Nostr keys: npub, nsec and hex

npub to hex, and back

Paste a public key in either form. Some tools and config files (relay settings, NIP-05 files) want hex; apps show npubs. The conversion happens in this page, in your browser.

Two keys, two jobs

Nostr uses the same kind of keys as Bitcoin: a private key on the secp256k1 curve, and the public key derived from it. Every event you publish carries your public key and a Schnorr signature (BIP-340) made with your private key. Apps and relays check the signature against the public key, so nobody without the private key can post as you, and no relay can change what you wrote (NIP-01).

• Public key: your identity. Share it freely; it's how people follow you.
• Private key: your signature. Anyone who has it can post, follow, delete and send messages as you, and you can't take it back.

npub, nsec and hex

Both keys are 32 bytes. Inside the protocol they are always written as 64 hex characters. For people, NIP-19 adds bech32 encodings with a prefix that says what you're looking at, and a checksum that catches typos:

NIP-19 is explicit that these encodings are for display, copying and QR codes only: events, filters and NIP-05 files use hex. That's why you sometimes need the converter above. A hex private key looks exactly like a hex public key, which is one more reason to keep private keys in a signer and out of text files.

Keeping the private key safe

The safest private key is one that no app or website ever sees. Signers hold it and sign on request:

• On Android: a signer app such as Amber. Other apps on the phone ask it to sign (NIP-55).
• In the browser: an extension such as Alby or nos2x. Websites ask window.nostr to sign and never see the key (NIP-07).
• Anywhere: a remote signer, or "bunker", such as nsec.app. Apps connect with a bunker:// or nostrconnect:// link and send it requests over relays (NIP-46).

For a backup, write the nsec down on paper, or keep an ncryptsec: NIP-49 encrypts the key with a password, stretched with scrypt so that guessing passwords is slow. anchorman's sign-in uses a browser extension or a remote signer, and never asks for your nsec.

If you lose it, or it leaks

There's no reset. If you lose the private key, the account is gone: you can't post as it again. If it leaks, someone else can post as you, and you can't stop them. The only fix is a new key pair: make a new account, tell your followers from the old one while you still can, and point your NIP-05 address at the new key so people who look you up by name find the right one.

A standard way to rotate keys, with the old key vouching for the new one, has been proposed several times but isn't part of Nostr yet. Your NIP-05 name is the closest thing to a stable handle today: it's a name you control that maps to whichever key you use.

Vanity npubs

A "vanity" npub starts with letters you chose, like npub1leon…. Tools find one by generating keys until one matches, which takes longer the more characters you want. Only use a tool that runs on your own machine: a website that generates a key for you has seen your private key.