Someone left a very fair comment under my previous article about SkySigner:

“Great, but what the heck is Nostr?”

Fair question.

I had written about Nostr signers, permissions and security while assuming that readers already knew what Nostr was.

Not everyone does.

I didn't either.

So before continuing the SkySigner story, here's the short explanation I probably should have written first.

My First Encounter With Nostr

When I first started looking at Nostr, I made the mistake of thinking it was another social network.

Something like X, Facebook or another alternative platform.

But Nostr isn't really a website.

There is no single nostr.com that owns the network, stores everyone's accounts and decides what everyone can publish.

Nostr is a protocol.

Different applications can use that protocol to communicate with the same network.

That distinction became much clearer when I started trying different Nostr clients.

I could use one client, then open another, and still use the same identity.

That felt strange at first.

On traditional social networks, your account belongs to the platform.

Your X account exists on X.

Your Facebook account exists on Facebook.

With Nostr, your identity isn't supposed to belong to the client you're currently using.

And that's where the keys enter the story.

Your Account Is Basically a Pair of Keys

At the center of a Nostr identity are two cryptographic keys.

A public key identifies you.

A private key proves that you are you.

The public key can be shared freely.

The private key is the dangerous one.

If someone gets it, they can sign events as you.

This immediately changed how I thought about “logging in.”

Normally, when a website asks me to log in, I think:

username + password

Nostr made me think instead:

identity + cryptographic signature

And that leads to an obvious problem.

I didn't want to paste my private key into every Nostr website I wanted to try.

Then I Learned About Signers

A signer provides another approach.

Instead of giving the website your private key, you keep the key somewhere separate.

When the Nostr application needs something signed, it asks the signer.

Very roughly:

Nostr app → “Please sign this.” → Signer → User approval → Signature

The website gets the signature it needs.

It doesn't need to receive the private key itself.

That sounded much better to me.

So naturally, instead of simply using one and moving on with my life, I decided to experiment with building my own. 😄

That's how SkySigner started.

But Where Are Nostr Posts Stored?

This was another concept I initially had to understand.

If there isn't one central Nostr company, where does a post go?

Nostr uses servers called relays.

A client can send your signed events to relays, and other clients can retrieve them.

This creates an interesting separation:

Your identity is your key.

The app you use is a client.

Relays help distribute events.

This is why I could publish something and then see it from another Nostr client.

I wasn't creating a completely new identity every time I changed applications.

I was changing the software through which I interacted with Nostr.

That was probably the moment when Nostr finally clicked for me.

What Is an “Event”?

Nostr also talks about events constantly.

The word sounds more complicated than it needs to be.

A post can be an event.

A reaction can be an event.

A profile update can be an event.

Different types of events have different kinds.

The client creates the event.

Your key signs it.

Relays distribute it.

Other clients interpret it.

That's a simplified explanation, but it's enough to understand why a signer matters.

A signer isn't merely approving “posts.”

It may be asked to sign many different types of events.

And suddenly another security question appears:

Should every Nostr application be allowed to ask the signer to sign everything?

That's the rabbit hole that led to my previous SkySigner article.

Why I Found Nostr Interesting

I'm still learning Nostr.

That's important to say.

I'm not writing this as someone who has spent years developing the protocol.

I'm writing it as someone who recently encountered it, started experimenting with it and eventually built a tool because I wanted to understand one part of it better.

And perhaps that's why Nostr became interesting to me.

I didn't just discover another social media website.

I discovered a different way of thinking about the relationship between:

identity, applications, servers and cryptographic keys.

You can change clients without necessarily changing your identity.

Your identity doesn't have to be a username stored in one company's database.

And applications don't necessarily need direct possession of your private key to act on your behalf.

Of course, that creates new problems too.

Which is exactly how I ended up building SkySigner.

The Simplest Explanation I Can Give

If you've never heard of Nostr before, this is the mental model I wish someone had given me at the beginning:

Nostr is the protocol.

Clients are the apps you use to access it.

Relays help move and store events.

Your public key identifies you.

Your private key proves it's you.

A signer can help you use that private key without handing it directly to every client.

There is much more to Nostr than those six lines.

But you don't need to understand every NIP, event kind or cryptographic detail before the rest of the story makes sense.

And now my SkySigner experiment probably has a little more context.

Sometimes the best reminder when writing about something you've been learning for weeks is surprisingly simple:

Your reader wasn't there when you learned it.

Also, click here to read my article, “I Built My Own Nostr Signer and Discovered a Different Security Problem.”