ScatterChat was discontinued long ago. It is no longer maintained, and you should not rely on it for anything sensitive. Hacktivismo released it in July 2006 as an instant messaging client that combined end-to-end encryption with routing over the Tor network, built for activists and dissidents who were not technical. If you need the same thing in November 2026, use a maintained, independently reviewed tool instead: Signal for encrypted messaging, SimpleX Chat if you want to avoid phone numbers and account identifiers, and the current Tor Browser for anonymous browsing.
What ScatterChat was
ScatterChat was a free, open-source secure chat client. J. Salvatore Testa II wrote it, and Hacktivismo released it at the H.O.P.E. Number Six conference in New York City on 22 July 2006. It was a fork of Gaim, the multi-protocol chat program that later became Pidgin. That is why its interface looked like a mid-2000s desktop instant messenger and not like a modern phone app.
The project described its goal as letting human rights workers and political dissidents in hostile environments talk securely and anonymously without needing technical skills. To do that, it bundled several features:
- End-to-end encryption of instant messages between ScatterChat users.
- Routing over Tor, so the network could not easily see who was talking to whom.
- Secure file transfers between contacts.
- Claimed protections including perfect forward secrecy, resistance to replay attacks and limited resistance to traffic analysis.
Sources from the time disagree about the license. Wikipedia lists the code under the Hacktivismo Enhanced-Source Software License Agreement (HESSLA), while a Debian packaging discussion from July 2006 listed it as GPL.
Screenshots
The screenshots below are kept as a historical record of the ScatterChat interface from 2006 and 2007. They show what the software looked like then. They do not show a product anyone should install today.
|
|||||||||||||||||||||||
Known security problems
ScatterChat had published security flaws within weeks of its release. This is a big reason it should be treated as history and not as a working tool.
The 2006 cryptographic weakness (CVE-2006-4021)
In August 2006, security researcher Steven J. Murdoch published an analysis on the University of Cambridge security blog Light Blue Touchpaper under the title “Protocol design is hard: Flaws in ScatterChat”. The main problem was ScatterChat’s custom padding scheme for messages encrypted in ECB mode. Repeated patterns could produce collisions, which leaked information about what messages said.
The issue was given the identifier CVE-2006-4021. Its CVSS 2.0 base score is 2.6, rated low, because an attack only became practical in long sessions. The advisory estimated that two 16-byte segments could be matched with about 1% probability after at least 1,188 instant messages in one uninterrupted session. The flaw affected the instant messaging part, not file transfer.
The same analysis raised deeper design concerns:
- Forward secrecy was weaker than advertised. The protocol probably resisted the compromise of one party’s key, but not both.
- The key exchange lacked identity binding and key confirmation. In some cases this could let the protections be bypassed.
At the time, the developers said the problem would be addressed in ScatterChat 2.0. The suggested stopgap for version 1.0.x was to disable the custom ECB padding.
The bundled Tor advisory
A second advisory in September 2006 covered flaws in the copy of Tor that came bundled with the Windows version. At the time, users were told to upgrade to ScatterChat 1.0.2. The impact was rated low, but it showed a lasting problem with bundling: a security tool is only as current as the components it ships with.
Why age matters more than the old bugs
Even if every 2006 flaw had been fixed, a chat client from that era would not be safe now. Its cryptography, its Gaim code base and its bundled Tor are many years out of date. Nothing has been patched since. Modern messengers also protect against things ScatterChat’s design never covered, such as recovering after a key compromise and resisting future quantum attacks.
What people use today for the same need
The need ScatterChat tried to meet still exists: private conversations that hide both the content and, as far as possible, who is talking. Today that job is split across maintained tools, and each one has limits.
| Tool | What it protects | Identifier needed | Independent review | What it does not hide |
|---|---|---|---|---|
| Signal | Messages, calls and files, end-to-end encrypted with the Signal Protocol | Phone number to register (usernames can hide it from contacts) | Formal analysis of its Triple Ratchet by Cryspen; long record of academic study | That you use Signal; your device if it is compromised |
| SimpleX Chat | End-to-end encrypted messages with no user IDs | None | Trail of Bits reviews in 2022 and of protocol design in 2024 | Network-level metadata unless you route it over Tor |
| Tor Browser | Your IP address and browsing from local networks and websites | None | Open source, run by The Tor Project | Anything you reveal yourself, such as logins and personal details |
Signal
For most people, Signal is the closest modern match to ScatterChat’s goal. In 2023 it added PQXDH, which protects the start of a conversation against “harvest now, decrypt later” attacks by future quantum computers. On 2 October 2025 Signal announced SPQR (Sparse Post-Quantum Ratchet). SPQR runs throughout a conversation, and its keys are combined with the existing Double Ratchet to form what Signal calls the Triple Ratchet. It uses ML-KEM-768, and the cryptography firm Cryspen worked with Signal to formally check both the design and the code that shipped.
Signal’s main trade-off is that you still need a phone number to sign up. Encryption also cannot protect messages on a phone that has been unlocked or infected with spyware.
SimpleX Chat
SimpleX Chat suits people for whom an account identifier is itself a risk. It has no user IDs at all. The security firm Trail of Bits assessed it in 2022 and reviewed the design of its protocols in 2024. It is newer and has a smaller user base than Signal, so you may have fewer contacts there.
Tor Browser
Tor Browser is the maintained way to use the Tor network that ScatterChat once bundled. The Tor Project released Tor Browser 16.0 on 29 October 2026 and ships frequent security updates. Tor hides your IP address. It does not make you fully anonymous, especially if you log into accounts or share identifying details.
FAQ
Is ScatterChat still available or safe to use?
No. ScatterChat has not been maintained in many years, and it had published cryptographic flaws, including CVE-2006-4021. Its bundled components are badly out of date, so any copy you find online should be treated as unsafe. Use a maintained messenger such as Signal or SimpleX Chat instead.
Who made ScatterChat?
J. Salvatore Testa II wrote it, and the hacker group Hacktivismo released it in July 2006. Hacktivismo was linked to the Cult of the Dead Cow. The project was aimed at human rights activists and dissidents who needed private communication.
Was ScatterChat related to Pidgin?
Yes. ScatterChat was a fork of Gaim, the chat client that was later renamed Pidgin. Its encryption and Tor routing were added on top of that code base, which is why it looked like a classic desktop messenger.
What is the best modern replacement for ScatterChat?
For most people, Signal is the best replacement. It is maintained, end-to-end encrypted by default and has strong independent review behind its protocol. If giving out a phone number is a risk for you, SimpleX Chat needs no identifier at all. For anonymous browsing, use the current Tor Browser.
Does an encrypted messenger make you anonymous?
No. End-to-end encryption hides what your messages say, but it does not hide every trace that you are communicating. A phone number, your IP address or a compromised device can still identify you. The EFF’s Surveillance Self-Defense guides explain how to match tools to your own threats.
Sources
- Hacktivismo, Wikipedia
- “Protocol design is hard: Flaws in ScatterChat”, Steven J. Murdoch, Light Blue Touchpaper (University of Cambridge)
- CVE-2006-4021, National Vulnerability Database (NIST)
- ScatterChat advisories, Bugtraq and Full Disclosure archives (Seclists.org), August and September 2006
- “Signal Protocol and Post-Quantum Ratchets”, Signal blog
- “SimpleX network: security review of protocols design by Trail of Bits”, SimpleX Chat blog
- “New Release: Tor Browser 16.0”, The Tor Project blog