Sidecar | A Classy Nostr Signer

A multi-account NIP-07 Nostr signer with a built-in Lightning wallet, in your browser sidebar.

Sidecar lives in your browser’s side panel and hands every Nostr web app a secure window.nostr to sign in with — so you never paste your nsec into a website again. Your keys stay on your device, encrypted behind a PIN. It’s a companion to your favorite Nostr client, not a replacement: sign, post, and zap in a tap, then jump right back to the app you love. 🔑 Your keys, your control Full NIP-07 signer: getPublicKey, signEvent, NIP-04 & NIP-44 encrypt/decrypt, and your relay list. Private keys are encrypted at rest (PBKDF2 → AES-GCM via WebCrypto) — never stored in plaintext, never transmitted off your device. PIN-protected (at least 8 characters, with a live strength check) and automatic re-lock, on by default after a period of inactivity you can adjust. A paste guard blocks dropping an nsec anywhere except the import field. Multiple accounts — store as many keys as you like, switch the active one in a click, drag to reorder. Switching works the way you’d expect: log out of a site, switch accounts here, log back in, and the site follows — while sessions you’ve left open elsewhere keep signing as the account they started with. Per-site permissions with a clear prompt that previews exactly what you’re signing — with human-readable event kinds and a heads-up on the few worth a second look. Relay auth (NIP-42) signs automatically so clients stay connected. 🔐 Key portability Import or export any account as a NIP-49 ncryptsec — a password-encrypted key, so it never has to touch a clipboard as a raw nsec. Back up or restore your whole vault — every account’s key and connected wallet — in one encrypted file. NIP-05 identifiers are verified against their domain, with a check or warning right on your profile. 👤 Your profile, your way View and edit your profile, see your following count, and publish updates in a tap. Edit and publish your outbox relays (NIP-65) right from your profile. Follow-list recovery — if another app wipes or shrinks your follows, scan your relays and restore a healthy earlier version (powered by Mutable). ✍️ Post without leaving the page A composer for notes with @mention autocomplete that searches your follows and all of Nostr, embedded note previews, link cards, and image/video upload (to your own Blossom servers, with an automatic fallback). Drafts autosave per account, and a short review countdown lets you read the note exactly as it’ll publish before it sends. 🔔 Notifications at a glance A bell shows replies, mentions, reposts, reactions, and zaps for your active account — opening instantly and updating live while you watch, and always reflecting a mute the moment you check (even one made in another app). Each taps through to your preferred web client. ⚡ Lightning wallet (Nostr Wallet Connect) Connect any NWC wallet — Alby Hub, Zeus, YakiHonne, Coinos, Minibits and more — with built-in suggestions to help you pick one. Send (BOLT11 or Lightning address), receive by invoice or by your Lightning address (with a QR), view history, and back up or export your connection (PIN-gated, with a QR). Pay a Lightning invoice from any Nostr page in a tap, plus a WebLN provider with optional per-site spending budgets you can edit or revoke any time. Sidecar never holds your funds — you stay in control of your own wallet. 🛡️ Private by design Open source. No analytics, no tracking, no remote code — everything runs locally in your browser. Link previews are fetched with a guard against private-network requests. Works in Chrome, Brave, Edge, and other Chromium browsers. Pin Sidecar, open the side panel, and you’re ready. 🍸 🗞️ What’s new 1.4.0 • A clearer signing prompt — event content shows in a compact preview with Formatted, Raw, and JSON views, and ~40 more event kinds are recognized by name, so routine actions no longer show an “unrecognized kind” warning • Encrypt and decrypt prompts show who you’re messaging by name, with their key kept beneath it to verify — a display name alone can be spoofed • Auto-lock is now on by default (15 minutes idle) — still adjustable, or back to Never, in Settings, and changes take effect immediately • A one-time reminder to save your PIN right after you set it — there’s no recovery if it’s forgotten • Tighter privacy — websites can no longer read your Sidecar settings • Primal wallet strings are flagged up front, with a link to a working wallet, instead of hanging on connect • A “What’s new” section built into the in-app help guide • Addressed a community security audit — refreshed core libraries, tamper-detection for every bundled file, and a licensing cleanup so the whole project stays cleanly open source 1.3.0 • Key portability — import/export any account as a NIP-49 ncryptsec (password-encrypted), so a raw nsec never touches your clipboard • Full-vault backup & restore — every account’s key and connected wallet in one encrypted file; restoring is always additive • NIP-05 verification — your identifier is checked against its domain, with a badge on your profile • Smarter account switching — log out, switch here, log back in and the site follows; open sessions elsewhere stay put; pick the account right in the login prompt • A clearer signing prompt — human-readable event kinds, with a warning on a few worth reviewing • Notifications open instantly, update live, and always reflect the latest mute — even one made in another app