npub / nsec

npub and nsec are the two halves of a Nostr identity, encoded in the human-friendly bech32 format defined by NIP-19. The npub (prefix npub1...) is your public key — the identifier you share freely so others can follow you and verify the signatures on your events. The nsec (prefix nsec1...) is your secret key — the credential that proves you are you. Whoever holds the nsec is the identity, in exactly the way whoever holds a Bitcoin private key owns the coins. There is no account, no email on file, no recovery flow — just a keypair you generated yourself.

What the encoding actually is

Underneath the friendly prefixes, both are ordinary secp256k1 keys — the same elliptic curve Bitcoin uses — represented as 32 bytes and dressed in bech32 so that humans can recognize them at a glance and clients can catch typos with the built-in checksum. The prefixes are a safety feature as much as a convenience: any string beginning npub1 is safe to publish anywhere, while anything beginning nsec1 must never leave your custody. NIP-19 defines sibling encodings too — note1 for event IDs, nprofile1 for a key bundled with relay hints — but npub and nsec are the pair that defines identity itself.

The custody rules

Nostr inherits Bitcoin's unforgiving key discipline, and the same habits apply. Never paste an nsec into a website you do not fully trust; the moment it touches a malicious page, the identity is gone — there is no reset-password, no support ticket, no revocation. Back it up offline, the way you would a seed phrase. And for daily use, do not hand the raw key to every client: NIP-07 browser signer extensions keep the nsec sealed away and let web clients request signatures one event at a time, and remote-signing arrangements go further by keeping the key on a separate hardened device — the same privilege-separation instinct behind a hardware wallet. The identity that posts casual notes can afford more convenience than the identity that anchors your reputation or receives zaps; scale the ceremony to the stakes. Some users derive their Nostr key from a dedicated seed so it backs up with familiar tooling; whatever the method, the test is simple — if your house burned down tomorrow, could you restore the key from what survives?

Why it matters for sovereignty

Because your account is a keypair you generate yourself, no company issues it, no company can revoke it, and no company can lock you out. Your followers follow your npub, not a server account, so your social identity is portable across every Nostr client and relay — if a client dies or a relay bans you, you open a different one and continue as yourself, history intact wherever your events are stored. This is the structural difference from platform identity, where the username is a row in someone else's database, lent to you under terms that can change. On Nostr the relationship inverts: clients and relays are interchangeable service providers to an identity that belongs to you.

The trade worth understanding

Self-issued identity means self-carried risk: key loss is identity loss, and key theft is impersonation, permanently. That is not a flaw but the price of the property — the same bargain Bitcoiners accepted for money. Treat the nsec with the seriousness of a signing key for your public life, because that is what it is. D-Central covers key-custody practice across our digital sovereignty hub, and the servers that carry your signed events are covered under Nostr relay.