Sidecar | A Classy Nostr Signer av The Daniel

Sidecar lives in your browser's side panel and hands every Nostr web app a secure window.nostr to sign in with, so you never paste your nsec into a website again. Your keys stay on your device, encrypted behind a PIN. It's a companion to your favorite Nostr client, not a replacement: sign, post, and zap in a tap, then jump right back to the app you love.

🔑 Your keys, your control

Full NIP-07 signer: getPublicKey, signEvent, NIP-04 and NIP-44 encrypt/decrypt, and your relay list.
Private keys are encrypted at rest (PBKDF2 to AES-GCM via WebCrypto), never stored in plaintext, never transmitted off your device.
PIN-protected with automatic re-lock, and a warning before signing anything that would wipe your follows, mutes, or profile.
Multiple accounts. Store as many keys as you like, switch the active one in a click, drag to reorder. Each site stays pinned to the account it logged in with, so there's no identity mix-up.
Per-site permissions with a prompt that previews exactly what you're signing. Relay sign-in (NIP-42) is answered for your own relays, for reading as well as posting, so relays that gate reads stop coming back empty.
Recent activity records what each signature actually was, and any row that signed an event opens it in your client, so the log can be checked rather than taken on trust.

📄 Backups that survive the browser

A printable backup sheet for a new key, styled as an old-fashioned telegram: the nsec as text you can copy and as a QR you can scan back in, plus a serial to tell sheets apart. A locked second page carries the key as a password-encrypted secret that passes for a masquerade invitation. Import by photo, PDF, clipboard image, or live camera scan. All generated locally, nothing uploaded.
One encrypted vault export covers accounts, wallets, and settings, and restore shows exactly what it will replace.

👤 Your profile, your way

View and edit your profile, with the bio editor opening as tall as your bio.
Edit and publish your outbox relays (NIP-65) right from your profile.
An account overview drawer: following count, relays, NIP-05, Lightning address, wallet status.
Follow-list recovery. If another app wipes or shrinks your follows, scan your relays and restore a healthy earlier version.
Check your relays: each one carries its own icon, and you can ask whether it is answering, gated behind payment or login, or holding none of your notes, which is the thing worth knowing before you drop it.
Your npub as a QR code, with your profile picture in the middle, so handing someone your key does not mean reading out sixty-three characters.

✍ Post without leaving the page

A composer for notes with @mention autocomplete across your follows and all of Nostr, embedded note previews, link cards, and image/video upload to your own Blossom servers.
Drafts autosave per account and are encrypted at rest. A short review countdown lets you read the note exactly as it will publish.
Post a poll instead of a note, and read the full tally in the panel when the votes come in.
Comment on any web page (NIP-22), and keep the bookmark lists your other clients write (NIP-51).

🔔 Notifications at a glance

A bell shows replies, mentions, reposts, reactions, and zaps for your active account, each opening in your preferred web client.
Reply to a note or a comment without leaving Sidecar. What you are answering stays on screen while you write, through the preview and the review countdown both.
Your circle comes first: replies from outside your follows, and their follows, are gathered into a counted group at the bottom rather than mixed in. Nothing is hidden and nothing is deleted.
Mute lists written by any client are respected, including muted words, hashtags, threads, and senders.

⚡ Lightning wallet (Nostr Wallet Connect)

Connect your own self-custody Lightning wallet over Nostr Wallet Connect. If you don't have one yet, built-in suggestions help you pick.
Send (BOLT11 or Lightning address, resolved up front so you see the real recipient), receive with a QR, view history, and back up or export your connection.
Pay a Lightning invoice from any page, including one the site copies to the clipboard, plus a WebLN provider with per-site spending budgets you can edit or revoke at any time.
Automatic zaps, capped and only on sites you've actually signed into.
Podcasting 2.0 boosts, paid from your own wallet, with the show and the message named on the approval.
Balance in sats, BTC, or fiat, with a 24-hour price chart.

Sidecar never holds your funds. You stay in control of your own wallet.

🎭 Twelve themes

A gallery you can filter by dark or light, showing a live preview of each one before you choose it. Six are drawn for low light and six for daylight, each with its own display typeface, textures, and balance animation. A single switch turns the animations off.

🛡 Private by design

Open source. No analytics, no tracking, no remote code. Everything runs locally in your browser, and link previews are fetched with a guard against private-network requests.
Tucked into the panel is a small game about relay hops. It runs locally, reaches no network, and keeps nothing but a high score.
Built for Firefox 128+ and also available for Chrome, Brave, Edge, and other Chromium browsers. Pin Sidecar, open the sidebar, and you're ready. 🍸

🗞 What's new

1.13.0
• Polls. Ask a question from the composer, set the choices, whether more than one can be picked, and how long it runs. Votes arrive in the bell and open a full tally in the panel: every option with its count and share, who picked which, and the winner once it closes.
• Proof of work on your posts, off unless you turn it on and set per account, at 16, 18, 20 or 22 bits. It runs in the background so nothing freezes, and you can stop it.
• Replies other clients send as comments now reach you. Many clients answer a note with a comment rather than a note, and everything below the first level of those threads was invisible.
• Podcasting 2.0 boosts work. A boost is a keysend rather than an invoice, and the call carrying it was rejected before it ever left the page. The approval names the show and the message instead of a node key.
• Set a status: a short line about what you are doing, shown beside your name by clients that read it.
• A payment already going out moves to a small indicator in the corner instead of holding the page, and only says it is sending once you have approved it.

1.10.0
• Two new themes: Nixie's red-hot digits strike and settle behind a wire screen, and Populuxe, a chrome-and-tile diner of a light theme and the first where every color passes the same contrast bar.
• Balance animations: every theme's figure now arrives in its own character, with a switch in Settings to turn them off.
• Bookmarks: the bookmark lists your other Nostr clients keep, read from your relays, each entry opening at your usual client.
• Mute lists work in notifications: muted words, hashtags, and threads from a list written by any client.
• A PIN change no longer breaks wallet connections: the connection is re-encrypted along with everything else.
• Automatic zaps only pay on sites you're actually signed into.
• An invoice a page copies to its own clipboard now gets the pay card.
• Send resolves a Lightning address before asking for an amount, so you see the real recipient first.
• The bio editor opens as tall as your bio and grows as you type.

1.9.1
• A printable backup sheet for a new key: a one-page PDF styled as an old-fashioned telegram, with your nsec as text and as a QR, generated entirely on your machine.
• Import a key by scanning that sheet, from a photo, the PDF itself, the clipboard, or live with your camera.
• The sheet can carry a locked second page: your key as a password-encrypted secret, printed to pass for a masquerade invitation.
• Account overview: a drawer showing what's actually set up for each identity: follows, alerts, relays, NIP-05, Lightning address, wallet.
• "Your relays, if you want them": publish your own relay list and Sidecar offers to use only yours, per account.
• Wallet reads and global name search ask first: a page you've never approved can't silently check your balance, and the global name index is opt-in.
• "Forget all sites": one button erases every record tying sites to your identities; sites simply ask again.
• Unsent drafts and payment notes are encrypted at rest.
• Approvals say what they cover: trusting a site with decryption comes with the plain statement of what that means for your DMs.
• A way out of a stuck payment, and the wallet now reconnects after a dropped connection instead of failing until a reload.