Private AI chat. No account, no email, no subscription.
An assistant that answers to you and to nobody else
Every question and every answer travels as a gift-wrapped Nostr event, sealed to keys only the two ends hold. Relays carry ciphertext and a single-use sender key — nothing they can correlate.
ML-KEM key encapsulation is combined with the classical exchange rather than replacing it, so an attacker has to break both. Traffic captured today does not become readable later. How the hybrid works.
Move the whole conversation onto a throwaway key and your credits across as blind vouchers Nymbot signs without seeing. It bills a message it cannot attribute to you. The full mechanism.
No subscription, no card, no invoice with your name on it. Buy credits over Lightning and spend them a reply at a time — 10 sats for a standard reply, 100 for a frontier model. Pricing in full.
Claude, GPT, Gemini, Grok, Kimi, Qwen and MiniMax, pinned per conversation — or let Nymbot route each message to whichever model suits the task. Models and routing.
Connect GitHub, GitLab or Gitea and Pro replies read your actual files, search the tree and answer from what is there. Turn writes on and it commits, branches and opens pull requests, and it can run your tests on a server, asking you first each time. Repository mode.
Make a picture with ?image or a short clip with ?video, from more than twenty frontier generators — or attach a photo and describe what to change. Send it a photograph and it will tell you what is in it. Making things.
Keep as many separate chats as you like. Each is its own thread with its own context, named after the first thing you asked — and the title is written on your device, never by the model. How chats work.
No email, no phone number, no password. A key generated on your device is your identity, your history and your balance. Bring one you already have from any Nostr app. Identity and login.
Five steps, and none of them involve an account
Nymbot is built on Nostr. Messages are events, identities are keypairs, and everything is sealed on your device before it leaves it — which is why an identity from any other Nostr app works here unchanged.
Kinds 14, 13 and 1059: an unsigned rumor, a seal you sign and encrypt to the recipient, and a wrap under a single-use key.
A relay sees an event from a key that exists for one message only, with a randomized timestamp — it can tell the message is for Nymbot, not who sent it.
Kind 27235: a short-lived auth event, signed for one action and one endpoint.
A captured signature cannot be replayed against a different request. Your message never travels as plaintext.
Nothing is fetched, generated or billed until the turn is claimed.
Resend the same message and you collect the answer you already bought, rather than paying for a second one.
The wrap is opened, the seal's signer is checked against the authenticated key, and the thread is rebuilt from the previous wraps.
Classification, routing, web search and repository tool calls all happen here.
Kind 30078: the post-quantum announcement carrying each side's ML-KEM key.
Both directions are sealed hybrid — classical and lattice — whenever your key has announced one, so capturing them today buys nothing later.
No user table. No password to leak. No transcript anyone can be compelled to hand over.
The whole protocol, written down.
Anything beginning with ? is a command
Games, unit conversion, math, the Bitcoin price and more — the full reference.
Everything you need to know about Nymbot
A private AI assistant. You talk to it the way you would talk to anyone in a messenger, and it answers using whichever frontier model suits the question.
What is different is underneath: there is no account to make, the messages are end-to-end encrypted, and replies are paid for in Bitcoin a reply at a time rather than by subscription. It can also be told to stop knowing who you are.
Being precise about this is worth more than being reassuring about it. Your messages are end-to-end encrypted, which means nobody in between — relays, networks, anyone holding the traffic — can read them. The Nymbot service does open them, because it has to in order to answer.
So the honest claim is: nobody else can read your conversation, and with anonymous mode on, the service that answers it cannot tell whose conversation it is. Your conversation titles are written on your device, never by the model, and only ever leave it encrypted to your own key. The full table of what the server sees is in the knowledge base.
The chat is encrypted, but normally the service still knows which public key is talking to it — that key is what the credit balance and the conversation thread hang off. Encryption was never the gap. Attribution was.
Anonymous mode generates a throwaway keypair on your device and moves the entire conversation onto it. Your credits move across as blind vouchers: your app blinds a random secret, the service debits your balance and signs something it cannot read, and the throwaway key later presents the unblinded token with nothing to match it against. The tables record that a voucher was issued and that one was spent, and nothing connects the two.
It does not hide everything, and we say exactly what it does not hide.
Credits, bought over the Lightning Network. Standard credits are 10 sats each and buy an auto-routed reply; Pro credits are 100 sats each and buy a reply from a specific frontier model you have pinned.
Every reply is metered on the tokens it actually reads and writes, at that model's rates, and charged in thousandths of a credit — so a short answer costs a fraction of one. The most a reply could cost is reserved when you send and only the real cost is taken. Nothing is charged for a failed generation, and resending a message replays the answer you already bought rather than buying another. Pricing in detail.
No. Open it and a keypair is generated on your device. That key is the account: it signs your messages, your balance is filed under its public half, and your history is encrypted to it.
Which is why the one thing worth doing on day one is backing it up — save your nsec, or keep an encrypted copy with a passkey, Google Drive or iCloud Keychain. Nobody can reissue it — not even us. You can also bring a key you already use in any other Nostr app.
Yes, and it is the same account. Nymchat is a full messenger with Nymbot built into it; this is Nymbot on its own. Sign in to either with the same key and you get the same credits and the same Nymbot conversation.
Buy credits in one, spend them in the other. Nothing needs migrating, because there is nothing per-service to migrate. How the two relate.
Claude Fable 5, Claude Opus 5, Claude Sonnet 5, Claude Haiku 4.5, GPT-5.6 Sol, GPT-5.4 mini, Gemini 3.1 Pro, Gemini 3.6 Flash, Grok 4.6, Kimi K3, Qwen 3.5, MiniMax M3, DeepSeek V4 and more from the live catalog — pinned per conversation with ?model.
Or pin nothing: on the standard tier each message is classified and routed to a model suited to it, so a quick factual answer does not pay for a reasoning model. The picker is generated from a live catalog, so what you see is exactly what the service will charge for. Models and routing.
Yes. ?git connects GitHub, GitLab or Gitea/Forgejo with a scoped access token, a repository and a branch. After that, Pro replies run as a small agent: listing directories, reading files and searching the tree, then answering from what is actually there.
With ?git writes on it can also commit, create branches and open pull or merge requests. The token syncs between your devices inside your end-to-end encrypted settings, is passed with each request, is never stored readable server-side and is removed when you wipe the device. Repository mode.
Into an artifact. When a reply contains a whole file — a page, a script, a document — it opens beside the conversation instead of scrolling away inside it. HTML, SVG and Markdown preview as themselves, in a sandboxed frame that cannot reach the app around it.
Artifacts are editable, and every save is kept as a version you can put back — the last 30 of them. A later reply that rewrites the same file updates it rather than leaving you two copies. Artifacts.
Yes. Compare sends one prompt to two models at once, each on a thread of its own, so neither sees the other's answer. Keep the one you prefer and the conversation carries on from it; the other is discarded and never becomes context.
Two answers means two replies, so it is charged twice — and the confirmation says what it will cost before either model is asked. How comparing works.
A bot is a name, standing instructions, a model and a few openers. Share one as a link or a QR code, or publish it under your own npub as a replaceable Nostr event and share the address.
What travels is only how the bot answers. It never carries your repositories, your access tokens, your files or anything either of you has said — and the link puts it in a URL fragment, which browsers do not send to a server. Sharing a bot.
A ghost chat is never written down. Its messages and anything it produced are held in memory and nowhere else, and no archived copy is published — so there is nothing to restore on another device, and nothing left when you close the app.
The message itself still reaches Nymbot, encrypted as always; what a ghost chat refuses is the copy that exists to bring a conversation back later. Auto-delete clears ordinary chats off your devices on a timer. Ghost chats and auto-delete.
A repository task is a loop — list, read, search, write — and that loop has an allowance, because an unbounded agent is an unbounded bill. When a task uses its allowance with work still to do, Nymbot stops, hands you what it has, and says so. Nothing further is charged.
Or set a continuation budget and it buys another allowance from the same balance, picking up exactly where it stopped instead of re-reading the repository. One leg at a time, each leg saying what it cost, stopping when the budget is spent or you press Stop. How that works.
Yes. Under the spinner Nymbot reports what it routed to, what it searched for, which files it is reading in a connected repository, which model call it is on, and the model's own reasoning as each call returns.
That report is scoped to the key that asked and to that one message — in anonymous mode the throwaway key, so watching reveals nothing the message had not already. Watching a reply.
If you never backed it up, you lose the account. Your history is encrypted to that key and your balance is filed under it, and there is no user table to recover you from — the same property that means nobody can hand your conversations to anyone else either.
Back it up on day one — your nsec, a passkey, Google Drive or iCloud Keychain — and turn on identity encryption so the copy on your device is unreadable without unlocking.
If you let it. Standing facts — what to call you, what you work on, how you want answers written — are kept as separate entries you can read line by line, correct and delete. Not a rolling summary, because a summary cannot be argued with.
They are stored on your device and in your end-to-end encrypted sync, and only your name, how you want answers written and the handful that bear on a question travel with a message. Anything noticed as you chat says so at the time with one tap to take it back, and a ghost chat neither reads memory nor adds to it. See what carries between chats.
No. A reply is given the most recent stretch of the conversation, and what that costs does not grow with how long you have been talking. Sending the whole history every time would raise the price of every reply for ever — which is the pricing that makes people start a new chat to save money and throw away the context they were paying for.
Turns that fall outside the window are still listed for the model, and a Pro reply can read any of them back in full when the answer depends on one. That look-up is one more model call, charged on the tokens it uses — on the replies that actually need it, and not on the ones that do not. See reading back what fell out.
Every reply that wrote to your repository says what it touched, and offers to put it back. Undo reads each of those files at the commit your branch stood on before the run and commits them as they were — a revert, not a rewrite, so nothing is erased and anyone who pulled in between keeps a checkout that works.
It costs no credits, because it touches no model. A branch or pull request the run opened is listed and left alone: closing somebody's pull request for them is not an undo. See undoing what a run changed.
No. Paste an access token and Nymbot asks the forge what that token can reach, then shows the answer as a list you tick — each one connected with its default branch already filled in. GitHub, GitLab and Gitea/Forgejo — Codeberg included — all answer.
That request goes from your device straight to the forge, not through our worker, so the token does not travel anywhere it does not already go. See connecting a repository.
Yes — the web app, the mobile apps and this site are all in the public repository. Read what the client does with your key rather than taking our word for it.
The hosted model routing is the part you cannot run yourself, which is why the client is written so that everything it can verify locally, it does: signatures, the voucher proofs, and the keys it seals to.
No registration. No subscription. No name on the bill.
A key on your device, and an assistant that answers to it.