# Identity and login

There is no account, no email and no password. There is a key, and everything else follows from how well you look after it.

## Keys, not accounts

Your identity is a Nostr keypair. The public half (an `npub`) is what the service knows you by; the private half (an `nsec`) stays on your device and signs on your behalf.

Your nym — the display name you picked — is decoration. The four characters after it are derived from your public key, and they are the part that actually distinguishes one `alice` from another.

> **Back it up**
>
> Nobody can reissue your key. Lose it and you lose your history and any credits on it. Copy the `nsec` somewhere offline the first day you use the app.

## Ways to sign in

- **Generate one.** The default on a fresh install.
- **Paste an `nsec`.** Brings an existing identity — from [Nymchat](https://nymchat.app) or any other Nostr app — with its credits and its Nymbot history.
- **A browser extension** (NIP-07). The key stays in the extension and never reaches the page; the app asks it to sign.
- **A remote signer** (NIP-46), if you keep your key on another device.

Signing in with the same key on a second device gives you the same account. Nothing has to be migrated, because nothing lives anywhere but the key.

## Identity encryption

Optional protection for the stored key, so it cannot be read out of local storage without unlocking. You pick the factor per device: a passphrase, a biometric, or a hardware security key.

No password, salt or credential is ever synced. Only an on/off preference travels, so you can choose to set encryption up on a new device rather than have it assumed.

It also covers the [anonymous mode](https://nymbot.ai/docs/anonymous/) throwaway key and its vouchers. Your [git access token](https://nymbot.ai/docs/git/#token-safety) is device-local too, for the same reason.

## Panic wipe

Press and hold the panic control and everything local is destroyed immediately: your key, every conversation, the git token, the throwaway key and any credits left on it.

It is not a logout and there is no confirmation dialog to talk yourself out of. If you have backed up your `nsec` you can come back to the same account later; if you have not, that identity is gone.