Check yourself: Your nsec is your account

Questions and answers, readable without JavaScript.

1. Why does the note say an nsec is not a password?

   • It is shorter than most passwords
   • On Nostr the private key is the account: no server can reset it and anyone who copies it can sign as you
   • Relays store a hashed copy of it
   • It expires after a year
   Answer 1

   On Nostr the private key is the account: no server can reset it and anyone who copies it can sign as you

   NIP-01 authentication is just the signature check, so whoever holds the key holds the identity.

   Read the note → · Your nsec Is Not a Password: Nostr Key Handling and Signers

2. What is the npub/nsec prefix for, according to NIP-19?

   • It encrypts the key
   • It identifies which relay issued the key
   • Human-friendly display, with different prefixes so private keys, public keys and event IDs aren't confused
   • It sets the key's expiry date
   Answer 2

   Human-friendly display, with different prefixes so private keys, public keys and event IDs aren't confused

   The prefix is a safety feature: npub is safe to share, nsec never is.

   Read the note → · Your nsec Is Not a Password: Nostr Key Handling and Signers

3. In NIP-46 remote signing, what does the client use to talk to the signer?

   • A disposable client keypair, separate from your identity key, which clients should delete on logout
   • Your nsec, copied into the client
   • An email login
   • A NIP-05 address
   Answer 3

   A disposable client keypair, separate from your identity key, which clients should delete on logout

   Requests travel as encrypted kind:24133 events. The client's own keypair is disposable.

   Read the note → · Your nsec Is Not a Password: Nostr Key Handling and Signers

4. A signer's approval screen shows a friendly client name and logo. What does NIP-46 say about that metadata?

   • It is signed by the relay, so it can be trusted
   • It proves the client's identity
   • Signers must reject connections without it
   • It is client-supplied and unauthenticated, and must not be used for authorization
   Answer 4

   It is client-supplied and unauthenticated, and must not be used for authorization

   A friendly name proves nothing about who's asking.

   Read the note → · Your nsec Is Not a Password: Nostr Key Handling and Signers

5. What is the status of NIP-06 seed-phrase derivation for Nostr keys?

   • Required for all clients
   • Marked unrecommended, with the advice to prefer a single nsec
   • Replaced by NIP-49
   • Only for hardware wallets
   Answer 5

   Marked unrecommended, with the advice to prefer a single nsec

   Don't assume a Bitcoin seed covers your Nostr identity. Reusing one seed for both means one leak exposes both.

   Read the note → · Your nsec Is Not a Password: Nostr Key Handling and Signers