No bullshit, safe, and reliableNostr signup for normies and hackers
1. Create a profile with Amber (installation from Zapstore is recommended).
2.[Settings] → [Backup keys] → enter your encryption password → [Encrypt and copy to clipboard] → paste the ncryptsec to a password manager you trust (like this one) → copy the ncryptsec on paper → ensure you've cleared up your clipboard when you're done.
☠️ Never paste your ncryptsec/nsec to Telegram/WA/ProtonMail/Google Docs/whatever (even to send it as a private message yourself!)—that's a fatal mistake, total profile control loss by leaking your private key to a third-party (see "Safety and Responsibility" below).
☠️ Never paste your ncryptsec/nsec to any Nostr Login screen even (same reason, see "Safety and Responsibility").
Safety and Responsibility
Your key = Your data. Someone else's key = someone else's data. Even a server owner can't modify your data, can't read your private messages, can't ban/censor you from the entire Nostr network (in the worst case, they can delete your data or ban you, but only on the server they have control over).
Password ≠ key: password is changeable, key is not. A key is much more powerful: it's full control over your data forever. The point of this step is to safely make several physical backups of your password-protected private key (the ncryptsec, not the unprotected nsec!) to several places: a password manager and on paper.
🔒 the full control means extra responsibility: roughly speaking, you can't undo a compromise of your profile by changing some password, stored on some remote server, because that would mean the server owner authorizes actions with your profile, not you
❌ never ever paste your private key to anything but Amber or a password manager
⚰️ if you've already leaked your private key to something different from Amber or a password manager, that means your profile is probably irreversibly compromised: somebody or something may access it, may read your private messages, may publish posts on your behalf, etc.; don't fuck with it, delete it (login whatever way into Armada → [Settings] → [Delete Account]), and start all over again.
3. Generate a one-time bunker:// URI from Amber with [+] → [Add nsecbunker] → enter name → [Create] → scroll down → [Copy to clipboard]. Copy the URI in whatever preferable way to your Desktop/Laptop machine (will be referred to as Laptop here).
Safety
✔️ it's not perfect, but still acceptable to copy-paste the one-time bunker:// URI over a message to yourself in whatever private messenger (you can reject all Amber requests and revoke the URI if you've accidentally leaked it to somebody malicious).
4. Open this page on your Laptop → install Bunker46 → click on the extension icon → paste the bunker:// URI copied from Amber → [Connect] → allow and keep allowing whatever is needed on both devices (on each permission request on your phone in particular, depending on the screen you see, manually select [I fully trust this application] or [Automatically sign this for] → [Always]) → this page.
5. your relay/server lists.
Or select them manually first if you know what you're doing.
Content Relays:
DM Relays:
Marmot Key Package Relays:
Search Relays:
Blossom Servers:
Publish Relay Lists to:
⚠️ Check your phone notifications if something has failed. Retry the "Publish" button in case of failure; don't continue if this step hasn't succeeded.
6. Use Armada Nostr client (also available as an onion service) for private/group chats:
- Armada browser page on Laptop → [Log in with Extension]
- Armada Android app → [Log in with Amber] (see the troubleshooting below if you don't see the button)
- never paste your nsec1 in the login screens (see step 2)
- check your phone notifications if something fails—perhaps you've missed a new permission request.
7. For everything else (but chats!) use YakiHonne or Ditto (tor) or Primal or Nostria or noStrudel or whatever Nostr client works for you. Login the same ways (using Amber signer, browser extension, or a new bunker:// URI), never with your raw ncryptsec/nsec. nostrconnect:// is not recommended; use bunker:// URI when possible.
Messengers Privacy
☝️Not all Nostr private chat clients currently support file encryption. Armada supports it, but, for instance, YakiHonne currently doesn't: if you send a file in a private chat using YakiHonne—at least a server owner will have access to your file without any encryption.
Troubleshooting
If you don't see [Log in with Amber] in Armada Android app—use a newbunker:// URI (step 3). Don't use [Open signer app].
If anything else is blocking you from using Armada Android app—either use Nospeak app → [Login with Amber] or/and use Armada browser page in your Mobile browser + newbunker:// URI (step 3). Note that group chats created in Armada won't work in Nospeak; media sent between Armada and Nospeak may fail to decrypt.
Laptop browser clients stopped working—check your phone connection and check Bunker46 extension icon.
If the extension shows a red button "Remove this profile"—don't press it; the easiest workaround would be restart your browser entirely:
(Chromium-based browsers) [⋮] → [More Options] → [Exit], (in Firefox-based) [☰] → [Exit].
For nerds
FAQ
Q: Many Nostr starter guides exist. What's so special about the new one?
A: Two issues it hopefully addresses: reliability and security. People keep complaining that NIP-17 DMs in particular don't reliably work for them. In my experience the main reason has to do with relays: different DM clients (+signers) set up different (usually inadequate) relay lists and/or fail to connect and publish to them. And for security—too many guides (and apps) motivate users to practice dangerous stuff that leads to private key compromise.
Q: Why not scan the nostrconnect QR generated by Bunker46 (instead of transmitting a bunker:// URI to desktop)?
A: Indeed, that would be both more privacy-friendly and user-friendly. Unfortunately it's currently broken. You might want to check out an Amber-specific Remote NIP-07 browser extension as an alternative to Bunker46 (untested).
Q: Armada Laptop app (rather than the browser page)?
A: Untested, possibly works; use a newbunker:// URI (step 3).
A: iOS?
Q: Currently broken. You can still use Armada from Mobile browser connected over Amber signer using a newbunker:// URI (step 3).
For paranoid nerds:
Q: Laptop setup only?
A: Only if you know what you are doing. Possible, for instance, with nak bunker, running on a hardened enough OS. I don't recommend storing your nsec/ncryptsec directly in NIP-07 browser extensions (like nos2x) because currently every browser is a critical vulnerabilities honeypot fractal.
Q: I'm scared to carry my private key on my phone, and my mobile client doesn't support bunker:// URI.
A: You can connect Amber to an external bunker (it's slow but works for me) or try FROST (untested).
Q: Armada/Concord vs White Noise/Marmot vs Cordn?
A: I wish somebody could independently investigate and contribute it here. Don't take my word without verifying it; at least something could be outdated already. In short:
- Armada/Concord is reliable, decentralized, private, and non-secret (it will load all chats from relays and decrypt them after logging in from a new device)
- White Noise is experimental, decentralized, private, and secret (it won't load and decrypt old chats on a new device, because relays don't store chat data after transmission)
All of them (even KeyChat, AFAIK) leak metadata (who/whom wrote when, but not what exactly was written) to relay operators (server owners). That's the reason to avoid using your real IP address: use VPN or Tor with all Nostr clients if possible.
Preconfigure relays/servers for your friend
If you want to provide this page to somebody with additional relevant location/invite/WoT/etc.-based preconfigured relays/servers, use hash parameters: content, dm, keypackage, search, blossom, profile, append. Example.