Nostr VPN is a free, open-source mesh VPN for people who want to connect their own computers and devices into a private network without sending their traffic through a commercial VPN provider. It suits developers, self-hosters and privacy-minded users who already follow the Nostr ecosystem or want to experiment with decentralized networking. The design follows the same general idea as Tailscale-style networks, so each machine can reach the others directly once they find each other.
Under the hood, the project is written in Rust. Nostr handles the signaling layer: devices use Nostr to discover each other and exchange connection details, while the actual encrypted tunnel runs on userspace WireGuard. The latest release is version 0.3.12. Because this is a young networking tool, it rewards careful reading and a test run on non-critical machines before you rely on it for anything important.
What Is a Mesh VPN, and Why It Matters
A traditional VPN sends all of your traffic through a single server run by a provider. A mesh VPN takes a different approach: every device in the network can connect to every other device, and traffic travels along the most direct path that works. For a home lab or a small team, this can mean a laptop reaching a home server or a desktop reaching a file share without exposing those services to the public internet.
The trade-off is complexity. Each device needs to know how to reach its peers, which is why mesh VPNs rely on a coordination layer. In Nostr VPN, that layer is built on Nostr, so the pieces that find devices and exchange connection details are separate from the tunnel that carries the data. Understanding this split helps when you troubleshoot, because a device can be known to the network yet still fail to connect if the path between two machines is blocked.
How Nostr Signaling Helps Devices Find Each Other
Nostr is an open protocol in which messages are sent through relays, and every user is identified by a public key. A device can publish its connection details to relays and read the details of its peers, without a single company owning the directory. Signaling is the name for this exchange of coordination messages before a direct connection is established.
For a user, the practical effect is that identity is tied to keys you control rather than to a single account on a central service. Keys must be stored carefully, since anyone who obtains a private key can impersonate that identity. Keeping backups of your configuration and never sharing private keys in chat or email are simple habits that protect the whole network you have built.
Who Should Consider Nostr VPN?
Nostr VPN fits several kinds of users. A developer might connect a laptop to a test server running at home, so that the server is reachable from anywhere without opening router ports. A family or small group might link a few personal machines to share a private network for local services such as a media library or a file archive.
It is also a reasonable choice for people who follow decentralized software and want to see how identity, messaging and networking fit together. If you need a polished consumer app with a graphical dashboard and a large support team, a more mature commercial product may suit you better. Nostr VPN rewards users who are comfortable reading documentation and using a terminal.
What Exit Nodes Are and How Paid Access Works
An exit node is a device that forwards your internet traffic to the public internet on your behalf. When you route your traffic through an exit node, websites see the exit node's connection rather than your own. Exit nodes are useful for privacy, for accessing services from a particular network, and for connecting from an untrusted location.
Nostr VPN's marketplace concept measures usage by the number of bytes transferred and settles payment in Bitcoin through Cashu, which lets small amounts move without a traditional bank. Because the feature is experimental, it is best approached as a way to learn how metered network access works. Do not expect it to be a dependable income source or a replacement for a service with clear terms, support and guarantees.
Key features
Private mesh networking
Nostr-based signaling
Userspace WireGuard tunnels
MagicDNS and split DNS
Experimental exit node marketplace
Command-line control and status checks
Supported coins
The documentation mentions Bitcoin (BTC) in connection with the exit node marketplace, where usage is paid for in Bitcoin through Cashu. Nostr appears as the protocol that carries signaling between devices rather than as a coin. Payments are the only place where money plays a role in the project, so the rest of the software can be used without any wallet at all.
How to install Nostr VPN on Windows
PS> winget install mmalmi.nostr-vpn- 1
Check the basics before installing
Nostr VPN targets Windows, and the simplest route is the winget package manager, which is included with current versions of Windows 10 and Windows 11. Open PowerShell or Windows Terminal and confirm that winget responds to a version check. Plan to use an account with administrator rights, because the background service must be installed from an elevated shell.
- 2
Install with winget
Run
winget install mmalmi.nostr-vpnin your terminal and accept the prompts. Winget downloads the package and installs it for you, so you do not need to search for an installer by hand. When the command finishes, close the window and open a new terminal so that the nvpn command is available on your path. - 3
Or download the installer manually
If you prefer not to use winget, download the Windows package from the official website for the project, which is the GitHub account and Releases page linked on the project's source repository. Only download from the official website, and if the release lists a SHA-256 checksum or a signature, verify the file before running it. Then run the installer and follow its steps.
- 4
Install the background service
Open PowerShell or Windows Terminal as administrator and run
nvpn service install. The background service keeps the mesh connection running even when no terminal is open. If Windows asks for permission to make changes, approve the prompt only if you started the command yourself and expected it. -
Confirm that the service is running
Run
nvpn status --jsonand read the output. Wait until the status reports a source of daemon before treating the connection as ready. If the result is still starting or shows no daemon source, give the service a minute and check again rather than assuming everything is working.
System requirements
- Windows with an account that has administrator rights, needed to install the background service from an elevated shell
- No development tools are needed for the ready-made program; tools such as Rust matter only if you compile the project from source
How to use Nostr VPN
Once the service is installed, the day-to-day workflow is short. The goal is to bring the daemon up, join your mesh and confirm that the status is healthy before you rely on any device. Here is a practical sequence for a first session.
- Open an elevated terminal and start the daemon with
nvpn start --daemon --connectso that it runs in the background and attempts to connect. - Run
nvpn status --jsonand check the output. Treat the connection as ready only when the status source reads daemon. - Test reachability by pinging or opening a service on another device in your mesh, using its address or MagicDNS name.
- If names do not resolve, check your DNS setup and confirm that split DNS is active before blaming the tunnel.
- Add the devices you want to reach to your network configuration and repeat the status check on each one.
- Keep a copy of your configuration in a safe place so you can restore the setup after a reinstall.
- When you finish a session, stop the daemon if you do not need the connection, to reduce the attack surface and free resources.
Working through these steps in order makes problems easier to isolate. Most issues turn out to be a status that never reached daemon or a DNS rule that did not apply, so checking those two things first saves time.
Pros & cons
- Free to use, with the source code publicly available on GitHub
- Peer-to-peer mesh design lets devices connect directly without a central gateway
- Uses WireGuard for the encrypted tunnel, a widely studied protocol
- Nostr-based signaling ties identity to keys you control
- Simple installation through winget and a command-line control interface
- Scriptable status checks suit administrators and automation
- The exit node marketplace is experimental and should not be relied upon
- Version 0.3.12 signals an early stage, so expect rough edges
- Relies on the command line, which may deter users who want a graphical app
- Some DNS and routing behavior depends on the operating system and on container restrictions, which can block route cleanup
Is Nostr VPN safe?
Nostr VPN handles network traffic and cryptographic keys, and its marketplace touches real payments, so safety matters from the first download. Download only from the official website, which means the project's GitHub account and its Releases page, or install through winget using the official package identifier. If a release publishes a SHA-256 checksum or a digital signature, verify it before running the installer. Never paste a private key or any wallet secret into a third-party website, chat or support form. Keep the latest version installed, and check the official website for the current release notes before updating, because an early-stage project can change quickly. Run the program with the minimum permissions needed, and remember that the experimental payment feature should be tested with small amounts only.
- Official source only. Download from github.com/mmalmi. Ignore ads and lookalike domains.
- Check the SHA-256. Compare the installer hash with the value the developer publishes before running it.
- Never share your seed phrase. No developer, support agent or website — including CryptApps — will ever ask for it.
Alternatives
Nostr VPN is a networking tool, while most of the other programs in this category are clients or wallets. Vega and Notedeck are desktop applications for browsing and posting to Nostr, so they focus on content rather than on connecting your machines. Nostrid also offers a Nostr client with Windows support, and it is the closest of the group to a general-purpose app for reading and posting. Bold Bitcoin Wallet and Bro App use Nostr for coordination around Bitcoin, one for device pairing and signing, the other for paying bills. Statim combines messaging with a self-custody model across several protocols. None of these replace a mesh network, so Nostr VPN is best viewed as a complement to a Nostr client rather than a rival to one.
Specifications
- Price
- Free
- Type
- Open source
- License
- unknown
- Latest version
- 0.3.12
- Last update
- 30 Oct 2026
- Windows support
- Yes (available via winget)
- Official site
- github.com/mmalmi
- Source code
- github.com/mmalmi/nostr-vpn
- Install command
- winget install mmalmi.nostr-vpn
Frequently asked questions
Yes, Nostr VPN is listed as free and open source. You can download it from the project's GitHub Releases page or install it with winget. Because it is free software, you can also read the source code to see how the mesh and signaling layers work before you decide to trust it with your devices.
The quickest way is to run winget install mmalmi.nostr-vpn in a terminal. After installation, open an elevated shell and run nvpn service install to set up the background service. Then check the connection with nvpn status --json and wait until the source reads daemon before assuming the mesh is ready.
It can be, if you use it carefully. Get the program from the official GitHub account or through winget, verify the SHA-256 checksum or signature when one is published, and keep the software updated. Because it manages network identity and keys, never share private keys with anyone or paste them into websites you do not control.
A traditional VPN routes your traffic through one provider's server, while Nostr VPN builds a mesh in which your devices connect to each other directly. Coordination happens through Nostr relays and encryption runs over WireGuard. This design suits private access between your own machines, though it is less about hiding your browsing from a single provider.
Bitcoin is used only in the experimental exit node marketplace, where byte-metered access is paid in Bitcoin through Cashu. The core mesh networking does not require a wallet or payments. If you test the marketplace, use small amounts, because the feature is labeled experimental and its behavior may change.
Yes, that is one of the main scenarios the design supports. Install the program on both machines, join them to the same mesh, and confirm that each one reports a ready status. You can then reach the home machine by its address or MagicDNS name, provided that the operating systems and firewall rules on both ends allow the traffic.
It shares the same general goal of a mesh network, but it is a different project with its own design and a much younger codebase. If you want a mature service with a polished interface and wide support, Tailscale may suit you better. Nostr VPN appeals to people who want Nostr-based identity and a fully open implementation.
Verdict
Nostr VPN for Windows suits technically comfortable users who want a private mesh between their own devices and value open-source, Nostr-based design. It is free, installs cleanly with winget and offers scriptable status checks. Its exit node marketplace is experimental, and the version number signals an early project. If you are willing to read documentation, test with non-critical machines and check the official website for the latest release before updating, it is worth exploring. Those who need a polished, fully supported product may prefer a more established option.