Adds a field in settings to publish a display name, so comments from a key made here no longer show as npub1abc…. An existing profile is merged rather than replaced.

Fixes four ways a key or a profile could be lost: the onboarding button could generate over a stored key without asking; an external signer that switched account could have its profile overwritten; an old profile left on a slow relay could overwrite a newer one; and a signer prompt approved a moment too slowly threw away what you had written.

This one is about which key speaks for you.


If you chose Key stored here and then reloaded a page with Alby or nos2x
installed, the panel connected as the signer's identity instead. Silently. Your
own key was never touched — it sat in storage the whole time — but you could post
under an identity you had not chosen and nothing said so.

On load the panel asked only whether a signer was installed, not which one you had
picked. Your choice is honoured now. Only when you have never made a choice does
the presence of a signer decide, which is a reasonable default for a first run.

Worth checking after updating: open ⚙ Settings and confirm the Signing section
shows the source you expect.


After switching to your signer and reloading, switching back was refused with that
message — while your npub was displayed two lines above it. The check asked whether
the key was loaded, not whether it existed. It asks storage now.


Alby and nos2x add themselves to the page asynchronously. The panel looked once,
allowed 800ms, and if that look came back empty it never tried again for the rest
of the page — pressing the signer button in Settings by hand was the only way out.
It now allows 2.5 seconds and keeps looking for about thirty.


Switching back to a stored key loaded it but left "Show private key" showing an
empty box. Introduced by the fix in v22.54 that took the key out of the page's
reach; corrected here.

Two of the six relays included by default were not responding and have been
replaced. Your own relay list is untouched — this only affects fresh installs.

The same relay could also appear twice in the list if it was added once with a
trailing slash and once without, which quietly doubled the connections made on
every page. Addresses are now normalized, and existing lists are cleaned up.

Settings now says what each of your relays is actually doing.

A relay that never answers looked exactly like a relay with nothing to say. Both
give you a thinner, slower thread, and nothing explained why — connections failed
silently, retried a few times and gave up without a word.

Each relay in Settings now carries a line: "answered · 12", "answered · nothing
here", "no answer", or "gave up". Answering with nothing and never answering are
different problems, and they were indistinguishable before.

This came out of finding that three of the six relays shipped by default did not
respond from one machine on one afternoon. The default list is deliberately
unchanged — that measurement was taken after hours of hammering those relays, and
one of the three had been serving data minutes earlier. Rather than change what
everyone gets based on one bad sample, the extension now shows you the answer for
your own machine.

You can now reply to ordinary Nostr notes from the panel. A note that links to the
page is a Nostr conversation rather than a comment written here, so your reply is
published as an ordinary Nostr note threaded onto it — which is also why the reply
box now tells you, before you type, that it will reach your followers and how many
people it will notify.

Notes are easier to tell apart from comments: they have their own border and a
slightly recessed card instead of looking identical to a comment with a small
label. Tapping that label explains what a note is, which previously only worked
with a mouse.

Two fixes from a security review of everything that changed since v22.53. The
small button that re-enables the extension on a site you switched it off on could
be hidden by that site's stylesheet, which left no way to turn it back on there.
And an error while composing a post could leave the Post button stuck with no
explanation.

Your private key was readable by the page it was open on. The comment panel lives in a
shadow root that any script on the site can reach, and the key sat in a field there from
the moment you opened Settings — not only while you were looking at it — until you left
the page. Deleting your identity did not clear it either. The key now stays out of the
page's reach and appears only while it is on screen.

If you used an earlier version on a site you do not trust, treat your key as exposed and
switch to a new identity in Settings.

Older comments are visible again. Version 22.51 moved to NIP-22 comment events and stopped
reading ordinary notes, which hid far more than intended: a note tagged with a page URL is
how any Nostr client links a note to a page, so everything said about a page elsewhere
disappeared from the panel. Those notes are shown again, marked as notes. You can vote on
them; replying is not possible, because a NIP-22 comment may not reply to an ordinary note.
New comments are still published as NIP-22 comments.

The floating button no longer picks up styling from the site it is on. Ordinary page CSS
could stretch its icon, move its badges, or hide the unread count entirely.

Lightning payments now verify the callback address returned by the recipient's server, which
also fixes payments failing silently with some providers.

The privacy policy now states that profile pictures and images in comments load from
third-party servers, which gives those servers your IP address.

• NostrComments no longer connects to relays on pages you glance at and leave, or in tabs
you have not looked at yet. Pages you read are unaffected.
• Your private key is hidden in Settings until you ask to see it.
• Copy and save confirmations now appear where you can see them.
• The comment count on the button no longer includes deleted or muted comments.

• You are now offered, once, the option to protect your stored key with a password.
Declining is remembered — you will not be asked again — and you can still set one later
in Settings.

• Comments now use the NIP-22 standard (kind 1111) instead of ordinary notes, so they no
longer appear in your followers' feeds as stray posts.
• Note: comments made with earlier versions used the old format and are no longer shown.

• Busy threads no longer come back empty — votes were crowding comments out of the request.
• Verified names (NIP-05) available in Settings, off by default: switching it on contacts
the commenter's domain, so it is your choice.
• Works with relays that require you to identify yourself (NIP-42), and explains a refusal
in words instead of quoting the relay.
• Profile names and pictures are looked for on all your relays, not just the first two.

• A comment, vote or deletion that no relay accepts is no longer shown as if it worked —
and your text stays in the box so you can try again.
• Replies to you no longer go missing from the thread, notifications survive a dropped
connection, and they follow you when you switch identity.
• Muting a word no longer hides replies written by other people, and "tap to show" on a
downvoted comment now shows it.

Voting now actually works.

• Votes cast by other people load with the thread. Until now you only ever saw your own
vote — this also brings back every vote already sitting on relays from earlier versions.
• You can see which way you voted, and it is still there after a reload, so you no longer
vote twice by accident.
• The "Connect Nostr" button disappears once you are connected, and comes back if you
delete your key.

New

• Delete your own comments. Comments used to be permanent — the extension had no delete
control at all. Your own comments now carry a delete button that publishes a NIP-09
deletion request. Most relays honour it, some will not, and copies may remain, so the
wording promises only that. Deletion requests from others are honoured too, and one only
counts when signed by the author of the comment it targets.

• A note before you post, so you know beforehand rather than afterwards: comments go to
public relays, and deletion is a request rather than a guarantee.

• Bring an identity you already use. There was previously no way to import a key at all —
you could generate, rotate or delete, but the nsec every other Nostr app gives you had
nowhere to go. Settings now accepts an nsec1… key directly, or raw hex, with the checksum
verified so a mistyped key is refused instead of quietly becoming a different identity.

• Choose which key signs. A key stored here used to win unconditionally, which silently
disabled Alby and nos2x — switching accounts in your signer had no effect. Settings now
has an explicit choice, and the extension follows your signer when you switch there.

• See who you are. The status line showed the tail of a hex key, which tells you nothing.
It now shows your profile name, or a shortened npub. Settings gained an Active identity
card with your avatar, name and full npub, with hex behind a toggle.

Fixes

• Warnings before an identity is lost. Importing or rotating replaced the stored key behind
a single confirmation with no way to keep a copy — and an unbacked-up key was simply gone.
Import, rotate and delete now name the npub about to disappear, say plainly whether a
backup was ever confirmed, and offer to copy the key without closing the dialog.

• NostrComments is now available on Firefox for Android.
• Fixed the comment panel overflowing slightly past the screen edge on narrow
displays, which clipped its margins and rounded corners.

New
• Support the developer — a value-4-value section at the bottom of the panel that
zaps sats straight from your own Lightning wallet. Nothing is gated; every
feature stays free and open source.
• Mute words — hide any comment containing a word or phrase you choose.
• "New" badges — comments posted since your last visit to a page are marked.
• Portable identity — copy your key as nsec or npub (NIP-19) to use the same
identity in any other Nostr app.
• Backup reminder — a confirmation step so a locally generated key is less
likely to be lost.

Improved
• Relays now reconnect automatically after a dropped connection, with a capped
backoff (~6 attempts) so a failing relay no longer needs a page reload.
• Single-page sites no longer reload the thread on every navigation event.
• Accessibility: all text in the support section now meets WCAG AA contrast in
both light and dark themes.

• Firefox: fixed a bug that stopped the extension from loading in Firefox — the panel opened but "Connect" did nothing and comments never appeared. Initialization now works correctly, so the recent features (per-page threads, accessibility, optional password protection) work on Firefox too. (22.32)
• Replaced a defunct default relay (relay.current.fyi → offchain.pub) that produced a failed connection and console noise on every page load. Only affects new installs / users who haven't customized their relays. (22.32)

• Chrome: NostrComments-Chrome-v22.32.zip
• Firefox: NostrComments-Firefox-v22.32.xpi
• Userscript (Greasemonkey/Tampermonkey): NostrComments-v22.32.user.js

v22.30
• Fixes an issue that stopped the add-on from working in Firefox (the panel opened but "Connect" did nothing).
• Each page now gets its own comment thread, even on sites that use URL parameters — every YouTube video is separate instead of sharing one thread — and threads follow in-app navigation on single-page sites.
• Full keyboard and screen-reader accessibility for the button and dialog.
• Optional password protection: encrypt your generated key on your device. Reading comments never needs it — you're asked for your password only when you post. Off by default.

v22.29
• Each page now gets its own comment thread, even on sites that use URL parameters — every YouTube video is now separate instead of sharing one thread, and threads follow in-app navigation on single-page sites.
• Full keyboard and screen-reader accessibility for the button and dialog.
• Optional password protection: you can now encrypt your generated key on your device. Reading comments never needs it — you're asked for your password only when you post. Off by default.

v22.26
• Added a one-time consent step: NostrComments now asks for your permission before it connects to any Nostr relay. Nothing (page URL, comments, or your public key) is sent until you enable it.
• Updated the privacy policy to clearly describe what is stored locally and what is sent to public relays.
• Now requires Firefox 142+.

v22.25
• Signature verification: all comments, votes and profiles from relays are now cryptographically verified (NIP-01 id + BIP-340 Schnorr). Forged or tampered events are rejected, so a relay can't spoof authorship or fake vote counts.
• Firefox fix: connecting a Nostr signer extension (nos2x / Alby) now works reliably.
• Lightning addresses are validated before a zap is sent.

v22.23–22.24

• Fixed: comment count and notification badges now always show in red/amber with white text (were appearing black on some pages due to CSS override)
• Removed nostr.wine and purplepages.es from default relays — nostr.wine requires a paid account to post, purplepages.es was unreachable
• Added relay.snort.social and relay.current.fyi as replacements
• Votes and comments no longer show an error toast when a relay rejects with "restricted:" — these are relay policy decisions, not user errors

v22.23: Firefox compatibility fixes

• Fixed: extension crashed silently on pages with strict Content Security Policy (CSP) — bubble now always appears even when relay connections are blocked by the page
• Fixed: NIP-07 external wallet support (Alby, Nos2x) restored in Firefox — signing events now works correctly
• Fixed: comment count and notification badges now always show in red/amber with white text instead of appearing black on some pages

• Fixed: locally generated keys now produce valid Nostr signatures — votes and comments were previously rejected by relays due to a bug in the cryptographic signing code
• Fixed: key rotation now correctly updates your connected identity
• Fixed: pressing Enter in the relay input now saves the relay
• Improved: voting the same way twice no longer sends duplicate events to relays

Fix userscript TDZ crash (icon unresponsive when stored key exists in Chrome) + add key rotation with confirmation warning

Changes in this version:
• Fixed a Temporal Dead Zone crash that made the floating button unresponsive in Chrome when a key was already stored
• Added key rotation feature with a clear confirmation warning before replacing your existing key

v22.4 — uniform icon design

• Floating button now uses the same rounded speech bubble icon as the extension icons
• Three dots now show correctly as visible blue circles on the white bubble
• Regenerated icon48.png and icon128.png from a canonical SVG source for consistency