Free · Open Source · No Backend Required

Login with Nostr

Add passwordless authentication to your website in 2 lines of code. No emails, no passwords, no OAuth providers. Users own their identity.

1 Add the script

One script tag. Loads from the CDN, self-initializes.

2 Add the button

Drop a div anywhere on your page. The script renders the button.

3 Listen for login

When the user authenticates, you get their public key. That's their identity.

document.addEventListener('nostr:login', function(e) { const pubkey = e.detail.pubkey; // That's it. This is the user's unique, permanent identity. // No password to hash. No email to verify. No OAuth token to refresh. console.log('User logged in:', pubkey); });

Try it

If you have NostrKey installed, click the button below.

Your Keys, Your Terms

A bunker URL lets any Nostr app request signatures through a relay. Your private key stays in NostrKey and never reaches the app.

You create one from the extension:

Open NostrKey and unlock it.
Pick the profile you want to sign with.
Open its Bunker panel.
Press Create Bunker URL, then copy it.

Paste that URL into any app that supports NIP-46 with NIP-44 encryption. Amethyst, Coracle and Nostrudel all do.

Never share this URL publicly. Anyone with it can sign events as you.

Only the extension can start a bunker. A web page cannot do it on your behalf, and NostrKey blocks any page that tries.

Get NostrKey

Building an AI agent?

Your bot deserves its own identity and wallet. NostrKey gives it cryptographic identity. NostrWalletConnect gives it Lightning wallet access. Both are plain Python libraries with no agent-framework dependency. Add them however your platform adds skills.

from nostrkey import Identity from nostrwalletconnect import NWCClient bot = Identity.generate() event = bot.sign_event(kind=1, content="Hello from an AI")

Learn about integrating these skills pip install nostrkey pip install nostrwalletconnect

When should I use a Bunker URL?

A bunker URL routes signing requests through a relay so your private key never leaves your device. Use it when direct key access isn't ideal.

Scenario	NIP-07 (direct)	Bunker URL (NIP-46)
Your own browser, trusted site	Yes	Either
Shared or public computer	No	Yes
Site you're trying for the first time	Maybe	Yes
Automated or long-running session	No	Yes
Mobile browser without extension support	No	Yes

No Backend

Everything happens client-side. The script talks directly to the user's key manager. Your server just receives a public key.

No Passwords

Users authenticate with cryptographic keys. Nothing to leak, nothing to reset, nothing to brute force.

No Vendor Lock-In

Nostr identities are portable. Users aren't locked to your platform or any single provider. Open protocol.

One Identity Everywhere

The same identity works on every Nostr-enabled site. Users log in once with their key manager, use it everywhere.

Privacy by Default

No email required. No tracking cookies. No third-party OAuth. The user's public key is all you need.

Works Everywhere

Desktop (Chrome, Safari, Firefox). Mobile (iOS, Android). The button adapts and guides users to install if needed.

How it works

User clicks "Login with Nostr"

The button checks if a Nostr key manager (like NostrKey) is installed in the browser.

Key manager handles authentication

If installed, the key manager provides the user's public key. If not, the user is guided to install one. No friction either way.

Your site receives a public key

A nostr:login event fires with the user's public key. Store it, use it as a user ID, look up their profile. It's a permanent, cryptographic identity.

Done. The public key is the identity.

No password to store and no OAuth token to refresh. You still set your own session length, and you can ask for a fresh signature whenever it matters. The private key never leaves the user's device.

Options

Customize the button appearance and behavior.

<!-- Dark theme (default) -->
<div id="nostr-login" data-theme="dark"></div>

<!-- Light theme -->
<div data-nostr-login data-theme="light"></div>

<!-- Large button -->
<div data-nostr-login data-size="large"></div>

<!-- Auto-add a relay when user logs in -->
<div data-nostr-login data-relay="wss://your-relay.com"></div>

Events

Listen for authentication state changes.

// User authenticated document.addEventListener('nostr:login', async (e) => { const url = location.origin + '/api/auth/nostr'; // NIP-98 (kind 27235): proof of key possession, bound to // this exact URL and method, and stamped with a timestamp. const auth = await window.nostr.signEvent({ kind: 27235, created_at: Math.floor(Date.now() / 1000), tags: [['u', url], ['method', 'POST']], content: '' }); // Your server verifies the signature, the u tag, the method, // and that created_at is inside its allowed window. await fetch(url, { method: 'POST', headers: { Authorization: 'Nostr ' + btoa(JSON.stringify(auth)) } }); });

FAQ

What is Nostr?

Nostr is an open protocol for decentralized identity and communication. Think of it as a universal login system where users own their identity through cryptographic keys. No company controls it.

What does my user need?

A Nostr key manager like NostrKey (browser extension or mobile app). If they don't have one, the button guides them through setup. It takes about 30 seconds.

What do I store on my server?

Just the public key (a 64-character hex string). That's the user's unique identifier. No password hashing, no email verification, no OAuth tokens to manage.

How do I verify the user later?

Ask them to sign a NIP-98 auth event (kind 27235). It carries the exact URL and HTTP method it was signed for, plus a timestamp, so the signature cannot be replayed against a different endpoint or reused later. Verify it on your server against their public key.

Never accept a bare public key as proof of identity. Public keys are public, so anyone can send you someone else's.

Is this secure?

Nostr uses secp256k1 elliptic curve cryptography (the same as Bitcoin). Private keys never leave the user's device. There's no central server to breach, no password database to leak.

Does it cost anything?

No. The script is free and open source. NostrKey is free. Nostr is an open protocol with no usage fees.

Can I use my own relay?

Yes. Add data-relay="wss://your-relay.com" to the button div. When users log in, the relay is automatically added to their key manager.

What is a bunker URL?

A bunker URL (NIP-46) lets you log into Nostr apps without giving them your private key. Instead, signing requests are routed through a relay back to your key manager. You stay in control. Your keys never leave your browser.

Ready to go passwordless?

Two lines of code. No backend changes. No vendor lock-in.

View on GitHub Get NostrKey