12<html lang="en">3<head>4<meta charset="utf-8">5<meta name="viewport" content="width=device-width, initial-scale=1">6<title>NIP-06 - Basic Key Derivation from Mnemonic Seed Phrase — Nostr Instruction Manual</title>7<meta name="description" content="NIP-06: derive a Nostr keypair from a BIP39 mnemonic using a fixed BIP32 path. Deprecated — prefer a single stored nsec. Includes test vectors.">8<link rel="preload" href="../assets/fonts/michroma-400-latin.woff2" as="font" type="font/woff2" crossorigin>9<link rel="preload" href="../assets/fonts/exo2-var-latin.woff2" as="font" type="font/woff2" crossorigin>10<link rel="preload" href="../assets/fonts/sairacondensed-600-latin.woff2" as="font" type="font/woff2" crossorigin>11<link rel="preload" href="../assets/fonts/sairacondensed-700-latin.woff2" as="font" type="font/woff2" crossorigin>12<link rel="preload" href="../assets/fonts/sairacondensed-500-latin.woff2" as="font" type="font/woff2" crossorigin>13<link rel="preload" href="../assets/fonts/sharetechmono-400-latin.woff2" as="font" type="font/woff2" crossorigin>14<link rel="preload" href="../assets/fonts/exo2-400i-latin.woff2" as="font" type="font/woff2" crossorigin>15<link rel="icon" href="../assets/favicon.svg" type="image/svg+xml">16<link rel="stylesheet" href="../assets/manual.css">17</head>18<body>1920<svg width="0" height="0" style="position:absolute">21 <defs>22 <marker id="arr" markerWidth="9" markerHeight="9" refX="7" refY="4.5" orient="auto">23 <path d="M1,1 L8,4.5 L1,8 Z" fill="#f26a00"/>24 </marker>25 <marker id="arrb" markerWidth="9" markerHeight="9" refX="7" refY="4.5" orient="auto">26 <path d="M1,1 L8,4.5 L1,8 Z" fill="#2e5f9e"/>27 </marker>28 </defs>29</svg>3031<div class="page">32 <span class="staple s1"></span><span class="staple s2"></span>3334 <header class="band">35 <a class="logo" href="../index.html">NOSTR<b>▸</b>PROTOCOL MANUAL</a>36 <span class="booklet-note">Chapter 06 - Key Management</span>37 </header>38 <nav class="tabs">39 <a href="../index.html">Contents</a>40 <a href="#overview" class="on">Overview</a>41 <a href="#spec">Spec</a>42 <a href="#examples">Examples</a>43 <a href="#history">History</a>44 </nav>4546 <div class="chapter">47 <div class="nipno" data-n="06">06</div>48 <div class="titles">49 <div class="kicker">Nostr Implementation Possibility - Hex № 06</div>50 <h1>Basic Key Derivation from Mnemonic Seed Phrase</h1>51 <p class="sub">Turn a BIP39 word list into a Nostr keypair with one fixed BIP32 path. Kept in this manual for compatibility, not for new designs.</p>52 </div>53 <div class="stamp">Deprecated</div>54 </div>5556 <main class="spread">57 <div class="main">5859 <h2 class="bar" id="overview"><span class="num">1</span> Overview</h2>6061 <div class="box danger">62 <span class="tag">Deprecated</span>63 <p>This NIP is <code>unrecommended</code>. The source spec states the reason in one line: prefer a single <code>nsec</code>. Deriving a key from a mnemonic adds a second secret format to protect and does not remove the need to guard the private key itself. New clients should generate and store one private key directly, encode it with <a href="19.html">NIP-19</a>, and encrypt it at rest with <a href="49.html">NIP-49</a> instead of relying on this derivation scheme.</p>64 </div>6566 <p>A Nostr identity is one keypair on the curve <code>secp256k1</code>. <a href="01.html">NIP-01</a> does not say how a client creates that keypair. A client can generate random bytes directly, but a raw private key is hard for a person to write down, read aloud, or check for copy errors.</p>67 <p>This NIP defines an optional way to derive a Nostr keypair from a human-readable backup phrase. It reuses two existing Bitcoin standards instead of inventing a new one. <a href="https://bips.xyz/39">BIP39</a> turns a list of ordinary words into a binary seed. <a href="https://bips.xyz/32">BIP32</a> turns that seed into one or more keypairs, following a fixed path.</p>68 <p>Because the path is fixed, every client that follows this NIP derives the exact same keypair from the exact same mnemonic. This makes one mnemonic portable between different Nostr apps and wallets.</p>6970 <h2 class="bar" id="spec"><span class="num">2</span> Mnemonic to Seed (BIP39)</h2>71 <p>A BIP39 mnemonic is a sequence of words drawn from a fixed 2048-word list. The words encode random entropy plus a checksum, so a client can detect a mistyped or mistranscribed word. A mnemonic is normally 12 or 24 words long.</p>72 <p>BIP39 defines a function that turns the mnemonic string into a 512-bit binary seed. This NIP does not restate that function; it only reuses its output as the input to BIP32 derivation.</p>7374 <div class="box tech">75 <span class="tag">Tech Note</span>76 <p>The source spec does not say whether the BIP39 seed function should use its optional passphrase (sometimes called a "25th word") or leave it empty. It also does not say whether the mnemonic must be normalized before hashing. Most known implementations use an empty passphrase and standard NFKD normalization, but this NIP does not state either rule explicitly.</p>77 </div>7879 <h2 class="bar" id="path"><span class="num">3</span> Derivation Path (BIP32)</h2>80 <p>BIP32 turns one seed into a tree of keypairs. A path selects one keypair from that tree. This NIP fixes the path to:</p>81 <div class="crt">82 <div class="titlebar">Fixed derivation path</div>83<pre>m/44'/1237'/<span class="c"><account></span>'/0/0</pre>84 </div>85 <p>The number <code>1237</code> is Nostr's registered coin type on <a href="https://github.com/satoshilabs/slips/blob/master/slip-0044.md">SLIP44</a>, the shared registry that BIP32-based wallets use to avoid path collisions between different coins and networks.</p>8687 <div class="tscroll"><table class="ref">88 <caption>Path segments</caption>89 <tr><th>Segment</th><th>Value</th><th>Meaning</th></tr>90 <tr><td class="btn">purpose'</td><td>44'</td><td>Fixed. Marks this as a BIP44-style path.</td></tr>91 <tr><td class="btn">coin_type'</td><td>1237'</td><td>Fixed. Nostr's SLIP44 coin type.</td></tr>92 <tr><td class="btn">account'</td><td><account>'</td><td>Starts at 0. Increment it to derive another, independent keypair from the same mnemonic.</td></tr>93 <tr><td class="btn">change</td><td>0</td><td>Fixed at 0. Not hardened.</td></tr>94 <tr><td class="btn">address_index</td><td>0</td><td>Fixed at 0. Not hardened.</td></tr>95 </table></div>9697 <p>The trailing <code>'</code> marks <strong>hardened derivation</strong>. A hardened child key needs the parent's private key to compute; it cannot be derived from the parent's public key alone. The <code>purpose</code>, <code>coin_type</code>, and <code>account</code> segments are hardened. The <code>change</code> and <code>address_index</code> segments are not, but this NIP fixes both at 0.</p>98 <p>A basic client can use <code>account</code> 0 and derive a single key. A client that needs more than one identity can increment <code>account</code> to derive practically unlimited further keys, all from the same mnemonic. Other kinds of clients may still use other, non-standard derivation paths for their own purposes; this NIP only fixes the default.</p>99100 <figure class="diagram">101 <div class="frame">102 <svg viewBox="0 0 640 150" role="img" aria-label="Pipeline: mnemonic words go through BIP39 to a seed, then through a BIP32 derivation path, producing a keypair">103 <rect class="d-actor" x="10" y="40" width="120" height="50" rx="8"/>104 <text class="d-actor-label" x="70" y="62" text-anchor="middle">Mnemonic</text>105 <text class="d-note" x="70" y="79" text-anchor="middle">12 or 24 words</text>106 <rect class="d-actor" x="175" y="40" width="110" height="50" rx="8"/>107 <text class="d-actor-label" x="230" y="62" text-anchor="middle">Seed</text>108 <text class="d-note" x="230" y="79" text-anchor="middle">BIP39 function</text>109 <rect class="d-actor" x="330" y="40" width="160" height="50" rx="8"/>110 <text class="d-actor-label" x="410" y="62" text-anchor="middle">Derivation Path</text>111 <text class="d-note" x="410" y="79" text-anchor="middle">m/44'/1237'/acct'/0/0</text>112 <rect class="d-actor" x="535" y="40" width="95" height="50" rx="8"/>113 <text class="d-actor-label" x="582" y="62" text-anchor="middle">Keypair</text>114 <text class="d-note" x="582" y="79" text-anchor="middle">secp256k1</text>115 <path class="d-msg d-flow" d="M130,65 L173,65"/>116 <path class="d-msg d-flow" d="M285,65 L328,65"/>117 <path class="d-msg d-flow" d="M490,65 L533,65"/>118 <circle r="4" fill="#f26a00">119 <animateMotion dur="2.6s" repeatCount="indefinite" path="M130,65 L173,65"/>120 </circle>121 <circle r="4" fill="#f26a00">122 <animateMotion dur="2.6s" begin="0.87s" repeatCount="indefinite" path="M285,65 L328,65"/>123 </circle>124 <circle r="4" fill="#f26a00">125 <animateMotion dur="2.6s" begin="1.74s" repeatCount="indefinite" path="M490,65 L533,65"/>126 </circle>127 </svg>128 </div>129 <figcaption>Fig. 6-1 — <b>Derivation pipeline.</b> The mnemonic becomes a seed, the seed feeds a fixed BIP32 path, and the path output is the Nostr keypair.</figcaption>130 </figure>131132 <h2 class="bar" id="examples"><span class="num">4</span> Worked Example - Test Vectors</h2>133 <p>The source spec gives two full test vectors. An implementation can run its own mnemonic-to-keypair code against these values to confirm it matches other implementations bit for bit.</p>134135 <div class="box tech">136 <span class="tag">Tech Note</span>137 <p>Neither test vector states which <code>account</code> index or BIP39 passphrase produced it. By convention, read both vectors as <code>account</code> 0 with an empty passphrase — the same ambiguity flagged in §2.</p>138 </div>139140 <div class="crt">141 <div class="titlebar">Test vector 1 - 12-word mnemonic</div>142<pre><span class="k">mnemonic</span>: <span class="s">leader monkey parrot ring guide accident before fence cannon height naive bean</span>143<span class="k">private key (hex)</span>: <span class="s">7f7ff03d123792d6ac594bfa67bf6d0c0ab55b6b1fdb6249303fe861f1ccba9a</span>144<span class="k">nsec</span>: <span class="s">nsec10allq0gjx7fddtzef0ax00mdps9t2kmtrldkyjfs8l5xruwvh2dq0lhhkp</span>145<span class="k">public key (hex)</span>: <span class="s">17162c921dc4d2518f9a101db33695df1afb56ab82f5ff3e5da6eec3ca5cd917</span>146<span class="k">npub</span>: <span class="s">npub1zutzeysacnf9rru6zqwmxd54mud0k44tst6l70ja5mhv8jjumytsd2x7nu</span></pre>147 </div>148149 <div class="crt">150 <div class="titlebar">Test vector 2 - 24-word mnemonic</div>151<pre><span class="k">mnemonic</span>: <span class="s">what bleak badge arrange retreat wolf trade produce cricket blur garlic valid proud rude strong choose busy staff weather area salt hollow arm fade</span>152<span class="k">private key (hex)</span>: <span class="s">c15d739894c81a2fcfd3a2df85a0d2c0dbc47a280d092799f144d73d7ae78add</span>153<span class="k">nsec</span>: <span class="s">nsec1c9wh8xy5eqdzln7n5t0ctgxjcrdug73gp5yj0x03gntn67h83twssdfhel</span>154<span class="k">public key (hex)</span>: <span class="s">d41b22899549e1f3d335a31002cfd382174006e166d3e658e3a5eecdb6463573</span>155<span class="k">npub</span>: <span class="s">npub16sdj9zv4f8sl85e45vgq9n7nsgt5qphpvmf7vk8r5hhvmdjxx4es8rq74h</span></pre>156 </div>157158 <div class="box hint">159 <span class="tag">Hint!</span>160 <p>Both vectors use the same fixed path shape, only the mnemonic changes. Feed each mnemonic through BIP39 to get a seed, then derive <code>m/44'/1237'/0'/0/0</code> from that seed. The resulting private key must match the listed hex value and <code>nsec</code>.</p>161 </div>162163 <h2 class="bar" id="history"><span class="num">5</span> Version History</h2>164 <p>Notable changes to NIP-06, newest first:</p>165 <ul class="patchnotes">166 <li><span class="ver">2026</span><span class="when">2026-05</span>Marked <code>unrecommended</code>. A warning was added recommending a single stored <code>nsec</code> instead of mnemonic derivation.</li>167 <li class="minor"><span class="ver">2023</span><span class="when">2023-11</span>Removed the per-NIP author byline from the document body.</li>168 <li><span class="ver">2023</span><span class="when">2023-10</span>Added the two worked test vectors (mnemonic, private key, <code>nsec</code>, public key, <code>npub</code>).</li>169 <li><span class="ver">2023</span><span class="when">2023-04</span>Renamed the fifth path segment from <code>address_index</code> to <code>account</code>, matching common BIP44 usage; the segment stayed fixed at 0.</li>170 <li><span class="ver">Origin</span><span class="when">2022-05</span>fiatjaf migrated the spec into the dedicated <code>nostr-protocol/nips</code> repository.</li>171 </ul>172173 <div class="credits">174 <h3 class="cardhead">Original Proposal - Credits</h3>175 <table>176 <tr><td>Author</td><td>fiatjaf</td></tr>177 <tr><td>First commit</td><td>2022-05-01 — "migrate nips from main nostr repo."</td></tr>178 <tr><td>Status</td><td>draft - unrecommended — kept for compatibility, not recommended for new designs</td></tr>179 <tr><td>Source</td><td><a href="https://github.com/nostr-protocol/nips/blob/master/06.md">06.md on GitHub</a> - <a href="https://github.com/nostr-protocol/nips/commits/master/06.md">full change history</a></td></tr>180 </table>181 </div>182183 <h2 class="bar"><span class="num">6</span> See Also</h2>184 <ul>185 <li><a href="01.html">NIP-01</a> — the <code>secp256k1</code> keypair and event model this NIP produces a key for.</li>186 <li><a href="19.html">NIP-19</a> — the <code>nsec</code> and <code>npub</code> bech32 encodings used throughout the test vectors above.</li>187 <li><a href="49.html">NIP-49</a> — <code>ncryptsec</code> password-based private key encryption, a recommended alternative to a mnemonic-derived key.</li>188 <li><a href="07.html">NIP-07</a> — a browser extension signer, which keeps the private key out of the web app entirely.</li>189 <li><a href="05.html">NIP-05</a> — a human-readable identifier for a pubkey; unrelated to key derivation but often confused with it by name.</li>190 </ul>191 </div>192193 <aside>194 <div class="cartridge">195 <div class="inner">196 <h3 class="cardhead">Spec Card</h3>197 <div class="lights"><span class="led err"></span><span class="led err"></span><span class="led err"></span></div>198 <dl>199 <dt>Status</dt><dd><span class="chip draft">draft</span><span class="chip unrecommended">unrecommended</span></dd>200 <dt>Defines</dt><dd>derivation path only - no event kind, tag, or message</dd>201 <dt>Kind(s)</dt><dd>none</dd>202 <dt>Requires</dt><dd><a href="01.html">NIP-01</a> keypair model - external: BIP39, BIP32, SLIP44</dd>203 <dt>Transport</dt><dd>n/a - local key derivation, no relay messages</dd>204 <dt>Crypto</dt><dd>BIP39 seed - BIP32 HD path - secp256k1</dd>205 <dt>First commit</dt><dd>2022-05-01</dd>206 <dt>Last updated</dt><dd>2026-05-31</dd>207 </dl>208 </div>209 </div>210 </aside>211 </main>212213 <nav class="navbtns">214 <a href="05.html">◀ NIP-05: Mapping Nostr Keys to DNS-Based Internet Identifiers</a>215 <a href="07.html">NIP-07: window.nostr Capability for Web Browsers ▶</a>216 </nav>217218 <footer class="pagefoot">219 <a href="../index.html">Nostr Protocol Manual</a>220 <span class="pageno">NIP 06 / F4</span>221 </footer>222</div>223224<script src="../assets/webmcp.js" defer></script>225</body>226</html>