NIP-59 (Gift Wrap)

NIP-59 defines "gift wrapping," a three-layer construction that lets Nostr events hide not just their content but most of their metadata. On a protocol where every event is normally a signed, public, timestamped record, encryption alone is not enough: who talked to whom, and when, is often as sensitive as what was said. NIP-59 is the generic mechanism that private-messaging and other confidential protocols on Nostr reuse, rather than each reinventing metadata protection. The design progressively peels concerns apart across three nested events.

The three layers

The innermost layer is the rumor: an unsigned event carrying the real content. Because it has no signature, a leaked rumor cannot be cryptographically attributed to anyone — the author can always deny it, which provides a meaningful form of deniability if a recipient's device is ever compromised. The middle layer is the seal (kind 13), which encrypts the rumor and is signed by the author's real key; the only thing publicly visible at this layer is who signed it, not what was said or to whom. The outer layer is the gift wrap (kind 1059, or ephemeral kind 21059), which encrypts the seal under a single-use, randomly generated keypair. To any relay or observer, the wrap appears to come from a throwaway identity that will never be used again, so the true sender is hidden while the routing tags — chiefly the recipient's pubkey — remain readable enough for delivery.

Why the layering matters

Each layer isolates exactly one concern: the rumor gives content without attribution, the seal gives authorship without disclosure, and the wrap gives delivery routing without revealing the real sender. Encryption at both the seal and wrap layers uses NIP-44, the modern versioned encryption standard. Timestamps on the seal and wrap are deliberately randomized into the recent past so that observers cannot correlate wraps by timing — a small detail that defeats an entire class of traffic-analysis attacks. What a relay ultimately sees is a stream of anonymous envelopes addressed to pubkeys, with scrambled clocks and no linkable senders.

Stored versus ephemeral wraps

The two outer event kinds serve different delivery patterns. Kind 1059 falls in the regular storage range, so relays retain it and a recipient who was offline for a week can fetch waiting wraps later — asynchronous delivery, like a mailbox. Kind 21059 sits in the ephemeral range, which relays broadcast but do not store, suiting real-time signals where persistence would only be a liability.

What it means for sovereign users

Gift wrap is the building block behind metadata-resistant communication on Nostr, and its most important application is private messaging: NIP-17 (Private Direct Messages) wraps every DM this way, which is why NIP-17 conversations leak no participant graph the way the legacy DM scheme did. The honest caveats: the recipient's pubkey on the wrap is still visible to the relays that accept it (that is what makes delivery possible), and gift wrap protects the pipe, not the endpoints — a compromised device reads everything regardless. For a Bitcoiner coordinating anything sensitive over a censorship-resistant transport, though, this is the current state of the art: content, authorship, timing, and social graph each locked behind its own layer, on infrastructure nobody can take away from you.