X Kills Nitter, the Last Way to Read It Anonymously

At 5 p.m. Eastern on 25 August 2026 a deadline expired and nitter.net went dark. X Corp had given the seven year old open source project roughly a day to take down not only its running websites but the repository holding its source code. Nitter complied. So did XCancel, the best known site built on top of it. If you checked a source's timeline without logging in, or monitored accounts without those accounts learning who was watching, that tool no longer exists and nothing clean replaces it.

Key Takeaways

• X Corp sent cease and desist letters on 24 August 2026 demanding a permanent takedown of Nitter's instances and the project's code repository by 5 p.m. Eastern the next day.
• X's lawyers cited the Texas Harmful Access by Computer Act (§ 143.001 and § 33.02) and the Lanham Act (15 U.S.C. §§ 1114, 1125), alleging Nitter circumvented X's API and reached X accounts and session tokens.
• Nitter's developer, who uses the handle Zedeus, took nitter.net offline and archived the GitHub repository, which is now frozen at 14,054 stars and 1,256 forks after seven years.
• XCancel and other public instance operators received similar letters and stopped, leaving an X account as the only dependable way to read most posts on the platform.
• Google's 2023 cease and desist against Invidious rested on API terms of service and was ignored; X invoked a state computer misuse statute and trademark law, which bind a developer who never agreed to anything.

What Exactly Did X Demand?

A permanent takedown of every Nitter instance and of the project's source code repository, inside about 24 hours.

TechCrunch reported that the letters went out on 24 August and set a 5 p.m. Eastern deadline for the following day. The letter accuses Nitter of "unlawful use and circumvention of X's Application Programming Interface (API) and associated data," and claims X holds evidence the project scraped X data and reached X accounts and session tokens. The Register published the statutes named in it. Zedeus said other instance operators had received the same letter and that he was seeking legal advice.

The repository demand is the unusual half. A cease and desist normally aims at a service that is running. This one aimed at the instructions for building one. We checked zedeus/nitter against the GitHub API on 30 August: archived and read only, licensed AGPL-3.0, created June 2019, sitting at 14,054 stars and 1,256 forks. The code is still readable. Nobody will touch it again.

Why Did Nitter Matter to Journalists and Researchers?

Because it let you read and archive a public X account without an account of your own, so no login session, cookie, advertising ID or engagement signal ever attached a reader to what they read.

• Monitoring without notifying. Loading a profile while signed in nudges view counts and feeds the recommendation graph. Nitter produced none of that.
• Archiving and screenshots. Analysts captured posts without altering engagement metrics on the thing they were documenting.
• Access under duress. Where X is throttled, or where signup demands a phone number tied to a real name, Nitter was the difference between reading and not reading.
• Separation of identity. A researcher's follows and search history are a map of an investigation before it is published.

The pattern here is the one the Committee to Protect Journalists described when it warned that ad tech location data can expose sources: the exposure is rarely the story you filed, it is the trail you left while reporting it.

The Legal Shape Matters More Than the Outage

Most coverage led with the websites going dark. The interesting part is which laws X reached for, because that choice looks like a direct answer to how the last two of these fights ended.

In June 2023 Google sent Invidious, a privacy frontend for YouTube, a cease and desist alleging breach of the YouTube API terms of service. Invidious had never used that API and had therefore never accepted those terms. The developers declined to comply and the project is still running three years later. X did not repeat that mistake. The Texas Harmful Access by Computer Act is a computer misuse statute, and the Lanham Act is trademark law. Neither one asks whether you signed a contract.

Compare the other well known frontend killing of 2023. Reddit sued nobody; it set a price of $12,000 per 50 million API requests, roughly $20 million a year for the Apollo client, which shut down that June. A price is a filter, and funded actors pass through filters. A criminal statute is not a filter. It is aimed precisely at the unfunded volunteer, who cannot afford to find out whether the theory would survive a judge.

Follow the reasoning outward and it does not stop at X. If serving a platform's public posts through your own frontend is unauthorized computer access plus trademark infringement, that argument covers every alternative frontend built the same way, for YouTube, Instagram or Reddit. And note what the repository demand does not achieve: 1,256 forks mean the code was mirrored 1,256 times before the letter arrived, so deleting the original removes nothing from the internet. What it removes is anybody's appetite for hosting the 1,257th.

What Actually Replaces Nitter?

Nothing clean, and anyone telling you otherwise is selling something. Here is the honest inventory:

• archive.today snapshots. Fine for a URL you already hold. No timeline, no search across an account, no monitoring, and a post only exists there if somebody saved it before it was deleted.
• Surviving forks. Privacy Guides noted that at least one instance was still answering after the deadline. Every operator now knows what arrives in the mailbox. Treat any of them as temporary.
• RSS bridges. They break whenever X changes its internals, they were already unreliable, and they now carry the same legal exposure that emptied the instance list.
• Bluesky and Mastodon mirrors. Useful only for accounts that chose to mirror themselves, which is the opposite of the accounts most researchers need to watch.
• A compartmentalized account. The realistic fallback. Use a dedicated browser profile, sign into nothing else in it, and assume signup wants a phone number. It ties your reading to an identity, just not your main one.

Why Your Reading Trail Matters Now

Reading has quietly become an authenticated act. For most of the web's life, what you read was the least observable thing you did, because a page render left almost nothing pointing back at you. On a platform that gates content behind a login, every profile you open is a logged event with your name on it.

For a reporter this reorders the threat model. Which accounts you checked, in what order, from which IP address and at what hour is a rough outline of an unpublished story, sitting in one company's logs where it can be requested. We looked at how that plays out intech companies quietly fighting ICE subpoenas for user data. Whether a platform resists is entirely the platform's call.

The device you read on is its own problem. Apple's threat notifications reached targets across 110 countries in the latest round, and an adversary already inside your phone does not care which frontend you preferred. Losing Nitter does not create that risk. It removes one of the few remaining places where reading cost you nothing.

Looking Ahead

No court has blessed any of this. A cease and desist is a letter, not a ruling, and the Texas theory has not been tested against a defendant who fought it. That is the point of the deadline: answering the letter costs far more than obeying it, so the argument never gets examined.

Three things are worth watching: whether X sends the same letter to operators of the surviving forks, whether GitHub receives a takedown request for the archived repository, and whether any developer with legal backing decides to litigate, sincethe statute text has to mean something specific before it means everything X says it does.

Until then the practical advice is unglamorous. Archive what you need while you can see it, keep the identity that reads separate from the identity that publishes, and stop assuming that a public post will stay readable by the public.