• Backing up your nsec, and what to do if it leaks
  • Backing it up
  • Reducing leak risk
  • If it leaked
  • Checklist

§Backing up your nsec, and what to do if it leaks

On Nostr your key is your account. No password reset, no support desk. Two things matter: don’t lose it, and don’t leak it.

§Backing it up

• Write it down offline. Paper or metal, stored like a house key. A plain note in a cloud drive is a leak waiting to happen.
• Encrypted form (NIP-49). Some clients export an ncryptsec1... string: your key encrypted with a password. Safer to store digitally, but you need both the string AND the password. Test a restore before you rely on it.
• Seed words (NIP-06). Some clients create the key from 12/24 words (derivation path m/44’/1237’/0’/0/0). If yours did, the words are the backup. Not every client can import words, so keep the nsec too.
• Test it. Log in on a second client in read-only mode with your npub, then once with the backup in a signer. A backup you never tested is a hope, not a backup.

§Reducing leak risk

• Keep the nsec in one signer (Amber, a NIP-46 bunker, or a browser extension) instead of pasting it into each client. See my NIP-46 guide.
• Never paste it into a website that “verifies”, “recovers” or “syncs” accounts. Those are theft.
• Watch out for screenshots, clipboard managers and password-manager autofill on shared devices.

§If it leaked

The hard truth: the protocol has no key rotation today. Proposals exist, but none are widely supported, so whoever has your nsec can post as you for good. Move fast:

1. Make a new key in a signer, not in a random client.
2. Copy your social graph. Re-follow from your old follow list (kind 3) and copy your relay list (kind 10002) so people can find you.
3. Announce from the OLD key (while you still control it) and the new one: “old key compromised, my new npub is …”. Ask friends to repost.
4. Update everything that points to the old npub: NIP-05 (your .well-known/nostr.json), Lightning address / zap settings, website bio links, other platforms.
5. Optionally wipe the old profile. Publish an empty or “MOVED” kind 0 profile from the old key. The attacker can overwrite it, but many clients will show yours first.
6. Assume old DMs are readable. Anything encrypted to the old key can be decrypted by the attacker. Tell sensitive contacts.

§Checklist

• [ ] Offline backup (nsec, ncryptsec + password, or seed words)
• [ ] Restore tested once
• [ ] Key lives in one signer, not every app
• [ ] NIP-05 and Lightning address you control (easy to repoint)
• [ ] Know your 5-step leak plan before you need it

Questions? Reply and I’ll add them. Zaps keep these guides coming.