Mention someone by typing @: a short list of the people in the thread appears, pick one, and they are notified when you post.

Clearer settings: the switch between the key stored here and your signer now just says "Browser signer", and works with any Nostr signer extension.

And a round of small security and privacy fixes from an audit: a comment full of quotes or mentions can no longer flood your relays with requests, and nothing about you stays on the page once you close the panel.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Safer on phones: dragging the button no longer brings up the small × and − next to your finger, so you can't switch NostrComments off by accident. And if you do switch it off on a site, the way back appears straight away, and the toolbar menu offers "Turn it back on here".

Mentions: put nostr:npub… in a comment and that person is notified in their own Nostr app. It shows as @name in the thread.

Content warnings and your mute list: comments marked as sensitive in other Nostr apps are folded until you tap them, and the people and words you muted in other Nostr apps are hidden here too. You can switch the second one off in Settings.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

An easier start: while your Nostr signer is asked, the panel now says so and what to do. If you decline, it says that plainly and doesn't keep asking. And if you type a comment before having an identity, one click makes a key and posts it.

Quoted notes are shown inline: paste a nostr:note or nostr:nevent link and the quoted note appears under your comment, fetched only from your own relays. If they don't have it, you can choose to look it up on the relay the quote names.

Replies reach the person you answer: a reply also goes to the relays they read, so strict relays on their side don't swallow it. You can switch this off in Settings.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Hashtags and quotes: write #scam or #vps in a comment and it is tagged, so people who follow that hashtag on Nostr can find it. Paste a nostr:note or nostr:nevent link to quote a note, and other Nostr apps show it as a quote; in the thread it becomes a short "quoted note" link instead of a long string. Both were requested on GitHub.

Choosing sites one by one: if you allow NostrComments only on certain sites (puzzle-piece menu → "Always Allow on" a site), the toolbar button now says so correctly.

Notifications say what happened: "replied to your note", "replied on example.com".

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Security and privacy fixes. Please update. Details will follow once this version is available everywhere.

Settings are shorter: each option has a one-line label, with the reasoning behind a "Why?" you can open.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Settings are easier to find your way in: they are now grouped under You, Reading, Button & sites, Relays & privacy and Activity, with buttons at the top that jump to each group. Your identity comes first.

The On/Off switch in the toolbar button is now a proper toggle.

For new users: the setup now also lists Attest as a signer, next to Alby and nos2x-fox. Attest is made by the developer of NostrComments, and it can sign through a remote signer such as nsec.app or Amber.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

New: an On/Off switch in the toolbar button. Switch it off and nothing appears on any page, nothing connects, and your signer is not asked for anything, until you switch it back on. Open tabs follow at once.

Fewer signer pop-ups: your Nostr signer is now asked for your key when you open the comments, not on every page you visit. With a signer that asks permission per site, like Attest, you will only be asked on sites where you actually read or write comments.

Clearer messages when a remote signer (NIP-46, through Attest) cannot be reached, or when the signer has no key set up yet.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Links in comments are checked more strictly: an address that hides a different site behind a user name (like https://yourbank.example@another.site) is now shown as plain text instead of a link. And when a relay explains why it refused something, its words are shown in quotes and named as the relay's.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

New: when a website's own Nostr key comments in its thread, you can now tell. With verified names switched on in Settings, a comment from a key whose verified name is _@example.com gets a "speaks for example.com" label on that site's pages. It shows the domain belongs to them, not who wrote the page. Thanks to the person who suggested it on GitHub.

Signers: the setup now suggests Alby or nos2x-fox again. nos2x-fox fixed the security problem that made us recommend something else for a while.

Some virus scanners with extra unofficial rules (ClamAV with Sanesecurity, used by some mail filters) reported the extension as infected because of one file's name. It was never infected; the file has been renamed so those warnings stop.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Security fixes — please update.

An audit after last week's fix found more ways for a malicious website to answer the panel's own dialogs for you. Because the panel sits inside the page, a site could press their buttons with a script. It could have pressed "Show my key" in the offer that appears after your first comment (putting your stored key where the page can read it), set a password of its own on your stored key so that you could no longer unlock it, removed the password from a key you had unlocked, or confirmed deleting your key once you had started to. Keys kept in a signer extension (Alby, nos2x, Attest) were not affected. These dialogs now only respond to your own clicks.

We have no indication that any of this was used. If you keep a key in NostrComments and want to be certain, make a new one under ⚙ Settings → Rotate key.

Also: when a Lightning provider or a relay refuses something, its words are now shown in quotes and named as theirs, so nobody can make the panel appear to say something it did not.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Security fix — please update.

On websites whose security policy forbids inline styles, Firefox dropped part of the panel's own styling. Because of that, the extension could write a private key stored in NostrComments into a hidden field of the panel when the page loaded, where a malicious website could read it. Keys kept in a signer extension (Alby, nos2x, Attest) were not affected. Keys stored in NostrComments were: unencrypted keys on every such page, and password-protected keys after you unlocked them on such a page.

We have no indication that it was used, but there is no way to rule it out. If you use a key stored in NostrComments and want to be certain, make a new one under ⚙ Settings → Rotate key.

The panel now restores its own styling on such pages, and only ever puts your key on screen when you press "Show private key".

Also new: "Your history" in the toolbar button — the pages where you opened the panel, with search, sorting and a Clear button. It stays on your device and makes no network requests. And if you sign with a signer extension, a failure now says why: the signer refused, did not answer in time, wants you to log in first, or is busy.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

If you sign with a signer extension (Alby, nos2x, Attest), the panel now connects to it right after the page loads. Before, it took about five seconds, so opening the panel quickly after a reload showed "Not connected" and a Connect button even though you had already chosen your signer.

On pages where the browser lets no extension run, such as the add-on stores themselves, the NostrComments toolbar button still explains that nothing can open there, and now also offers to show that page's comments in the web reader instead.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

New: quiet mode. If the floating button gets in your way, hover over it and click the small "−" next to the "×": from then on the button only appears on pages that already have comments, or where somebody replied to you. Everywhere else, open the panel from the NostrComments icon in your toolbar. You can switch it back off under Settings, "The floating button".

It is off by default, because every conversation starts with somebody seeing the button on a page nobody has commented on yet.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Two fixes to the Share button on your own comments.

It could be missing on some sites, while Delete was still there. The cause was not NostrComments itself: another extension's stylesheet hid it. Content blockers commonly hide anything named "share-btn" to remove "share on Facebook" widgets from web pages, and that was the button's name. It now has a name no such filter targets.

Sharing could also post the same note twice. After you confirmed, the button went straight back to "Share" while the note was still being signed, which with a signer extension that asks for your approval can take a few seconds, so it looked as if nothing had happened. It now says "Sharing…" and cannot be pressed while the note goes out, then "Shared". If publishing fails, the button comes back so you can try again. A note that was already posted twice is not removed: delete the extra one from any Nostr client.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

Settings, tidied — no behaviour change. Relays now has a heading. The button's own settings (hide it, move it) moved up near the top, since that's usually the first thing anyone opens settings for. "Disabled sites" now lives together with "Disable on this site" under one "This site" heading, instead of being split apart.

Fix: the unread-reply badge (on the floating button and on the toolbar icon) now shows what was already unread the moment a page loads, instead of staying at zero until the next reply arrives live or you open the panel yourself.

New: settings can now set a default corner for the floating button — "Use this corner on every new site" — used on any site you have not personally moved it on. Sites you have already placed, there or by dragging, are unaffected; this only changes where a fresh site starts.

New: drag the floating button (or swipe it, on a phone) toward an edge and it snaps to that corner — the same four corners the picker in Settings already offered, just faster to reach. It slides there rather than jumping, and a push up or down and a push left or right work independently of each other.

New: the floating button is quieter now — it dims unless you're hovering it, and hovering reveals a small × that turns the extension off on that site in one click. Same effect as "Disable on this site" in Settings, just faster to reach.

New: if a page you're reading names its own canonical address, or says it is also a native Nostr note or article (a growing convention some publishers are adopting), NostrComments now reads that thread too and folds it into the same panel — so a publisher's own Nostr-native comments and the ones made here meet, instead of sitting in two separate places. A small "linked" badge marks a comment that arrived this way.

This only ever adds what you see. What you write here still files under this page's own address, exactly as before — a page cannot decide where your own comment ends up.

Security fixes. A page you were reading could previously open this panel on its own and read a few things meant to be seen only once you opened it yourself — your public key, which pages you'd commented on, which sites you'd turned the extension off on, your muted words — without you clicking anything. It could also make the extension sign and send a Lightning payment through a comment's zap button, again without a click from you. Both now require an actual click, the same as posting a comment already does.

A couple of smaller things: another relay working against you could previously hide a real comment behind a forged one, or stop a page's thread from loading at all with a comment shaped wrong on purpose. Both are closed. Verifying comments and votes is also about ten times faster now.

None of this exposed your private key. Nothing here needs you to do anything — just update.

This is a security update. Please install it.

The comment panel is drawn inside the page you are reading, and a website's own scripts could reach into it. A malicious page could have pressed "Show private key" and read your key out of the panel, or written a comment and posted it under your name, without you clicking anything.

Everything that touches your key or publishes something now requires a real press from you — one that a page cannot imitate. That covers showing, copying, importing, replacing and deleting your key, posting, sharing, deleting and voting, publishing your name, choosing your signer, tipping, switching the extension off for a site, and muting a word or a person. The last two matter for a different reason: a website could otherwise have switched the comment layer off on its own pages, or hidden every comment that mentioned it.

Being straight about what this does not do: the panel still lives inside the page, so a page can still read the thread, read what you are typing, and read your key if you choose to display it while you are on that page. Moving these controls into the extension's own window is the real fix and it is next. If you keep a key in the extension and you would rather not wonder, you can rotate it in Settings; there is no sign anyone did this to anyone.

Also fixed: relays that ask you to identify yourself (NIP-42) have not worked since 23.2.0 — neither reading nor posting. They work again. And if you had a key stored here, Settings could not show it to you; now it can.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

This release makes sharing more useful and fixes one setting.

When you share your own comment to your Nostr feed, the note now includes a link that opens the whole thread in any browser. Most people who see your note do not have NostrComments, and until now the link took them to the page, where they saw no thread at all. Now they can read it without installing anything.

If you turned off "extra relays" in Settings, tabs you already had open kept using them until you reloaded. The setting now applies to every open tab straight away.

If you find this useful, a review on this page genuinely helps people find it. There is no company behind it and no advertising budget — word of mouth is the whole distribution.

This release fixes three faults in the part of the extension that talks to relays, all of them
dating from 23.2.0.

If a relay closed the connection — after a restart, or when your laptop woke up — nothing
reconnected. Comments and reply notifications stopped for that page until you reloaded it, and
nothing said so. That was the most serious of the three.

When you posted a comment, it is sent to every relay you have configured at once. Their answers
could be confused with one another, so a relay that was briefly busy looked like a relay that never
replied, and the second attempt came far too late or not at all. Comments now reach more relays,
which is the whole point of having several.

A relay that is no longer there now says so in Settings within seconds instead of after half a
minute.

Also: the relay status line is easier to read, and the consent screen and the relay list now ignore
clicks that did not come from you — a website's own scripts could previously reach into the panel.
Nothing changes in how you use it.

The toolbar button now opens the comment panel.

Until now it only told you whether the extension was active. Clicking it now opens the panel on the page you are looking at, and clicking again closes it. This matters on sites that remove the floating button from the page — some do, deliberately or as a side effect of how they manage their own page — because the toolbar is outside the page's reach.

Also fixed: on a page that was already open when the extension was installed or updated, a second floating button could appear on top of the first, which looked like a stray unread counter stuck behind the button.

No new permissions. Nothing changed about what is stored, what is sent, or which relays are used.