From Whonix

Bitmessage Logo


BitMessage [archive] is a P2P asynchronous communications protocol used to send encrypted messages to another person or to many subscribers. The PyBitmessage client is written in Python with a Qt GUI. BitMessage is decentralized and trustless, meaning that users do not need to place faith in entities like root certificate authorities. The design employs strong, self-authenticating, Bitcoin-style addresses which prevents adversaries from spoofing messages so they appear to be legitimate.

For a comparison of BitMessage with other open source communications software, refer to the FAQ [archive].


The BitMessage protocol is quite flexible and robust: [1]

  • Messages for offline recipients are stored for up to 28 days before being deleted.
  • Proof-of-Work is relied upon to prevent spamming.
  • Sender and recipient metadata is hidden by broadcasting all messages to everyone, thereby acting as a simple private information retrieval (PIR) system.
  • Bridging services between the BitMessage network and legacy / regular email exist.
  • Additional features include subscription support and Chans (Decentralized Mailing Lists). [3]
  • Stronger anonymity is possible by running BitMessage in Whonix ™, since it works reliably.

For other use cases, refer to the Arch BitMessage wiki [archive].

BitMessage has not yet been independently audited by professionals to verify its security claims. That said, miscreants did use it to run a ransomware operation (over Tor) without being caught, demonstrating that it is somewhat "battle-tested." [4] While the Whonix ™ Project will never condone criminal abuse of technology, it is hoped that dissidents in oppressive states can profit from the protocol's underlying strength.

Email Bridging Services[edit]

Note: Bridging services are not required to use Bitmessage.

Bitmessage Mail Gateway (BMG) is a service that allows for seamless integration of email (webmail or email client) and the Bitmessage network.

As of January 1, 2020, the service at that was referenced in this section is terminated. For more information, go to [archive] or http://bitmailendavkbec.onion/term.html [archive].

BitMessage Installation and Operations[edit]


The following instructions perform steps to compile and verify the BitMessage source code. Once the verification process is complete, BitMessage can be started and the networking appropriately configured.

Bitmessage developers use git [archive] to sign their source code. [5] Git is a distributed version control system (VCS [archive]) that has the ability to tag specific points in history -- such as version release points -- as being important. These (git) tags can be signed and verified with GNU Privacy Guard (GPG). For a basic overview of Tagging please read: Git Basics - Tagging [archive].

Ambox warning pn.svg.png While git is cryptographically secure, it is not foolproof. See Web of Trust [archive] for further information.

Note: Unless directed otherwise, run the following commands in Whonix-Workstation ™ (Qubes-Whonix ™: anon-whonix).

1. Compile the source code.

Install package dependencies. Qubes-Whonix ™ users run this single command in whonix-ws-15 TemplateVM.

sudo apt-get install git python openssl libssl-dev python-msgpack python-qt4

Download the source code from GitHub.

git clone $HOME/PyBitmessage

2. Download the GPG public key of Pete Šurda, BitMessage core developer.

Whonix first time users warning Warning:

The following command using gpg with --recv-keys is not recommended for security reasons and is often non-functional. [6] This is not a Whonix ™-specific issue. The OpenPGP public key should be downloaded from the web instead; see also Secure Downloads. This procedure is currently undocumented and can be resolved as per the Free Support Principle. Documentation contributions will be happily considered.

gpg --recv-keys 52C97EBC095A2C0863C098C80C5F50C0B5F37D87

When finished, the output should appear similar to the following screenshot.

Figure: GPG Key Importation

Bitmessage import gpg key.png

3. Verify the public key fingerprint.

gpg --fingerprint 52C97EBC095A2C0863C098C80C5F50C0B5F37D87

At the time of writing, the output will appear like the following screenshot.

Figure: GPG Key Verification

Bitmessage verify gpg fingerprint.png

4. List tags.

Navigate to any Bitmessage directory.

cd ~/PyBitmessage

List all git tags.

git tag

Tags will be preceded by a "v".


Note: The output has been truncated.

5. Verify the git tag(s).

At the time of writing, v0.6.3 was the most current tag.

git tag --verify v0.6.3

When the tag has been verified the output should show a "Good signature" similar to the screenshot below.

Figure: Successful Verification

Bitmessage verify git tag.png

The above "gpg: WARNING" can be ignored since it does not alter the validity of the signature related to the downloaded key. Rather, this warning refers to the level of trust placed in the developers signing key and the web of trust. To remove this warning, the developers signing key must be personally signed with your own key.

If the following "gpg: BAD signature" message appears, the source code has been corrupted or altered during the download process.

gpg: BAD signature from "Peter Surda <>" [unknown]

In this event, delete the source code and either wait 10-15 minutes for the Tor circuits to change, or open up the Arm Tor Controller in Whonix-Gateway ™ (Qubes-Whonix ™: sys-whonix) and type "n" to create new Tor circuits. Wait for a random period of time before repeating the steps to download the source code and verify the git tag(s).

Start BitMessage[edit]

Start BitMessage by running the following command.


When BitMessage starts for the first time, this prompt will appear: "Bitmessage won't connect unless you let it." Choose: "Let me configure special network setting first" → press <OK>.

Figure: BitMessage Network Settings

Bitmessage enable networking.png

Make the following changes:

  • Proxy type: SOCKS5
  • Server hostname:
  • Port: 9050.

Press <OK> and the application should be fully functional.

Figure: SOCKS5 Proxy Configuration

Bitmessage configure networking.png

Upgrade BitMessage[edit]

To upgrade BitMessage run the following command.

cd $HOME/PyBitmessage
git pull

Send Attachments[edit]

While explicitly attaching files is not supported, technically any file can be sent within the message body. [7]

First convert the file with base64 and then copy and paste the contents of the text file.

base64 < binary.file > text.file

Do not forget to include receiver instructions on how to decode it. In order to decode the file, the recipient can copy and paste the code into a file and convert it with the following command.

base64 -d < text.file > binary.file

It is not very practical to send large files with BitMessage. Alternatively, a file or archive containing a collection can be GPG-encrypted and uploaded to untrusted cloud storage, with a link sent to the intended recipient(s). Two methods of encryption are possible: relying on a contact's public key or using symmetric encryption and sending the password in BitMessage. For GPG symmetric encryption, follow this example:

gpg -vv -c --cipher-algo AES256 your-file.tar.gz

Note that the output of diceware (pre-installed from Whonix ™ 14 onward) can be used for secure passwords.

Backup User Data[edit]

To backup the BitMessage profile and all user-generated program data:

  • Copy the folder under this path to your shared folder: /home/user/.config/PyBitmessage
    • Private keys are stored in the keys.dat database file. [8]
    • Other data-like inbox contents, contacts and black / white-list information are stored in the messages.dat [9] database file.
  • Copy the folder to this location to restore BitMessage data for new installs.

It is recommended to use Multiple Whonix-Workstation ™ to safely separate BitMessage identities and running instances. For better security, do not run separate BitMessage instances concurrently in this configuration.


  1. The development of Android clients has unfortunately stalled. Connecting with a mobile client also requires a full node running on the user's PC.
  2. The service will be gracefully shutdown in stages over a period with the termination date of 1 January, 2020. Full details are available at http://bitmailendavkbec.onion/term.html [archive]:

    The service will be gradually shut down. This is the plan (red steps are complete):

    1. Disable registrations as of 2019-06-01.
    2. Deny all outgoing E-mails as of 2019-07-01. You will no longer be able to send E-mails after that.
    3. Deny all incoming E-mails as of 2019-12-01. You will no longer be able to receive messages after that.
    4. Take the E-mail handler completely offline on 2020-01-01. You will no longer be able to log into your account after that.
    5. Clear secret key storage for mailboxes and bitmessage addresses on 2020-02-01.
    6. Delete all remaining accounts at 2020-06-01.
    7. Take the service offline 2021-01-01.

    We reserve the right to perform these actions sooner or later than initially planned. Please don't wait until the last moment.

  3. [archive]
  4. [archive]
  5. [archive]
  6. [archive]
  7. [archive]
  8. [archive]
  9. [archive]

text=Jobs in USA
Jobs in USA

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Iconfinder news 18421.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg Reddit.jpg Diaspora.png Gnusocial.png Mewe.png 500px-Tumblr Wordmark.svg.png Iconfinder youtube 317714.png 200px-Minds logo.svg.png 200px-Mastodon Logotype (Simple).svg.png 200px-LinkedIn Logo 2013.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png United Federation of Planets 1000px.png

Share: Twitter | Facebook

Want to get involved with Whonix ™? Check out our Contribute [archive] page.

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.