Recovery

Designating guardians and vouching for a recovery attempt are both just signed events — the same real window.nostr/NIP-07 flow as attesting. This page covers that half only. The other half — actually splitting your key into guardian shares and delivering them — has to happen inside a signer extension itself, never a web page, since that needs your raw private key, which NIP-07 never exposes here. See A018 for why, and what's not built yet.

1. Designate guardians

Signs one recovery_guardian claim per guardian, all sharing a fresh group ID — save that group ID, guardians and any future recovery attempt both need it.

Guardian npubs or hex pubkeys (one per line) Threshold (how many of them must confirm)

2. Confirm as a guardian

If you've been designated as a guardian and the owner has told you (out of band — a recovery attempt isn't itself published by anyone until a guardian confirms it) which group ID and recovery nonce to use, sign your confirmation here.

Owner's npub or hex pubkey Group ID Recovery nonce

Starting a recovery attempt? Generate a nonce here and give it to your guardians yourself — there's no separate "start recovery" event; the nonce is just the thing that ties everyone's confirmations to the same attempt.

3. Check recovery status

Looks up the real guardian set and real confirmations for one owner/group/nonce from real relays — the same check internal/recovery.ThresholdMet does in Go, ported directly, not re-derived.

Owner's npub or hex pubkey Group ID Recovery nonce

No signer loaded? check you have one first. This page never sees your private key — only window.nostr does, inside your own extension.