Private messages

Everything you’ve seen so far is public on purpose: notes, likes, follow lists. But sometimes Alice just wants to tell Bob where to meet. Nostr has no private servers to hide behind. Every direct message is still an event sitting on a relay that anyone could read. So the privacy has to live inside the event itself.

That’s harder than it sounds, because a secret has two parts:

• What you said: the words.
• Everything around it: who sent it, who it’s for, when, and roughly how long it was.

That second part is called metadata, and it can be just as revealing. If a relay sees Alice message a divorce lawyer at 2 a.m. every night, it doesn’t need to read a single word.

Three generations of secret notes

Nostr’s private messages evolved in three steps. Think of them as:

1. NIP-04: a postcard with a padlock on the text. Everyone can still read the address, the sender and the postmark.
2. NIP-44: a much better padlock. Still a postcard.
3. NIP-17: the postcard goes in a signed envelope, and that envelope goes inside a plain brown parcel posted by a stranger.

Here is the same message sent all three ways, with real encryption running in your browser. Look at what the relay can see, then try to open each one as Bob, as nosy Carol, and as the relay itself.

Things to try:

• Compare the red badges in the relay’s view as you go from NIP-04 to NIP-17.
• Pick Carol and try to open the envelope. Her key is a perfectly good key, just not the right one.
• On NIP-17, press Send it again a few times and watch the outer sender change every time.

Step 1: NIP-04, the leaky postcard

NIP-04 was Nostr’s first attempt. Alice and Bob each mix their own secret key with the other’s public key and arrive at the same shared secret without ever sending it. That trick is called ECDH, and it’s the foundation of every scheme in this chapter.

Alice then scrambles her text with that secret and publishes a kind 4 event. The words are hidden, but look at what’s left on the outside:

• pubkey: Alice’s real public key.
• a p tag: Bob’s public key, so the relay knows where to deliver it.
• created_at: the exact second she hit send.
• the ciphertext length, which tracks the message length to within 16 bytes.

Anyone can draw a map of who talks to whom, when, and how much. That’s why NIP-04 is officially deprecated: the spec itself carries a warning that it leaks metadata and is nowhere near the state of the art.

{
  "kind": 4,
  "pubkey": "<alice's pubkey>",
  "created_at": 1735689600,
  "tags": [["p", "<bob's pubkey>"]],
  "content": "J7d9…base64 ciphertext…==?iv=AQEBAQEBAQEBAQEBAQEBAQ==",
  "id": "…",
  "sig": "…"
}

import * as nip04 from "nostr-tools/nip04";

// Legacy only: read old DMs, don't send new ones.
const content = nip04.encrypt(aliceSecretKey, bobPubkey, "Meet me at 9");
const text = nip04.decrypt(bobSecretKey, alicePubkey, content);

Step 2: NIP-44, a lock worth trusting

NIP-44 replaces the padlock with a modern, audited design. It doesn’t define a message type at all: it’s just a way to turn text into a sealed blob that only the two of you can open. Three upgrades matter:

• Tamper-proof: every blob carries an authentication code. Change one bit, or use the wrong key, and decryption refuses loudly instead of handing back garbage.
• Fresh keys per message: a random nonce makes every message use its own key material, so sending the same text twice never gives the same blob.
• Padding: messages are rounded up into size buckets, so “yes” and “no way!” look identical.

Try it: type something short, then something a bit longer, and watch which sizes stay the same.

But notice what didn’t change in the lab when you switched from NIP-04 to NIP-44: if you put a NIP-44 blob into the same kind of event, Alice’s key, Bob’s tag and the timestamp are still on the outside. A better lock doesn’t fix a see-through envelope.

import * as nip44 from "nostr-tools/nip44";

const conversationKey = nip44.getConversationKey(aliceSecretKey, bobPubkey);
const payload = nip44.encrypt("Meet me at 9", conversationKey);
// Bob derives the very same key from his side:
const text = nip44.decrypt(payload, nip44.getConversationKey(bobSecretKey, alicePubkey));

Step 3: NIP-17, envelopes all the way down

NIP-17 is today’s recommended way to send private messages. It takes the NIP-44 lock and adds clever packaging from NIP-59, called a gift wrap. Picture three layers, from the inside out:

1. The rumor (kind 14): the actual chat message, written by Alice. It is a normal event with an id, but no signature. That’s on purpose: if it ever leaks, nobody can prove Alice wrote it. A rumor, literally.
2. The seal (kind 13): the rumor, encrypted to Bob and signed by Alice. This is how Bob knows it’s really her. The seal has no tags at all, so it doesn’t say who it’s for.
3. The gift wrap (kind 1059): the seal, encrypted again and signed by a brand-new random key that’s used once and thrown away. It carries a single p tag so the relay can deliver it to Bob.

The relay only ever sees layer 3. The sender is a stranger who will never post again, the timestamp is deliberately fuzzed (up to two days in the past), the real kind is hidden, and the size is padded.

Go back to the lab, pick NIP-17, and peel it as Bob: wrap, then seal, then rumor. When the seal opens, your browser checks that the seal’s signer is the same key as the rumor’s author, otherwise anyone could forge a message “from Alice”.

{
  "id": "…",
  "pubkey": "<alice's pubkey>",
  "created_at": 1735689600,
  "kind": 14,
  "tags": [["p", "<bob's pubkey>"]],
  "content": "Meet me at 9"
}

{
  "kind": 13,
  "pubkey": "<alice's pubkey>",
  "created_at": 1735601234,
  "tags": [],
  "content": "<NIP-44(rumor JSON), Alice → Bob>",
  "id": "…",
  "sig": "…"
}

{
  "kind": 1059,
  "pubkey": "<random throwaway pubkey>",
  "created_at": 1735555555,
  "tags": [["p", "<bob's pubkey>"]],
  "content": "<NIP-44(seal JSON), throwaway key → Bob>",
  "id": "…",
  "sig": "…"
}

import * as nip17 from "nostr-tools/nip17";

// One call builds rumor → seal → wrap with a fresh throwaway key.
const wrap = nip17.wrapEvent(aliceSecretKey, { publicKey: bobPubkey }, "Meet me at 9");

// Bob peels both layers and gets the kind 14 rumor back.
const rumor = nip17.unwrapEvent(wrap, bobSecretKey);
console.log(rumor.kind, rumor.content); // 14 "Meet me at 9"

Quick check