Typing now works on sites that have their own keyboard shortcuts.

The comment panel draws itself inside the page you are reading, so every key you pressed in the
box also travelled through whatever that page was listening for. On a site that reads the space
bar and cancels it — most Nostr clients do, and so do GitHub, YouTube and Reddit — your spaces
simply vanished as you typed.

Two things were wrong behind that. Keys are no longer handed to the page at all, so a site can
no longer act on what you write in a comment. And where the page cancels a key before the panel
can see it, the character is put into the box afterwards.

Nothing about what is stored, what is sent, or which relays are used has changed.

If you find this useful, a review on this page genuinely helps people find it. There is no
company behind it and no advertising budget — word of mouth is the whole distribution.

The small "note" label, on comments carried over from the old Nostr note format, now uses the same grey as everything else in the panel. It came from a different grey scale with a blue tint, which in dark mode turned it into a blue pill on an otherwise neutral panel — and on light backgrounds left it fainter than the contrast standard the rest of the interface meets.

Nothing about what is stored, what is sent, or which relays are used has changed.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Two changes, both about the panel being straight with you.

Settings no longer leaves your lists where the website can read them. Your relays, the people
and words you have muted, and the sites you switched NostrComments off on were written into
the page when you opened Settings — and left there afterwards. The list of disabled sites is
the awkward one: it names other sites you visit, sitting in the page of one of them. All four
are cleared when you close Settings, and again when you close the panel.

And if you already have a Nostr signer, the welcome screen now offers to connect it. It used
to show links to install Alby or nos2x even when one of them was already running, while the
only way to actually use it was the Connect button, which did not say so.

Nothing about what is stored, what is sent, or which relays are used has changed.

If you find this useful, a review on this page genuinely helps people find it. There is no
company behind it and no advertising budget — word of mouth is the whole distribution.

Your Nostr public key is no longer sitting where the website can read it.

The panel writes your identity — the status line, your npub, and your profile name — into
the page it is running on. Until now it did that on every page you visited, whether or not
you ever opened the panel. Your public key is meant to be public, but that is not the same
as letting every site you read recognise you by it without you posting anything.

It is now written only while the panel is actually open, and removed again when you close
it. Nothing about what is stored, what is sent, or which relays are used has changed.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Your dark/light choice is now remembered once, for every website, instead of separately per
site. It also no longer lives in the storage of the page you are visiting — where any site
could read it and tell that you have NostrComments installed.

Buttons and text that were too faint have been made readable. White on the blue used for
Post, Connect Nostr and every other primary button measured 3.00:1, below the accessibility
floor of 4.5:1; the blue is now deeper. The same has been done for the hints in Settings,
the message shown for an empty thread, and the connection status, which was hard to read on
the dark theme.

The floating button keeps its original colour: it carries an icon rather than text, and
that has a different, lower requirement which it already met.

Some websites block NostrComments from reaching your relays through their own security
policy. On Firefox this silently emptied the panel — you were told nobody had commented,
when in fact the connection was never allowed. The panel now says the site is in the way,
and the relay list marks those relays as blocked. The connection still cannot be made;
this release stops it being a mystery.

Pictures in comments and profile avatars no longer tell their host which page you are
reading. They load from whichever server the poster chose, and until now every one of
those requests named the page — so an avatar revealed where its owner's readers were
going. They also load only as they scroll into view.

An empty thread now says which kind of empty: everything hidden by your own mutes, no
search results, or genuinely nothing yet. And the Muted users and Disabled sites lists in
Settings stay on screen when they are empty, so you can see that nothing is muted instead
of guessing.

Searching returns a flat list of matches, so a reply containing your search term is no
longer hidden because the comment above it does not.

Fixed: switching off your signer extension while a tab stayed open left the Post button
dead with nothing on screen. Disabling nos2x or Alby does not remove window.nostr from a
page that is already loaded, so the request was accepted and never answered. The panel now
says so after four seconds and points at the way out, instead of going quiet for a minute.

Fixed: two relays that stopped answering, dropped from the defaults back in 22.59, were
never removed from lists that had been edited by hand — a saved list is only written when
you change it, so it froze with them in it. They are retired once now. A relay you removed
on purpose stays removed, and Settings tells you when this happened.

Also, from 22.63, which was pulled shortly after release and never reached most installs:
the comment button can be moved to any of the four corners and remembers that per site, and
it is smaller than it was.

A signer request that never comes back now times out in the userscript build too, and
messages you need to act on stay on screen instead of disappearing after a couple of
seconds.

Automatic rollback based on version [22.63].

Automatic rollback based on version [22.62]. Schnorr security measures too strict, causing some people to not being able to comment. Working on it.

The floating button is smaller, and you can now choose which corner it sits in, per site. Bottom right is where most chat widgets and back-to-top buttons live, so a button parked there eventually covers something; Settings offers all four corners and remembers the choice for that site only.

That section also reads in a more sensible order: moving the button is offered before switching the extension off, which used to come first.

Internally, the Schnorr signature implementation is now tested against the complete official BIP-340 vector set rather than a single vector — including the ten that must be rejected. No behaviour changed; it is now measured.

Adds a toolbar button. Everything this extension shows is drawn into the page, and that cannot happen without permission for the page — so without it, the extension showed nothing at all and could not explain why. The button needs no such permission: it says whether the extension can see pages and can ask for access.

Fixes three ways a private key could be lost or exposed. Pasting an nsec into the comment box published it to public relays; it is now refused there and everywhere else except the import field. "Show private key" shows an nsec instead of raw hex. And choosing a browser signer that later stops answering no longer strands you — the key stored in the extension is offered instead.

Generating a key no longer opens Settings and shows a warning about losing your identity. It connects and lets you comment; the backup prompt moved to just after your first comment, where it is about something real.

Install links now point at addons.mozilla.org rather than a source repository, and the signer buttons show which signer is actually in use.

Adds a field in settings to publish a display name, so comments from a key made here no longer show as npub1abc…. An existing profile is merged rather than replaced.

Fixes four ways a key or a profile could be lost: the onboarding button could generate over a stored key without asking; an external signer that switched account could have its profile overwritten; an old profile left on a slow relay could overwrite a newer one; and a signer prompt approved a moment too slowly threw away what you had written.

This one is about which key speaks for you.


If you chose Key stored here and then reloaded a page with Alby or nos2x
installed, the panel connected as the signer's identity instead. Silently. Your
own key was never touched — it sat in storage the whole time — but you could post
under an identity you had not chosen and nothing said so.

On load the panel asked only whether a signer was installed, not which one you had
picked. Your choice is honoured now. Only when you have never made a choice does
the presence of a signer decide, which is a reasonable default for a first run.

Worth checking after updating: open ⚙ Settings and confirm the Signing section
shows the source you expect.


After switching to your signer and reloading, switching back was refused with that
message — while your npub was displayed two lines above it. The check asked whether
the key was loaded, not whether it existed. It asks storage now.


Alby and nos2x add themselves to the page asynchronously. The panel looked once,
allowed 800ms, and if that look came back empty it never tried again for the rest
of the page — pressing the signer button in Settings by hand was the only way out.
It now allows 2.5 seconds and keeps looking for about thirty.


Switching back to a stored key loaded it but left "Show private key" showing an
empty box. Introduced by the fix in v22.54 that took the key out of the page's
reach; corrected here.

Two of the six relays included by default were not responding and have been
replaced. Your own relay list is untouched — this only affects fresh installs.

The same relay could also appear twice in the list if it was added once with a
trailing slash and once without, which quietly doubled the connections made on
every page. Addresses are now normalized, and existing lists are cleaned up.

Settings now says what each of your relays is actually doing.

A relay that never answers looked exactly like a relay with nothing to say. Both
give you a thinner, slower thread, and nothing explained why — connections failed
silently, retried a few times and gave up without a word.

Each relay in Settings now carries a line: "answered · 12", "answered · nothing
here", "no answer", or "gave up". Answering with nothing and never answering are
different problems, and they were indistinguishable before.

This came out of finding that three of the six relays shipped by default did not
respond from one machine on one afternoon. The default list is deliberately
unchanged — that measurement was taken after hours of hammering those relays, and
one of the three had been serving data minutes earlier. Rather than change what
everyone gets based on one bad sample, the extension now shows you the answer for
your own machine.

You can now reply to ordinary Nostr notes from the panel. A note that links to the
page is a Nostr conversation rather than a comment written here, so your reply is
published as an ordinary Nostr note threaded onto it — which is also why the reply
box now tells you, before you type, that it will reach your followers and how many
people it will notify.

Notes are easier to tell apart from comments: they have their own border and a
slightly recessed card instead of looking identical to a comment with a small
label. Tapping that label explains what a note is, which previously only worked
with a mouse.

Two fixes from a security review of everything that changed since v22.53. The
small button that re-enables the extension on a site you switched it off on could
be hidden by that site's stylesheet, which left no way to turn it back on there.
And an error while composing a post could leave the Post button stuck with no
explanation.

Your private key was readable by the page it was open on. The comment panel lives in a
shadow root that any script on the site can reach, and the key sat in a field there from
the moment you opened Settings — not only while you were looking at it — until you left
the page. Deleting your identity did not clear it either. The key now stays out of the
page's reach and appears only while it is on screen.

If you used an earlier version on a site you do not trust, treat your key as exposed and
switch to a new identity in Settings.

Older comments are visible again. Version 22.51 moved to NIP-22 comment events and stopped
reading ordinary notes, which hid far more than intended: a note tagged with a page URL is
how any Nostr client links a note to a page, so everything said about a page elsewhere
disappeared from the panel. Those notes are shown again, marked as notes. You can vote on
them; replying is not possible, because a NIP-22 comment may not reply to an ordinary note.
New comments are still published as NIP-22 comments.

The floating button no longer picks up styling from the site it is on. Ordinary page CSS
could stretch its icon, move its badges, or hide the unread count entirely.

Lightning payments now verify the callback address returned by the recipient's server, which
also fixes payments failing silently with some providers.

The privacy policy now states that profile pictures and images in comments load from
third-party servers, which gives those servers your IP address.

• NostrComments no longer connects to relays on pages you glance at and leave, or in tabs
you have not looked at yet. Pages you read are unaffected.
• Your private key is hidden in Settings until you ask to see it.
• Copy and save confirmations now appear where you can see them.
• The comment count on the button no longer includes deleted or muted comments.

• You are now offered, once, the option to protect your stored key with a password.
Declining is remembered — you will not be asked again — and you can still set one later
in Settings.

• Comments now use the NIP-22 standard (kind 1111) instead of ordinary notes, so they no
longer appear in your followers' feeds as stray posts.
• Note: comments made with earlier versions used the old format and are no longer shown.

• Busy threads no longer come back empty — votes were crowding comments out of the request.
• Verified names (NIP-05) available in Settings, off by default: switching it on contacts
the commenter's domain, so it is your choice.
• Works with relays that require you to identify yourself (NIP-42), and explains a refusal
in words instead of quoting the relay.
• Profile names and pictures are looked for on all your relays, not just the first two.

• A comment, vote or deletion that no relay accepts is no longer shown as if it worked —
and your text stays in the box so you can try again.
• Replies to you no longer go missing from the thread, notifications survive a dropped
connection, and they follow you when you switch identity.
• Muting a word no longer hides replies written by other people, and "tap to show" on a
downvoted comment now shows it.

Voting now actually works.

• Votes cast by other people load with the thread. Until now you only ever saw your own
vote — this also brings back every vote already sitting on relays from earlier versions.
• You can see which way you voted, and it is still there after a reload, so you no longer
vote twice by accident.
• The "Connect Nostr" button disappears once you are connected, and comes back if you
delete your key.

New

• Delete your own comments. Comments used to be permanent — the extension had no delete
control at all. Your own comments now carry a delete button that publishes a NIP-09
deletion request. Most relays honour it, some will not, and copies may remain, so the
wording promises only that. Deletion requests from others are honoured too, and one only
counts when signed by the author of the comment it targets.

• A note before you post, so you know beforehand rather than afterwards: comments go to
public relays, and deletion is a request rather than a guarantee.

• Bring an identity you already use. There was previously no way to import a key at all —
you could generate, rotate or delete, but the nsec every other Nostr app gives you had
nowhere to go. Settings now accepts an nsec1… key directly, or raw hex, with the checksum
verified so a mistyped key is refused instead of quietly becoming a different identity.

• Choose which key signs. A key stored here used to win unconditionally, which silently
disabled Alby and nos2x — switching accounts in your signer had no effect. Settings now
has an explicit choice, and the extension follows your signer when you switch there.

• See who you are. The status line showed the tail of a hex key, which tells you nothing.
It now shows your profile name, or a shortened npub. Settings gained an Active identity
card with your avatar, name and full npub, with hex behind a toggle.

Fixes

• Warnings before an identity is lost. Importing or rotating replaced the stored key behind
a single confirmation with no way to keep a copy — and an unbacked-up key was simply gone.
Import, rotate and delete now name the npub about to disappear, say plainly whether a
backup was ever confirmed, and offer to copy the key without closing the dialog.

• NostrComments is now available on Firefox for Android.
• Fixed the comment panel overflowing slightly past the screen edge on narrow
displays, which clipped its margins and rounded corners.