The desktop signer — a NIP-46 remote signer with a GUI. Your Nostr key lives on your
own machine, unlocked with Touch ID, and signs for any app — browser, phone, another
computer — over a relay. The app that asks never sees your key, only the signature.
This is the companion to the browser extension (see the 1.0.0 release). Use the extension
for a signer inside one browser; use this for one key serving everything, including iOS
and Safari, where extensions barely exist.
Install (macOS, Apple Silicon)
Download the .dmg, drag the app to Applications, open it. It is signed with a Developer ID
and notarized by Apple, so Gatekeeper will not complain.
On first run: paste your nsec (or create a brand-new Nostr account in the app), set a
recovery password, and confirm with Touch ID. Then Go online and paste the bunker://
link it shows into any Nostr app.
Key custody
- The key is only ever handled in the Rust process — the UI never receives key material.
- At rest it is sealed as a NIP-49
ncryptsectwice: once under a random 256-bit key in
the macOS Keychain (Touch ID gated) and once under your recovery password. Both open the
same key, so unlock methods can be added or revoked without re-encrypting anything. - Every request shows the app and what it wants. Auto-approve is opt-in per app, revocable.
- No analytics, no accounts. Network traffic is NIP-46 relay chatter plus an optional public
profile lookup.
Known limits — please read
- Apple Silicon only. No Intel build yet.
- Windows is not packaged. Windows Hello support is written but the secure-storage path
is not implemented; it fails with a clear message rather than silently. - Touch ID is currently app-enforced, not bound to the Keychain item's access control.
That upgrade is next. - No independent security audit. It is small enough to read — please do, before trusting
it with a key that holds value.
Verify your download against SHA256SUMS-desktop.txt.