-
@ Swift
2025-06-15 10:36:35Using Browser Extensions to Log In and Sign Events on Nostr
If you're new to Nostr, or trying to log in to a client via a web browser using an existing account, you may come across something that feels risky: being asked to paste your private key (your
nsec) into a website to log in. This guide outlines a safer alternative. using browser extensions like Nos2x or Alby, which let you securely log in and sign actions without exposing your private key.These extensions only work in desktop web browsers, not in mobile apps. If you're logging in to a mobile Nostr client (such as Primal, Amethyst, Damus, or others), you’ll typically need to either paste your existing
nsecinto the app or use a secure import method, like scanning a QR code or restoring from a backup. Be extremely cautious when pasting yournsec, and only do so in apps you trust.What is NAWC
NAWC stands for "Nostr Authorisation Web Credential". It allows Nostr websites to ask your browser for permission to read your public key and sign messages, without needing direct access to your private key. It works similarly to a password manager or a crypto wallet extension.
Why avoid pasting your
nsecYour
nsecis your private key. If someone gains access to it, they can impersonate you, send posts as you, or read your private messages.Pasting your
nsecinto a web form is discouraged for several reasons:-
The site might be compromised or malicious
-
Your key could be stored in browser memory or cached
-
Extensions, scripts, or browser plugins could access the field
-
You may unknowingly copy or sync it elsewhere (e.g. clipboard history, autofill, cloud sync)
Once exposed, your
nseccannot be revoked or changed, it is your entire Nostr identity. This is why experienced users recommend using extensions that safely manage your key and handle signing.What new users might notice
Some Nostr clients still prompt users to paste their
nsec, even when a signing extension like Nos2x is installed. This can cause confusion, especially for users trying to follow best practice. Extensions sometimes need to be manually enabled, refreshed, or granted permission before they are recognised. These challenges are common in a developing ecosystem and should improve over time.Extensions that support NAWC
Nos2x
-
Chrome only
-
Stores one private key locally
-
Works with sites like Primal and Coracle
-
Lightweight and simple to use
Alby
-
Available for Chrome and Firefox
-
Originally built for Lightning, but also supports Nostr
-
May need extra setup for non-Lightning Nostr use
-
Supports switching between keys and profiles
Bunker (self-hosted signer, not an extension)
-
Keeps your private key entirely isolated from the browser
-
Can be combined with hardware devices or run remotely
-
Ideal for advanced users or managing multiple keys with higher security
Why Signing Events Matters in Nostr
On Nostr, everything you do, posting a note, reacting to content, updating your profile, is considered an event.
To prove that an event is really yours, it must be signed with your private key. This signature is what makes the event valid and verifiable by anyone on the network.
Browser extensions like Nos2x, Alby, or self-hosted signers like Bunker handle this event signing for you. Instead of giving the site your private key, the extension signs the event on your behalf, keeping your key secure while still proving authorship.
In short: extensions are not just for logging in, they also sign everything you do. This keeps your identity secure and helps maintain Nostr’s decentralised and trustless nature.
How to use an extension
-
Install Nos2x or Alby
-
Enter your
nsecinto the extension settings (only once) -
Visit a Nostr client like primal.net
-
Approve the login request from the extension
-
You’ll be logged in securely without pasting your key
Switching keys
Most extensions support only one private key at a time. To switch:
-
Open the extension
-
Remove the current key and enter a new one
-
Refresh the site and reauthorise when prompted
If your old key keeps reappearing or does not seem to clear properly, it may be necessary to:
-
Uninstall the extension
-
Reinstall it from the Chrome Web Store
-
Then enter your new
nsecduring setup
This is a known issue with some extensions (like Nos2x), and will likely improve as tools mature. For now, a clean reinstall is a simple workaround.
Wrap-up
Browser extensions are one of the safest and most effective ways to interact with Nostr. They protect your private key, simplify login, and securely sign every action you take.
While the user experience is still evolving, using a signing extension today is a smart way to get started safely and build good habits as you explore the network.
For more beginner-friendly Nostr guidance, visit:\ https://swiftsats.github.io/getting-started-with-nostr/
-