XCancel shut down the last usable Nitter

XCancel, for a long time the most reliable of the surviving Nitter instances, now answers every request with one line: service is suspended until further notice. No timeline, no explanation, no redirect. For the people who used it to read X without an account, that error page is the whole story. For anyone who thinks about how these tools actually work, it is the start of one.

Nitter is an open-source front-end for X, the platform formerly called Twitter. It let you read posts, threads, and profiles without logging in, without JavaScript, and without X’s tracking scripts loading in your browser. When X cut off free API access in 2023 and began forcing a login to view most content, nearly every Nitter instance broke. XCancel kept working, which turned it into a default bookmark for journalists, researchers, and people who just wanted to open a linked thread without handing X a session.

That popularity is the reason its disappearance matters past the inconvenience.

The proxy you trusted was still a proxy

Nitter fetches content from X on your behalf and then renders it for you. The operator’s server sits in the middle. That is the point of the tool, and it is what strips the tracking. It also means that server saw every request you made: your IP address, the accounts and posts you asked for, the timing of each visit, your browser’s user-agent. Whether XCancel logged any of that, and for how long, was never something a user could check. You trusted an operator you could not name to keep no records you could not audit.

Here is the trade almost nobody said out loud. People used XCancel to move their reading away from X’s surveillance. What they did in practice was move that visibility from a company with a legal team and a published privacy policy to an anonymous operator with neither. That is not automatically worse. But “I don’t trust X” and “so this random mirror is safe” are two different claims, and the gap between them is where the risk lives.

The dangerous window is open right now

The shutdown is not the real threat. The scramble after it is.

When a widely used privacy tool goes dark without warning, thousands of people go hunting for a replacement the same afternoon. They search for “xcancel alternative,” “working nitter instance,” “xcancel mirror.” Attackers know this pattern and stage for it. Expect three moves in the coming weeks.

• Typosquatted domains such as xcancel[.]net, xcancel-mirror[.]com, or xcance1[.]com. These cost a few dollars and climb search rankings fast on a demand spike.
• Copycat Nitter instances that behave exactly as expected while logging everything, or while injecting hostile scripts into the pages they hand back to you.
• “Restored” builds posted to Reddit and forums, framed as the original team quietly bringing the service back.

A malicious Nitter clone is a near-perfect phishing surface. It looks identical to the real thing because the source code is public, so anyone can stand up a pixel-accurate copy in an hour. If one of these ever asks you to log in with your X credentials “to view this post,” that is the entire attack: a credential-harvesting form wearing a familiar face. The genuine Nitter never needed your X password. Any replacement that asks for it is stealing it.

What happens to the data XCancel already held

Whatever XCancel’s servers held does not evaporate when the site starts returning an error. Logs, cached pages, and the guest-account tokens Nitter uses to talk to X all sit on disk somewhere. A suspension is not a wipe. That data stays put until a person actively destroys it, and “suspended until further notice” tells you nobody has committed to destroying anything.

That matters for two reasons. First, a suspended service is usually a service that stopped getting patched. An unmaintained server left exposed to the internet becomes a softer target every week it stays up, and its stored data goes with it. Second, if the suspension came from a legal demand, a hosting provider pulling the plug, or a breach, the operator may no longer control what happens to those records. You cannot retroactively decide you would rather not have read those particular accounts through that particular server. If a log was kept, it already exists.

There is a smaller detail worth naming. Nitter authenticates to X using pools of guest-account tokens the operator has to source and rotate. Those tokens are effectively X sessions. An instance that mishandles them, or an operator who cuts corners to keep a dying service alive, ends up holding X-side credentials on a box that is now unpatched and unattended. That is not your risk directly, but it shapes what a compromised or abandoned Nitter server exposes to whoever finds it next.

Why it probably went dark

Nobody outside the operator knows the exact cause, and the honest answer is that the error page does not say. A few explanations fit the pattern, and each carries its own security weight.

X has spent two years actively fighting Nitter, killing the guest-account tokens the software depends on to read content. A tool that keeps breaking against a hostile platform eventually loses the volunteer willing to keep repairing it. Legal pressure is a second possibility, and a hosting provider acting on a complaint is a third. Operator burnout is the least dramatic and probably the most common ending for a free service run by one person. You do not need to know which one it was to act correctly. In every version of the story, the tool is gone and the replacements are less trustworthy than what you lost.

The single point of failure nobody planned for

The structural lesson is bigger than one instance. The privacy-front-end world collapsed into one or two load-bearing servers, and XCancel was the largest of them. When an entire category of tool depends on a single volunteer-run box, the failure mode is not a slow decline. It is a wall. One shutdown removes access for everyone at once and shoves the whole user base toward whatever rushes in to fill the vacuum.

This is the same concentration risk that shows up across security: one certificate authority, one npm maintainer, one cloud region, one DNS provider. Resilience comes from holding more than one non-identical option and knowing how to switch before you are forced to. Almost nobody who leaned on XCancel had a second plan, which is why one error page could reroute so much behavior overnight.

How to check an instance in under a minute

Verification is not guesswork if you know what to look at. Before you type anything into a replacement, run four checks. Look up the domain’s age with a WHOIS lookup; anything registered in the last month during a shutdown wave is suspect by default. Confirm the site is a real deployment of the public Nitter or a known fork by matching it against the project’s own instance list rather than a link someone dropped in a comment. Watch for any login prompt at all, because a legitimate instance has no reason to ask. And check that the connection is plain HTTPS to the domain you expect, with no redirect bouncing you through a second unfamiliar host mid-request. None of this guarantees safety. It filters out the low-effort traps, which is most of them.

What to do this week

If you used XCancel, work through these in order.

1. Assume the accounts and posts you viewed through it were visible to its operator. Nothing you did there was private from the server itself. If any of that reading was sensitive, research on a hostile group, or activity you would rather not tie to your IP, treat it as known and plan from there.
2. Never enter your X credentials into any Nitter-style site. The real design never asks for them. This one rule defeats the most likely attack heading your way.
3. Verify a replacement before you trust it. Read the source repository, find out who runs the instance, and stay suspicious of any “working mirror” that surfaced right after the shutdown. A domain registered last week is a signal, not a coincidence, and a WHOIS lookup surfaces that in ten seconds.
4. If you must read X without an account and cannot verify a safe front-end, route through a browser you use for nothing else, over a VPN, and clear it afterward. A throwaway profile limits what any hostile instance can tie back to the rest of your life.
5. Archive anything durable yourself. Screenshot the source or citation while you can still see it. Leaning on a third-party mirror to preserve a public post is how you end up with a dead link and no evidence.

The hard part is that “suspended until further notice” may mean forever, and the tools people reach for next will mostly be worse: less maintained, less scrutinized, more likely to be someone’s quiet data-collection project. The convenient replacement is the one most likely to be the trap. The inconvenient habit, verify the operator, never surrender credentials, archive what you need, is the defense that actually holds.

---

#ad Contains an affiliate link.