NIP-46 is a Nostr protocol for remote signing. It allows a client to request cryptographic operations from a separate signer, so the application using Nostr does not need to hold the user's private key itself.
How remote signing works
The user runs or trusts a signing service sometimes described as a bunker. The client and signer establish a Nostr-based communication channel and exchange encrypted requests. The client can ask the signer to create signatures or perform supported key operations; the signer can apply its own approval policy before returning the result. Connection strings and permissions let compatible clients discover how to reach the signer without simply copying the secret key into every browser or mobile application.
Why separating the key matters
Private-key custody is one of the hardest usability problems in decentralised protocols. If every Nostr client receives the same master key, one compromised app can compromise the user's entire identity. Remote signing changes the security boundary: the key can remain on a dedicated device or service while clients receive narrowly mediated signing capability. It also makes account use across many apps more practical without repeated key export.
Remote signers still need a threat model
NIP-46 does not eliminate trust or attack surface. A remote signer can become unavailable, approval prompts can be phished, and weak permission handling can still authorise dangerous operations. Users should understand recovery and availability before depending on a bunker. The security gain comes from isolating the private key, not from making key management disappear.
Related reading
- What Is WebFinger? How ActivityPub Finds Accounts Across the Fediverse
- What Is did:plc? The Identity System Behind Most Bluesky Accounts