Nostr VPN is an open-source mesh VPN that uses Nostr key pairs and signed rosters to enrol your own devices, then links them peer to peer over FIPS, with MagicDNS, subnet routes and WireGuard egress built in.
Nostr VPN is a self-hosted mesh network for your own machines, modelled on Tailscale rather than on commercial VPN subscriptions. Each device generates a key pair, and an administrator approves a signed join request before that device enters a roster everyone else can verify. Traffic then flows directly between peers wherever UDP gets through, and falls back to routing through neighbouring nodes when it does not. The Nostr VPN data plane is FIPS, an encrypted internetworking protocol, with WireGuard available for upstream egress. There is no account, no email and no central service holding your device list.
It is worth being clear about the category. A commercial client such as those installed through the Mullvad VPN loader exists to hide your address from websites; Nostr VPN exists to connect your own hardware, a home server, a laptop and a phone, as if they shared a switch. Nothing is tunnelled to a stranger's data centre by default, so your public IP is unchanged until you deliberately configure an exit node. The trade-off is that you administer the mesh yourself: approving devices, keeping rosters consistent and deciding who may relay traffic all remain your responsibility.
The appeal of Nostr VPN is ownership without a subscription. Your device list lives in signed rosters that every member can check, so a compromised server cannot quietly add an intruder. Because peers attempt direct connections first, two machines on the same continent usually exchange traffic without a relay in the middle, which cuts latency for remote desktops, database access and file copies. MagicDNS means you type a device name instead of hunting for an address, and subnet routes expose a whole home or office LAN through a single peer. Exit nodes let a phone borrow a home connection while travelling, while WireGuard upstream egress lets that home connection itself sit behind a conventional VPN. For tinkerers, the experimental paid-exit marketplace sells bandwidth per byte over Nostr and settles in Bitcoin.
Key capabilities and highlights.
Devices are identified by key pairs rather than usernames and passwords. Adding one means generating a signed join request on the new machine and having an administrator approve it, after which the roster update propagates to every peer, so membership is auditable rather than implied by a password reset.
Peers try to reach each other over UDP first, which keeps traffic off any relay when both ends are reachable. Where NAT or a firewall blocks the path, the mesh routes packets through FIPS neighbours instead, so a working link exists even when a direct one cannot be negotiated.
Machine names resolve through the mesh, so you open a share or a management page by hostname instead of memorising an address that changes when DHCP hands out a new lease. It removes the small friction that usually pushes people back to a spreadsheet of IP numbers.
A peer can advertise a whole LAN behind it, letting a laptop reach a printer, a NAS or a rack of servers without installing anything on those devices. That single setting is what turns a handful of connected machines into something resembling a site-to-site link.
Designate one peer as the internet exit and other devices can send their general browsing through it, which is how a phone on hotel Wi-Fi borrows a home connection. It is the closest this project comes to a conventional VPN, and it stays entirely under your control.
An exit peer can forward traffic into an existing WireGuard tunnel before it reaches the internet, so a home node sitting behind a commercial VPN does not expose the household address. It stacks with the mesh instead of forcing a choice between the two.
Nostr VPN lets operators sell spare bandwidth per byte, advertised over Nostr relays and paid in Bitcoin through Cashu channels, with buyers choosing providers by price, trusted ratings or measured connection quality. It is experimental, but it sketches a market for exits that needs no central broker.
The nvpn command drives everything from a terminal, including registering itself as a service at boot, while Nostr VPN ships native apps for macOS, Linux, Windows, Android and iOS. Server packages exist for StartOS and Umbrel, so a home node can be deployed from a familiar app store.
Browse historical releases and previous builds.
Common questions about Nostr VPN.
Nostr VPN is a private mesh network for devices you own, using Nostr identities to manage membership and an encrypted FIPS data plane to carry traffic. Peers connect directly when they can and route through neighbours when they cannot, and native apps exist for five platforms.
Not by default. It connects your own machines and leaves your public IP unchanged unless you deliberately send traffic through an exit node, so hiding your address from websites is not its main purpose. The author is candid that Tailscale and plain WireGuard remain more mature for demanding production use.
No. Identity comes from a key pair generated on the device, and membership is expressed in signed rosters rather than in a user database. Nothing about enrolment asks for personal details, which removes the usual sign-up step entirely.
It creates a signed join request, presented as a QR code or a pasted string. An administrator approves that request in their app, the roster is updated and signed, and the change reaches the other peers on their next sync.
No dedicated server is needed, since peers talk to each other and relays only carry signalling. In practice one always-on machine makes the mesh far more useful, and Nostr VPN packages are available for StartOS and Umbrel if you want that node managed for you.
Native apps for macOS, Linux, Windows, Android and iOS, plus command-line archives for desktop and ARM Linux. Intel Macs are source-only, and the self-hosted packages cover both x86 and ARM hardware.
Packets between peers are encrypted by the FIPS data plane, WireGuard handles upstream egress, and DNS queries are encrypted by default. Nostr VPN still leaves exit nodes able to see destination addresses and unencrypted traffic, so ordinary HTTPS habits remain necessary.
An experimental marketplace where operators sell internet egress by the byte, priced over Nostr and paid in Bitcoin using Cashu channels. Buyers pick a provider manually or let the app rank them by quality and price, which helps when you have no always-on node of your own.
Nostr VPN is an open-source mesh VPN that uses Nostr key pairs and signed rosters to enrol your own devices, then links them peer to peer over FIPS, with MagicDNS, subnet routes and WireGuard egress built in.
Mozilla VPN is a WireGuard-based virtual private network from the makers of Firefox that encrypts traffic on Windows, macOS, Linux, Android and iOS, hides your IP address, and blocks trackers and ads through the Mullvad server network.
Net Bird is a WireGuard-based networking client that connects approved devices and private resources through encrypted peer-to-peer tunnels governed by centralized identity, routing, and access policies.
IPVanish is a VPN service that encrypts internet traffic, masks the user’s public IP address, and provides configurable connection controls for private browsing, streaming, file sharing, and safer use of unfamiliar networks.
Mullvad VPN loader is the compact Windows and macOS installer that fetches the latest Mullvad VPN app from global CDNs, verifies its authenticity automatically before running anything, and can be reused to upgrade an existing installation.
Comments