How to get a verified Nostr identity

From email-simple to cryptographically serious — the exact steps to get a @giveabit.io name you control.

What you're actually doing

Getting a verified Nostr identity is one task with two halves:

1. Generate a keypair — a public key (npub) and a secret key (nsec). The nsec is the one thing you must never lose or share.
2. Bind a name to the public key — publish a small JSON file on a domain you control. That file is what makes the name verifiable.

There is no signup form, no password reset, no company to ask. That is the point — and it means you are responsible for the secret key. That responsibility is the whole game.

Step 1 — Create a keypair

Nostr keys are just an elliptic-curve keypair. The simplest correct path is a client or tool that generates a key locally and shows you the nsec once. Save the nsec somewhere offline (password manager or paper), never paste it into chat or a shared file.

Step 2 — Put the file on your domain

NIP-05 verification is a single well-known URL. For the handle [email protected], serve this file at:

https://example.com/.well-known/nostr.json

with this content (your hex public key in place of the placeholder):

{
  "names": {
    "you": "<YOUR_HEX_PUBKEY>"
  }
}

That's it. When a client wants to verify [email protected], it fetches this file, finds your name, and reads off the public key.

Step 3 — Verify it resolves

curl -s 'https://example.com/.well-known/nostr.json?name=you'

Most clients also need to see a signed post from your key before they'll show the checkmark — the client confirms the key is actually being used. Posting from your nsec once is enough to complete the loop.

The @giveabit.io route (we've done it for you)

If you don't own a domain, Give A Bit can host the file for you. We maintain a public, open registry that already resolves 10 names, and the registry file is itself publicly auditable:

curl -s 'https://giveabit.io/.well-known/nostr.json' | jq '.names | keys'

The exact steps to be added are simple: generate a keypair, send the public key to hello@giveabit.io, and our registry ops verify and publish it. The secret key never leaves your hands.

Pitfalls to avoid

• Sharing the nsec. It is a signature pen. Anyone holding it can sign as you. Never paste it anywhere.
• Losing the nsec. A lost nsec means your name points at a key nobody can use. Back it up before you bind a name to it.
• Using someone else's "verification service" that holds the nsec for you — that is a gatekeeper, and it defeats the purpose.

What verified gets you

A verified handle is not a reputation score and not a blue badge. It is a durable answer to one question: "does the key signing these posts belong to whoever controls this name?" For that question it is the cheapest, most open proof that exists — and it's one you can run yourself, forever.

See it working live

Here is the live giveabit.io registry proving rosa@giveabit.io maps to a real, distinct key — same command any client runs:

curl -s 'https://giveabit.io/.well-known/nostr.json?name=rosa' \
  | jq -r '.names["rosa"]'

If you follow the same three steps above, your own name will resolve the same way — and the registry proving it will be yours to control.