What Is NIP-17? Private Messages on Nostr, Explained

In short: NIP-17 is the Nostr standard for private direct messages. It encrypts each message with NIP-44 and wraps it twice, in a “seal” and a “gift wrap”, so relays can deliver it without learning what you said or who sent it. amend uses NIP-17 for its private messages.

If you have looked at private messengers built on Nostr, you have probably seen “NIP-17” in the feature list. This guide explains what it is in plain language, how it works step by step, and where its limits are.

First, a quick look at Nostr

Nostr is an open protocol, not a company. Everything on it is an event: a small piece of data signed with the author’s private key. Events are sent to relays, which are simple servers run by many independent people and groups. Anyone can run one.

There are no accounts. Your identity is a key pair. Your public key, written as npub1…, is how others find you, and your private key proves that events really came from you. Because the standard is open, many apps can read the same events with the same keys.

The rules for how apps should behave are written down as NIPs, short for Nostr Implementation Possibilities. NIP-17 is the one for private direct messages.

The problem NIP-17 solves

An older standard, NIP-04, already encrypted the text of direct messages. But the outside of each message was public: anyone watching the relays could see who sent it, who received it and when. The content was hidden, the conversation was not. NIP-04 is now marked as not recommended, and NIP-17 replaces it.

NIP-17 goes further by hiding the sender and blurring the timing, so the information on a relay is no longer enough to link two people together.

How a NIP-17 message is built

Think of it as a letter inside two envelopes.

1. The rumor: your message

Your actual chat message is a normal Nostr event of kind 14, but it is left unsigned. NIP-17 calls this a rumor. Without a signature it cannot be shown to anyone else as proof that you wrote it, even if it leaked.

2. The seal: the inner envelope

The rumor is encrypted with NIP-44 using a key shared only between you and the recipient. The result goes into a seal (kind 13), which you do sign. Only the recipient can open it, and once they do, they can check that it really came from you.

3. The gift wrap: the outer envelope

The seal is encrypted again and placed in a gift wrap (kind 1059). This outer layer is signed by a brand-new random key that is used for one message only. The gift wrap carries one visible tag: the recipient’s public key, so the right person can find it. A separate gift wrap is made for each recipient, and one for the sender so their own app can show the conversation.

NIP-17 also asks apps to set the timestamps on the seal and the gift wrap to a random time up to two days in the past, so the real sending time cannot be read off the relay.

What NIP-44 adds

NIP-44 is the encryption standard underneath. Version 2 combines the secp256k1 keys Nostr already uses with ChaCha20 encryption and an HMAC-SHA256 authentication check, so a message cannot be changed in transit without the change being detected. It also pads messages, so their exact length is harder to guess.

Where the messages go

Each user can publish a short list of their preferred inbox relays (a kind 10050 event). Apps send gift wraps only to those relays. NIP-17 suggests relays only hand gift wraps to the person they are addressed to, after that person proves who they are.

What relays can still see

NIP-17 hides a lot, but not everything. A relay storing a gift wrap can see:

• the recipient’s public key, because the gift wrap has to be delivered to someone
• the time on the gift wrap, which is randomized and so only approximate
• the size of the encrypted data
• the IP address of whoever connects to it

It cannot see the sender, the text or the real time. If your IP address matters to you, use a VPN or Tor (Orbot) along with any Nostr app.

The trade-offs

The NIP itself is open about its limits, and so should we be:

• No forward secrecy by default. Messages are encrypted to your long-term key, so anyone who later steals that key could read old messages they had collected. NIP-17 lists forward secrecy as optional, through disappearing messages.
• Best for small groups. Each message is encrypted separately for every recipient, so the spec suggests other schemes for groups of more than about ten people.
• Spam is harder to filter. Because outer envelopes use random keys, relays cannot block senders by reputation in the usual way.
• Messages are recoverable. The flip side of the first point: any app with your private key can restore your full message history.

One standard, many apps

Because NIP-17 is open, apps that use it can talk to each other. amend uses the same private message standard as apps like 0xchat and Amethyst, so the same keys and messages work across them. If one app disappeared, your identity and your conversations would not disappear with it.

How amend uses NIP-17

• Private messages are NIP-17 gift wraps encrypted with NIP-44 version 2.
• The cryptography (secp256k1, BIP-340 Schnorr signatures, ChaCha20 and NIP-44 v2) was written from scratch in Kotlin and is tested against the official test vectors.
• Your key is created on your phone and encrypted at rest with the Android Keystore.
• Photos and other media are encrypted with AES-256-GCM before they are uploaded to Blossom file servers, which only ever store the encrypted files.

amend is a young app and has not had an independent security audit yet. You can read the full details on the Features and Safety pages, and exactly what data is handled where in the privacy policy.

Want to try it? amend is in closed testing on Google Play, with a public launch coming soon. The Get amend page always has the current status.