Nostr Quantum Preparation
Preparation Steps
1. Sign in with your Nostr identity
2. Generate a seed phrase
3. Derive post-quantum keys from seed
4. Sign the key-link event
5. Publish events to relays
6. Timestamp the event with OpenTimestamps
Nostr Quantum Preparation
Link your Nostr identity to post-quantum keys — before quantum computers arrive
Quantum computers will eventually break the cryptography Nostr uses today. When that happens, anyone who recorded your public key could forge your signature, impersonate you, and read your encrypted messages. This tool lets you prepare now: it generates a new seed phrase, creates post-quantum keys from it, and publishes a signed statement linking those keys to your current Nostr identity. The statement is then anchored to a Bitcoin block, so no one can backdate a fake one later.
Your current nsec, npub, your followers, and your social graph stay exactly as they are. This program doesn't change anything about your current nostr setup.
Upon completing this process, you should have saved 2 things:
  1. A new seed phrase. This should be kept secret and private.
  2. A proof archive. This information is published to relays, but keeping a copy yourself is useful in case the relays don't keep the event.
In case quantum computers break nostr, you can use your new seed phrase to create a new nostr identity, and prove that your old nostr identity created this new one.
Post-Quantum Preparation
Connected as:
Current Bitcoin block height:
Loading...
This tool will:
  1. Generate a new seed phrase (your recovery backup)
  2. Derive post-quantum keys from that seed via BIP32 paths (ML-DSA-44, ML-DSA-65, SLH-DSA-128s, Falcon-512, ML-KEM-768)
  3. Sign a key-link event linking your identity to the post-quantum keys
  4. Publish the event to relays
Your Seed Phrase
Your seed phrase is your recovery root. All post-quantum keys are derived from it. It is processed entirely in your browser and never sent to any server. The code is open source and auditable.
Back this up offline. Anyone with this phrase can derive your PQ private keys. 24 words (256 bits) is recommended; 12 words (128 bits) is offered for testing only and is weaker under a quantum brute-force model.
Verify out-of-band after linking: This seed phrase is your backup — but this browser cannot cryptographically prove the published PQ keys came from it. After completing the key link, take your seed phrase to a different device or browser, derive the keys independently, and confirm the public keys match the published event. This is the only way to catch a compromised browser that might have substituted attacker keys.
Optional: Add extra entropy by moving your mouse and typing in the box below. This mixes your input with the browser's random number generator, making the seed unpredictable even if the browser's RNG is compromised. You can skip this — a seed has already been generated for you above.
Optional: click here and type random characters, move your mouse to add entropy...
Deriving Post-Quantum Keys
Deriving post-quantum keys from your seed phrase via BIP32 paths. All keys are generated deterministically — the same seed will always produce the same keys.
ML-DSA-44 (Dilithium) — FIPS 204 · Cat 2 · 1312-byte pubkey · m/44'/1237'/0'/0/1
ML-DSA-65 (Dilithium) — FIPS 204 · Cat 3 · 1952-byte pubkey · m/44'/1237'/0'/0/2
SLH-DSA-128s (SPHINCS+) — FIPS 205 · Cat 1 · 32-byte pubkey · m/44'/1237'/0'/0/3+4
Falcon-512 — FIPS 206 (draft) · Cat 1 · 897-byte pubkey · m/44'/1237'/0'/0/5+6
⚠ Draft standard — may need re-issuing if FIPS 206 changes
ML-KEM-768 (Kyber) — FIPS 203 · Cat 3 · 1184-byte pubkey · m/44'/1237'/0'/0/7+8
Sign Key-Link Event
We'll now create two events: a public announcement (kind 1, visible in Nostr feeds) and a proof carrier (kind 9999, which holds the Bitcoin timestamp). Each post-quantum key signs the announcement text, and your signer signs both events with your current Nostr key. The hash of the signed announcement is then sent to OpenTimestamps to be anchored in Bitcoin.
Event preview:
Review & Publish Events
Two events have been signed: a kind 1 announcement (public, visible in Nostr feeds) and a kind 9999 proof carrier (carries the OpenTimestamps proof). Review them below, then publish both to relays when ready.
Kind 1 announcement event:
Kind 9999 proof carrier event:
Relays to publish to:
OpenTimestamps Attestation - Leave This Page Open
Your event's hash was already sent to OpenTimestamps in the previous step, and a pending timestamp proof is embedded in the event you just published. OpenTimestamps anchors that hash into the Bitcoin blockchain, proving your event existed at this moment — so a future quantum attacker can't fake an older event and claim it came first.
Bitcoin confirmation typically takes 10-30 minutes. You can leave this page open to watch the progress below — the polling log updates every minute. Once the Bitcoin attestation is confirmed, this page will automatically sign and publish a new kind 9999 event carrying the upgraded (confirmed) proof, referencing the original via an upgrade_of tag. The original event remains on relays permanently. You're free to close the page; the workflow resumes on your next visit.
Polling log:
Submit hash to OpenTimestamps — pending .ots proof created
Pending proof embedded in kind 9999 event
Wait for Bitcoin confirmation
Polling every 60 seconds...
Publish new kind 9999 with confirmed proof — automatic on confirmation
Bitcoin confirmation verified and the upgraded proof carrier has been published to relays. Download the upgraded proof archive below — it contains the kind 1 event, the upgraded kind 9999 proof carrier, and the confirmed OTS proof (with Bitcoin attestation). Keep a copy in case relays delete the event.