Napster revives peer file sharing using Nostr and Tor
- Napster deployed decentralized file sharing using Nostr relays for discovery and ephemeral Tor tunnels for transfers.
- Relays tightened NIP-42 authentication to prevent unauthorized downloading of encrypted inbox direct messages.
- Nostr clients and developer toolkits updated privacy controls, search indexing, and local cryptographic verification.
Peer-to-peer file sharing is back, minus the central servers.
In mid-September 2026, Napster unveiled a decentralized file-sharing architecture anchored entirely on the Nostr protocol. According to Nostr Compass, the system replaces central server indexes with cryptographic event logs. Users publish music catalog entries using event kind 30,421 tagged with file hashes, while broadcasting peer availability through kind 30,422 heartbeats every ten minutes.
"Nostr handles discovery; Tor handles the bytes."
- Nostr Compass
When two users agree on a transfer, they negotiate handshake terms through NIP-17 encrypted direct messages. The actual bytes bypass Nostr relays entirely, flowing across short-lived Tor version 3 onion tunnels created on demand for each transfer. The architecture leaves no persistent network footprint while tying individual user identities permanently to their cryptographic key pairs.
The shift toward decentralized file discovery is forcing relays to tighten access controls.
As noted on Nostr Compass, the Go-based relay Conduit recently patched its outbox authentication model to enforce strict NIP-42 checks. Private inbox messages are now restricted exclusively to the recipient key, stopping unauthorized relays from leaking encrypted data. In addition, updated relay search standards now issue dedicated tags when unauthenticated queries return truncated results, forcing clients to authenticate before accessing complete data sets.
"Infrastructure is moving past dumb relays toward hardened, authenticated endpoints."
- Nostr Compass
Hardened relay controls are already reshaping client applications across the ecosystem. Voca released versions 1.0 and 1.1.0 on the Nostr-native Zap Store, allowing GrapheneOS users to verify cryptographic signatures locally before reading long-form posts offline. Meanwhile, peer-to-peer exchange Mostro updated to version 0.18.5, defaulting to NIP-44 encryption for gift wraps and implementing pre-signature checks to block expensive validation attacks on its Cashu escrow system.
Developer infrastructure is maturing alongside these privacy upgrades. NDK resolved an entropy reconsolidation bug that previously spammed excess events across relays, while Amethyst integrated NIP-84 portable highlights and patched a shared key caching vulnerability. Across the board, protocol contributors are turning Nostr from a social feed into a resilient transport layer for arbitrary media and commerce.
Decentralization is no longer just about text messages.
Source Intelligence
- Deep dive into what was said in the episodes
Logbook Episode 38 • Sep 14
- Voca version 1.0 and 1.1.0 released as a GrapheneOS text-to-speech reader on Zap Store. It fetches and locally verifies Nostr URLs natively from relays, and allows users to queue npub long-form posts for offline reading.
- Nostream now supports NIP-89 application handler discovery and NIP-90 data vending machine jobs. Meanwhile, NDK resolved an entropy set reconsolidation bug that caused excess events and fixed a request collapse issue across different relays.
- Divine Mobile fixed private DM duplicate text collisions and added a dual deletion request to remove local storage events. Conduit hardened its NIP-42 authentication to ensure inbox DM events are only downloadable by the intended recipient.
- Amethyst version 1 integrated NIP-84 portable highlights to reference external or Nostr content. The update also adds NIP-29 group archiving and patches a shared key cache vulnerability that caused hash collisions.
- Mostro version 0.18.5 defaulted to NIP-44 encryption for gift wraps and added pre-signature checks on incoming events to mitigate expensive signature-validation attacks. It is also refining its two-out-of-three Cashu escrow system.
- Napster launched as a Nostr-based music sharing app, cataloging files using kind 30,421 and tracking online peers via kind 30,422 heartbeats. Transfers are negotiated via NIP-17 private DMs and routed through ephemeral Tor version 3 onion addresses.
- Recent NIP updates allow relays to signal that more filter results exist post-authentication. Additionally, the Nostr Wallet Connect specification clarified that the list transaction API must return actual transaction counts instead of raw database rows.
Also discussed on this episode: (4)
Nostr (4)
- The host transitioned the podcast from Riverside to a custom, native Nostr recording setup. Listeners can log in with their Nostr keys on the website to submit voice notes, which are then compiled into the weekly Wednesday episodes.
- Concord streamlined its relay permission flow to prevent connection request overload and introduced key backup discovery. The client also fixed Cashu proof backfill truncation and added search indexing for event titles and names.
- MDK optimized encrypted group chats by scanning admin events in a single member walk. Zap.cooking now restricts NIP-46 signer traffic to configured bunker relays, while Nostwort enabled device-wide decryption of NIP-17 gift wraps.
- NIP-18 mandates kind 6 events for kind 1 reposts, while other kinds must use kind 16 with a "k" tag. NIP-25 defines kind 7 reactions, requiring "+" for upvotes, "-" for downvotes, and custom emojis to avoid automated vote interpretation.