matthew's post ... Continue reading A bit more on Twitter/X's new encrypted messaging ->