Keep is an encrypted vault for Nostr and Bitcoin keys, built for developers, node operators and everyday Nostr users who want their private keys kept out of the apps they use. It stores keys locally, encrypts them, and can sign requests remotely, so a client receives a signature without ever seeing the key itself. The project is released under the MIT license and is free to use.
Keep works across command-line, desktop and mobile setups, and its platform list includes Windows, macOS, Linux, Android and iOS. The project builds for Windows, but check the GitHub Releases page for a ready-made package for the current version, v0.13.1. The most recent code update is dated October 31, 2026. The rest of this page covers features, installation, how threshold signing works and how Keep compares with other Nostr tools.
What Is Keep and Who Is It For?
Nostr identities and Bitcoin wallets both depend on private keys. Whoever controls the key controls the account or the funds, so storing it in a plain file or pasting it into a website creates a real risk. Keep is designed to reduce that risk by keeping keys in an encrypted vault and signing on their behalf.
The program suits several kinds of users. Nostr users who post from multiple clients can keep their identity key in one place instead of copying it everywhere. Developers building Nostr or Bitcoin tools can test remote signing flows without handling raw keys in their code. Operators of servers and nodes may find the threshold and enclave features useful when no single machine should hold full control.
It is less suited to people who only want a casual app with no setup. Keep assumes you are willing to learn a few concepts, such as encrypted vaults, remote signing and key shares. The reward is that your key material stays under your control and is handled with careful cryptography.
How Threshold Signatures Reduce Single-Point Risk
A single private key is a single point of failure. If the device holding it is stolen, infected or simply lost, the funds or identity it controls can be taken or locked away. Threshold signatures address this by splitting the signing power across several shares.
Consider a 2-of-3 arrangement. Three shares are created, one for each device or holder, and any two can cooperate to produce a signature. Losing one share does not stop signing, and a single compromised share does not allow anyone to sign alone. The exact trade-off depends on how you choose t and n, since a higher threshold is safer but harder to coordinate.
FROST is the method Keep uses for this. Its signing rounds are designed so the parties cooperate without ever reconstructing the full private key in one place. Distributed key generation handles the setup, so the shares are created together rather than by a single trusted dealer. Users who want this protection should plan their share holders and backups before depositing any real value.
Remote Signing: Keeping Keys Out of Your Apps
Most Nostr clients need to sign events, which proves that a post or message came from your identity. The traditional approach is to paste your private key into the client. That works, but every app that holds your key becomes another place where it can leak.
Remote signing changes the model. Under NIP-46, the client asks a separate signer to produce signatures, and the signer keeps the key to itself. Keep plays this role in bunker mode. The client sees public information and signed results, while the private key stays in the vault. Revoking access to one client does not require changing the identity itself.
This arrangement is useful when you test new clients. You can try an unfamiliar app without giving it your key, and you can stop trusting it by removing the connection. It does not protect you from approving harmful requests, so read what each signing prompt asks for before you confirm it.
Key features
Encrypted Vault
Remote Signing with NIP-46
Threshold Signatures
Network Signing Over Nostr Relays
Threshold Vault Unlock
Bitcoin Support
Enclave Signing
Agent SDK for AI Tools
Hidden Volumes
Desktop App with System Tray and QR Scanning
Supported coins
Keep's documentation names Bitcoin (BTC) and Nostr as its main networks. On the Bitcoin side, the vault works with BIP-86 Taproot addresses and PSBT signing, which fits into standard wallet-building workflows. On the Nostr side, it holds identity keys and signs requests for compatible clients. Argon2 is the key-derivation function used to protect the vault.
How to install Keep on Windows
- 1
Download from the Official Source
Download Keep only from the official website or the project's GitHub Releases page at github.com/privkeyio/keep. Avoid mirrors, forum links and file-sharing sites, since they can carry modified installers. Open the release for the current version, v0.13.1, and look for a Windows package in its list of files.
- 2
Check for a Windows Build
The project builds for Windows, but a ready-made package may or may not be attached to a given release. If the Releases page lists a Windows installer or archive, use that. If no Windows file is posted, building from source is the alternative, and that is a developer task that needs its own toolchain.
- 3
Verify the File
Before running anything, compare the file's SHA-256 checksum with the value published alongside the release. In Windows PowerShell, run Get-FileHash followed by the file path and check the output against the published value. If the release provides a signature instead, verify it with the method the project describes. Do not run a file whose checksum does not match.
-
Install and Create Your Vault
Run the installer and follow its prompts. On first launch, create your vault with a strong passphrase that you store offline, since losing it can lock you out of your keys. Write down any backup material the app gives you and keep copies in separate places. Only then import existing keys or set up remote signing.
How to use Keep
Once Keep is installed, the basic workflow is straightforward, although the underlying concepts take some practice.
- Open the desktop app and create or unlock your vault with your passphrase.
- Import an existing key using the NIP-49 import option, or start with a fresh vault and add keys deliberately.
- Turn on bunker mode to enable NIP-46 remote signing, which produces a connection string for a compatible Nostr client.
- Paste the connection string into the client, or scan the QR code if your client supports it, then approve the connection.
- Review each signing request before confirming it, paying attention to the event type and the client that sent it.
- For Bitcoin, import or set up your wallet descriptor, receive a PSBT from your wallet software, and sign it in Keep before broadcasting.
- For threshold setups, create a FROST group with the share count you planned, then test a signature with all participants before storing meaningful value.
Practice with small amounts and throwaway identities first. Once you understand how requests appear and how the vault locks, you can move your real keys over with more confidence.
Pros & cons
- Free to use and released under the MIT license
- Keys are encrypted with Argon2id and XChaCha20-Poly1305 and zeroized in memory
- NIP-46 remote signing keeps private keys out of third-party Nostr clients
- FROST threshold signatures remove the single-device point of failure
- Covers both Nostr identities and Bitcoin workflows such as Taproot and PSBT signing
- Platform list includes Windows, macOS, Linux, Android and iOS
- Windows support is listed as available through builds, so you may need to confirm a ready-made package on the Releases page
- Threshold signing, DKG and remote signing involve concepts that take time to learn
- Some features, such as keep-node unlock and enclave signing, target specialized setups
- Backups and passphrase management are your responsibility, and mistakes can be hard to undo
- Setup is more involved than a typical single-key wallet or Nostr client
Is Keep safe?
Download Keep only from the official website or the project's GitHub Releases page at github.com/privkeyio/keep. Before running the installer, compare the file's SHA-256 checksum with the value published with the release, or verify the signature if one is provided. Never type your seed phrase, passphrase or private key into a website, chat window or support message, and treat anyone who asks for them as a scammer. Keep handles keys that control money and identities, so a tampered installer could do serious damage. The MIT license and public source code let security-minded users review the code. Public code still does not replace verification of the file you actually run. Check the latest version on the official website before installing.
- Official source only. Download from github.com/privkeyio/keep. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Keep sits in a different place from most entries in this catalog. Vega, Nostrid and Notedeck are Nostr clients, the apps where you read and post, while Keep is where keys live and signing happens. Keep can act as a remote signer for a client like these, so the two often work together rather than compete.
Bold Bitcoin Wallet also uses threshold-style signing over Nostr, but it is a Bitcoin wallet focused on pairing devices and signing transactions. Keep covers Nostr identities and Bitcoin keys in one vault, with a wider set of tools around remote signing. Nostr VPN and Statim address different problems entirely: a mesh VPN and a self-custodial messenger.
Specifications
- Price
- Free
- Type
- Open source
- License
- MIT
- Latest version
- v0.13.1
- Last update
- 31 Oct 2026
- Windows support
- Likely (builds for Windows; check releases)
- Source code
- github.com/privkeyio/keep
Frequently asked questions
Yes, Keep is free and released under the MIT license, which allows its source code to be read, modified and reused. The source is published on GitHub, so you can inspect it yourself. Free access also means you are responsible for managing your own keys, passphrases and backups, because no one else can recover them for you.
Keep is built around strong encryption, zeroized memory and remote signing, so private keys do not need to leave the vault. Safety still depends on how you install and use it. Verify the download with its SHA-256 checksum or signature, store your passphrase offline, and never share seed phrases or keys with anyone who asks for them.
The project builds for Windows, and Windows is among the platforms it lists alongside macOS, Linux, Android and iOS. Check the GitHub Releases page for a ready-made Windows package for the version you want. If none is posted, building from source is the alternative, which requires developer tools.
NIP-46 is a Nostr protocol for remote signing, often called bunker mode. A compatible client sends a signing request to Keep, which signs the event and returns the signature. The client never receives the private key, so you can use one identity in several apps while the key stays inside the vault.
It means a key is split into n shares, and any t of them are enough to produce a signature. In a 2-of-3 setup, any two shares can sign, but one share alone cannot. Keep uses FROST for this, and distributed key generation creates the shares without any single party assembling the full key.
Yes. Keep supports BIP-86 Taproot addresses, PSBT signing and wallet descriptor coordination. A typical flow is to build an unsigned transaction in a wallet that supports PSBTs, move it to Keep, sign it there and broadcast the result. Start with small test amounts until the workflow feels familiar.
Keep works with any Nostr client that supports NIP-46 remote signing. You connect the client to Keep's bunker, usually by pasting a connection string or scanning a QR code, which the desktop app supports. Check each client's documentation to confirm it supports this flow before you rely on it.
Verdict
Keep suits Nostr and Bitcoin users who want their keys encrypted locally and kept away from everyday apps. It also fits developers who want to experiment with threshold signing, remote signing or scoped AI agent sessions. It is free, open source and actively updated. Beginners should expect a learning curve, especially with FROST shares and NIP-46 connections, so practice with small amounts first. It is less suited to people who want a simple, all-in-one wallet with no setup.