Beginner · 2 of 7
Your Keys, Your Identity
Learn how to generate, save, and protect your Nostr keys. The complete security guide for beginners. Follow the 3-2-1 backup rule.
Why This Matters
Unlike Twitter or Instagram, Nostr puts you in charge of your identity. No single company can take your account away from you or lock you out of the network. Any one app or relay can still refuse to carry your posts, but your keys, your posts and your followers are not theirs to hold, so you can simply move somewhere else and carry on. That freedom comes with responsibility: you own your keys, you control your account.
The good news? Securing your keys is straightforward. Follow this guide and you’ll be safer than 99% of users.
Understanding Keys (2 minutes)
Nostr uses cryptography to secure your identity. You don’t need to understand the math, though. Think of it like a lock and key system.
What Is a Key Pair?
Every Nostr user has two keys that work together. One is public and starts with npub1, the other is private and starts with nsec1. Here is what each one is for.
Your Public Key (npub1…)
SAFE TO SHARE
npub1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
This is your username. Share it everywhere. Post it publicly. This is how people find you.
What you do with your npub:
- Share it on your website or other social profiles
- Give it to friends so they can follow you
- Post it publicly
- Include it in your email signature
Your Private Key (nsec1…)
NEVER SHARE - TOP SECRET
nsec1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
This is your password. Anyone with this can post as you. Lose it = lose your account forever.
Rules for your nsec:
- NEVER share it with anyone
- NEVER screenshot it (goes to cloud)
- NEVER save it in unencrypted notes
- NEVER paste it into random websites
- ALWAYS back it up securely (see below)
Why So Long?
Those strings look like gibberish because they’re cryptographic keys. Here’s why:
- 256-bit security: Makes it impossible to guess or crack
- Random generation: Even computers can’t predict it
- One-way math: You can’t figure out the private key from the public key
Think of it like this: There are more possible private keys than grains of sand on Earth. No one is guessing yours.
Generate Your Keys (3 minutes)
Tip: This generator makes a real, valid key pair inside your browser. Nothing is sent anywhere. You can keep it as your actual Nostr identity, or treat it as practice and let your app create a fresh one later. If you keep it, back up the nsec now. If you treat it as practice, never reuse it for your real account.
Generate Your Nostr Keys
Create a secure key pair to access Nostr. Your keys are generated locally in your browser and never sent to any server.
Step-by-Step Instructions
-
Click “Generate New Keys”
- This creates a random key pair
- Watch the animation to understand what’s happening
-
If You’re Keeping This Pair, Save Both Keys Now
- Copy your npub (green) to a safe place
- Copy your nsec (red) to a SECURE place
- Do it before you do anything else with the key
- Only practising? Save nothing, and never use this pair for a real account
-
Verify You Saved Them
- The generator keeps nothing: close this page and the keys are gone from it
- So go to the place you saved them and read both keys back
- If you can’t read them back, you don’t have a backup yet
Example Format (Not Real Keys)
Below is the shape of a Nostr key. These are examples only, not valid keys:
Example Public Key (npub) format:
npub1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
Example Private Key (nsec) format:
nsec1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
These are example formats only, not valid keys. Use the Key Generator above to make a working key pair.
The 3-2-1 Backup Rule (2 minutes)
This rule comes from professional data management. Follow it religiously.
Backup Your Keys
Before proceeding, complete this checklist to ensure your keys are safely backed up. This is critical - lost keys cannot be recovered.
Security Tips
- • Never store your nsec in plain text files or screenshots
- • Don't share your keys with anyone, including "support"
- • Test your backup by restoring from it before deleting originals
- • Consider a hardware wallet for maximum security
The Rule Explained
3 copies of your nsec
- One isn’t enough. Two is better. Three is safe.
- If one fails, you have two backups
2 different media types
- Digital: Password manager, encrypted file
- Physical: Paper written by hand, metal plate
- Why different types? Digital fails differently than physical
1 offsite location
- At least one copy should be somewhere else
- Cloud storage counts as offsite (if encrypted)
- Safe deposit box, trusted friend/family member
Backup Methods Ranked
BEST (Do This):
- ✅ Password manager (1Password, Bitwarden)
- ✅ Written on paper, stored in safe
- ✅ Encrypted USB drive in different location
GOOD:
- ✅ Encrypted cloud storage (iCloud/Google Drive with encryption)
- ✅ Metal seed plate (fireproof/waterproof)
NEVER DO:
- ❌ Screenshot on phone (syncs to cloud)
- ❌ Unencrypted notes app
- ❌ Email to yourself
- ❌ Text message
- ❌ Save in browser autocomplete
What Happens If You Lose Your Keys?
This is why the 3-2-1 backup rule matters.
Unlike centralized platforms, Nostr has no “forgot password” button or customer support to recover your account. But don’t worry: following the backup steps above will keep you safe.
Think of it like this: You wouldn’t carry your life savings as cash in your pocket. You’d keep most of it in a bank (multiple backups) and only carry what you need. Your nsec is similar. Store it securely, and not just on your phone.
Security Best Practices (2 minutes)
The DON’Ts (Learn from Others’ Mistakes)
DON’T Screenshot Your Keys
- Screenshots sync to cloud (iCloud, Google Photos)
- Cloud accounts get hacked
- Deleting the photo doesn’t remove it from backups
DON’T Save in Unencrypted Notes
- Default notes in Apple Notes, Google Keep and the like aren’t end-to-end encrypted
- They sync to the cloud automatically, so anyone who gets into your account can read them
- So can anyone holding your unlocked phone or computer
DON’T Share With Anyone
- Not your spouse
- Not your best friend
- Not “Nostr support” (there is no support)
- Not anyone, ever
The DOs (Best Practices)
DO Use a Password Manager
- 1Password, Bitwarden, KeePass
- Encrypted, backed up, accessible
- It’s also the right home for a strong password on the manager itself and on your email
DO Write on Paper
- Low-tech, highly reliable
- No batteries needed
- Store in a safe, lockbox, or hidden location
DO Use Nostr Signer Apps [ADVANCED]
- Apps like Amber (Android) store your keys securely
- Clients request signatures instead of storing keys
- Adds extra security layer
- Recommended for serious users
Common Mistakes (1 minute)
Key Safety
0/6 answered
Three Ways People Lose an Account (Optional Reading)
These are not quotes from anyone. They are composites of the mistakes that come up again and again, written out so you can recognise them before you make one.
“I thought I backed it up”
The nsec goes into a password manager that was never actually syncing. The phone dies, the vault on the laptop has no entry, and the account and its followers are unreachable.
“The screenshot that wasn’t deleted”
Keys get screenshotted, then the photo gets deleted. The Recently Deleted folder keeps it for a month and the cloud backup keeps it longer. Whoever gets into that cloud account gets the nsec.
“The ‘helpful’ stranger”
A message arrives offering to “verify” or “link” your account, and it asks for your nsec to do it. Nobody legitimate ever needs your nsec. There is no verification service, no support desk, and no reason to hand it over.
✓ Key Backup Checklist
Advanced: What Losing Your Keys Costs
⚠️ Click to read: what happens without proper backups (optional)
The 3-2-1 rule keeps you safe. Skip it and the loss usually takes one of these shapes:
The creator earning zaps
Months of building an audience and getting paid in zaps, then the phone is stolen and the nsec was only on that phone. The identity is gone: no way to post as yourself again, no way to show that the account was ever yours. Worth knowing: zaps are paid straight to your Lightning wallet, not held by your Nostr key, so that money is only as safe as your wallet’s own backup. Two things to back up, not one.
The account with years behind it
A phone goes into a pool. Without a backup, the posts, the replies and the audience stay on the relays under a key nobody can use any more, and you start again from zero.
The laptop that died
A single copy on one machine is not a backup. When the drive fails, there is no reset link and nobody to appeal to.
The common thread: every one of these is prevented by a copy in a password manager or on paper, made the day you generate the key.
Questions? Check our FAQ for common concerns about keys and security.