Napster launches decentralized peer sharing on Nostr
- Napster is back as a decentralized file-sharing app built on Nostr relays.
- Users trade music over ephemeral Tor connections negotiated through encrypted Nostr messages.
- Relays are adding strict authentication to prevent unauthorized servers from reading private messages.
Napster is trading files again.
In September 2026, a new implementation of the iconic music platform launched on top of open Nostr relays, removing the need for central servers or persistent indexers. As reported on Nostr Compass, the system relies on cryptographic public keys for user identities and open relays for catalog discovery. Users publish catalog events tagged with file hashes and broadcast ten-minute availability heartbeats to signal when files are online.
When two peers agree to trade a track, they negotiate transfer terms over NIP-17 encrypted direct messages. The actual file delivery happens entirely off the relay network. Napster generates an ephemeral Tor version 3 onion connection on demand for each specific handshake, sending the bytes directly between peers before closing the address.
"Nostr handles discovery; Tor handles the bytes."
- Nostr Compass
The return of peer-to-peer file trading coincides with a broader infrastructure push toward stricter data privacy. As detailed on Nostr Compass, Go-based relay Conduit recently patched its outbox authentication model under NIP-42. Private inbox messages are now restricted strictly to recipient keys, stopping unauthorized relays from downloading and serving private user messages.
"Infrastructure is moving past dumb relays toward hardened, authenticated endpoints."
- Nostr Compass
Client applications are aligning with these hardened relay standards by executing security checks locally. On Nostr Compass, updates highlighted Voca, an offline text-to-speech reader for GrapheneOS, which verifies cryptographic signatures on-device before reading posts queued from relays. At the same time, peer-to-peer Bitcoin exchange Mostro adopted NIP-44 encryption by default and added pre-signature checks to defend relays against validation attacks.
These developments signal a fundamental shift in how open protocols handle bandwidth and privacy. By pairing lightweight relay indexing with temporary Tor channels, developers are reviving peer-to-peer distribution without relying on vulnerable central coordinators.
The centralized index is dead. The protocol carries on.
Source Intelligence
- Deep dive into what was said in the episodes
Logbook Episode 38 • Sep 14
- Voca version 1.0 and 1.1.0 released as a GrapheneOS text-to-speech reader on Zap Store. It fetches and locally verifies Nostr URLs natively from relays, and allows users to queue npub long-form posts for offline reading.
- Divine Mobile fixed private DM duplicate text collisions and added a dual deletion request to remove local storage events. Conduit hardened its NIP-42 authentication to ensure inbox DM events are only downloadable by the intended recipient.
- Mostro version 0.18.5 defaulted to NIP-44 encryption for gift wraps and added pre-signature checks on incoming events to mitigate expensive signature-validation attacks. It is also refining its two-out-of-three Cashu escrow system.
- Napster launched as a Nostr-based music sharing app, cataloging files using kind 30,421 and tracking online peers via kind 30,422 heartbeats. Transfers are negotiated via NIP-17 private DMs and routed through ephemeral Tor version 3 onion addresses.
Also discussed on this episode: (7)
Nostr (7)
- The host transitioned the podcast from Riverside to a custom, native Nostr recording setup. Listeners can log in with their Nostr keys on the website to submit voice notes, which are then compiled into the weekly Wednesday episodes.
- Nostream now supports NIP-89 application handler discovery and NIP-90 data vending machine jobs. Meanwhile, NDK resolved an entropy set reconsolidation bug that caused excess events and fixed a request collapse issue across different relays.
- Amethyst version 1 integrated NIP-84 portable highlights to reference external or Nostr content. The update also adds NIP-29 group archiving and patches a shared key cache vulnerability that caused hash collisions.
- Concord streamlined its relay permission flow to prevent connection request overload and introduced key backup discovery. The client also fixed Cashu proof backfill truncation and added search indexing for event titles and names.
- MDK optimized encrypted group chats by scanning admin events in a single member walk. Zap.cooking now restricts NIP-46 signer traffic to configured bunker relays, while Nostwort enabled device-wide decryption of NIP-17 gift wraps.
- Recent NIP updates allow relays to signal that more filter results exist post-authentication. Additionally, the Nostr Wallet Connect specification clarified that the list transaction API must return actual transaction counts instead of raw database rows.
- NIP-18 mandates kind 6 events for kind 1 reposts, while other kinds must use kind 16 with a "k" tag. NIP-25 defines kind 7 reactions, requiring "+" for upvotes, "-" for downvotes, and custom emojis to avoid automated vote interpretation.