Keep is a FROST (Flexible Round-Optimized Schnorr Threshold Signatures) threshold signing app and dedicated Nostr event signer for Android. It allows users to hold FROST key shares on their phone and sign Nostr events without any single device ever holding the full private key. Keep implements the NIP-55 Android Signer protocol and NIP-46 remote signing, so any compatible Nostr client can request signatures directly.
Like Amber, Keep serves as a dedicated Nostr event signer that keeps private key material segregated from client apps. Both implement NIP-55 and NIP-46 with per-app permissions, background signing, and multiple account support. Keep goes further by splitting keys into FROST threshold shares (2-of-3, 3-of-5, etc.) so that no single device ever holds the complete private key.
- FROST threshold signing (2-of-3, 3-of-5, etc.)
- NIP-55 Android Signer protocol (intents + content provider)
- NIP-46 remote signing (bunker service)
- Import and export FROST shares via QR code or text
- Import existing nsec keys
- Multiple account support
- Per-app signing permissions and policies
- Signing history and audit log
- Biometric and PIN authentication
- Hardware-backed key storage (Android Keystore)
- Kill switch for emergency key deletion
- SOCKS proxy support (Tor)
- NIP-44 encryption and decryption
- Background signing with configurable rate limits
- Certificate pinning for relay connections
- Encrypted backup and restore
- Bitcoin wallet descriptor coordination (multisig)
Any Nostr client that supports NIP-55 or NIP-46 can use Keep for signing.
Supported NIP-55 operations: get_public_key, sign_event, nip04_encrypt, nip04_decrypt, nip44_encrypt, nip44_decrypt, decrypt_zap_event.
Exact toolchain versions are required. The build fails fast on any mismatch.
- Rust
1.89.0(pinned inkeep/rust-toolchain.toml, auto-selected by rustup) - Android NDK
29.0.14206865(install viasdkmanager "ndk;29.0.14206865") cargo-ndk4.1.2:cargo install --locked cargo-ndk --version 4.1.2- JDK 17
git clone https://github.com/privkeyio/keep keep
./gradlew assembleDebugAPK output: app/build/outputs/apk/debug/app-debug.apk. Gradle rebuilds the Rust libraries automatically when sources change. Set KEEP_REPO if the keep checkout lives elsewhere.
Run scripts/check-toolchain-pins.sh to verify pinned versions are consistent across build scripts and CI workflows.
GitHub issues and pull requests are welcome.
Translations are welcome. Seed locales (Portuguese (Brazil), Spanish, German, Japanese) live under app/src/main/res/values-<lang>[-r<REGION>]/strings.xml; store listings live under fastlane/metadata/android/<locale>/. A managed translation platform (Crowdin or Weblate) is on the backlog; until it lands, translations are contributed via pull request. See CONTRIBUTING.md for the full translator workflow. scripts/check-locale-drift.sh fails CI if a locale is missing any translatable key from the default values/strings.xml.
By contributing to this repository, you agree to license your work under the MIT license. Any work contributed where you are not the original author must contain its license header with the original author(s) and source.
MIT