The decentralized social protocol Nostr has always prided itself on cryptographic sovereignty—your keys, your data, your rules. But a quiet revolution is happening beneath the surface, one that addresses a threat most users haven’t even considered: quantum computing. On August 10, the @nostr-wot/pq package was published to npm, introducing post-quantum identity keys for Nostr. The package derives ML-KEM-1024 and ML-DSA-87 keys from a NIP-06 seed—the same seed that generates your Nostr private key—and builds attestations that advertise these quantum-resistant keys to the network.

The Two Threats: Retroactive Decryption and Event Forgery

The package’s documentation lays out two distinct harms with very different deadlines:

First, encrypted messages become readable retroactively. NIP-44 derives its conversation key from an ECDH secret between two secp256k1 keys. Anyone archiving encrypted events today—and you can bet intelligence agencies are—could decrypt them all once secp256k1 falls. This threat can be fixed in advance, which is exactly what @nostr-wot/pq addresses.

Second, events can be forged. This is worse in impact, but it cannot be pre-empted—only fixed by migrating signatures before the break. In other words, we have a window to act, but it’s closing.

The package’s design is clever. Rather than deriving post-quantum keys from the Nostr private key—which would be circular, since an adversary who recovers your nsec could simply derive the post-quantum key too—both keys are derived independently from the same BIP-39 seed using HKDF. One mnemonic still restores everything, but recovering the secp256k1 private key reveals nothing about the post-quantum keys.

The Ecosystem Responds

This isn’t the only development moving the protocol forward. On August 6, Fiatjaf’s relayer framework—the gold standard for building custom Nostr relays—received a merge pull request from contributor mattn. The framework continues to evolve as the reference implementation for relay infrastructure.

Meanwhile, the Mesh-LLM project upgraded to nostr-sdk 0.45.1 on August 10, adapting to breaking API changes that include explicit signing at the event level and removal of the send_event_builder() method. The upgrade improved event publishing, deletion, discovery, filtering, and retrieval behavior, keeping the project on a supported SDK line.

OpenSats, the nonprofit behind The Nostr Fund, continues to provide the economic engine for this development. Between February and May 2026, the organization announced three waves of Nostr grants, funding 13 projects across applications and infrastructure. The seventeenth wave of grants was announced in May, and the fund remains active.

What This Means for You

I think this is a pivotal moment for Nostr. The protocol has always been about user sovereignty, but sovereignty means nothing if your data isn’t secure against future threats. The @nostr-wot/pq package is forward-looking—it’s preparing for a threat that doesn’t exist yet but almost certainly will.

The challenge, as I see it, is adoption. Most Nostr users don’t read GitHub releases or npm packages. They use clients like Primall or Damus and they trust that their messages are private. But without client-side support for these post-quantum attestations, the package is just a specification waiting for implementation.

The good news is that the infrastructure is being built. The bad news is that quantum computers are advancing faster than most people realize. The timeline for a cryptographically relevant quantum computer is uncertain—some say five years, some say twenty—but the archives are being collected today, few understand this…

Summary

Nostr’s ecosystem is quietly preparing for a post-quantum future. On August 10, the @nostr-wot/pq package introduced quantum-resistant identity keys, deriving ML-KEM-1024 and ML-DSA-87 keys from the same BIP-39 seed that generates your Nostr keys. The design addresses retroactive decryption of encrypted messages—a threat that can be fixed in advance—while acknowledging that event forgery will require a migration of signatures before quantum computers break secp256k1. Meanwhile, Fiatjaf’s relayer framework continues to evolve, and OpenSats keeps funding development through The Nostr Fund. The protocol’s long-term viability now depends on whether clients adopt these quantum-resistant measures before it’s too late.