Your account is a key.

What your account is #

An account is a pair of keys. The public one (your npub) says who you are; the secret one proves it’s you and unlocks your data. That’s all there is: no email, no password, no contact details.

New here? Choose “I’m new here” and the app makes a key for you, shown as 12 words. They’re a standard Nostr key, so you can use it elsewhere on Nostr too. Write the words down: they’re how you sign in on another device, and nobody can reset them for you.

Why Nostr, and why bitcoin #

Both are open, permissionless and quick to get going, with no gatekeepers and no forms.

For accounts, Node Paper borrows Nostr’s way of proving who you are: your device makes its own key pair, and signing a request with it proves it’s you. So there’s no database of emails and passwords to build, guard or leak.

For payments, Node Paper makes a bitcoin Lightning invoice and you pay it from any wallet: no card, no billing details.

Using the Nostr key you already have #

Already on Nostr? Choose “I use Nostr” and sign in with your browser extension (Alby, nos2x and the like), a remote signer (Amber, nsec.app) or by pasting your nsec. Your key is your account here: the first time, Node Paper shows your npub and asks before making an account for it, so a mistyped key never makes one by accident.

Only your public key is connected. Node Paper doesn’t read or post anything on Nostr: no notes, no follows, no messages, no relays (other than the channel a remote signer uses to talk to the app).

What your key signs, and why #

Your key is asked to do exactly two things:

1. Sign in a device. Each time a device signs in, your key signs a short message that names Node Paper and the moment (a NIP-98 event). The server checks the signature to know it’s you. The message is good once, for about a minute, and it’s only ever sent to Node Paper, never published.
2. Lock and unlock your data key. When you make an account, your device makes a random key for your data and encrypts it to yourself with your Nostr key (NIP-44), and the server keeps only that locked copy. A new device asks your key to decrypt it. If your signer asks you to approve “encrypt” or “decrypt”, this is what it’s for. Some signers show what they’re decrypting: that’s your data key, so don’t share it.

Nothing else. Node Paper never asks your key to sign a note, a message, or anything else for Nostr.

Is it safe to connect my main Nostr key? #

• With an extension or a remote signer, your secret key never leaves it. Node Paper can only ask it to do the two things above, and your signer can ask you first.
• If you paste your nsec, it stays on your device, stored encrypted with a key the browser won’t let out, and it’s never sent anywhere.

Two things to know before you choose:

• The server knows your npub uses Node Paper, and when you sync. If your npub is your public identity, that’s tied to you.
• Whoever has your nsec can read your synced lists, just as they could act as you on Nostr.

If you’d rather keep the two apart, use a separate key: choose “I’m new here” and Node Paper makes one just for your lists.

Signing in on another device #

Sign in the same way you made the account: your 12 words, your extension, your signer or your nsec. Your lists sync down. If that device already has lists of its own from another account, it asks whether to start empty or add them to this one.

If you lose your key #

Nobody can reset it, us included, because nobody else has it. Your devices keep their lists and you can export them, but synced lists can’t be opened without the key. While you’re signed in, Settings can show your secret key again so you can write it down.