Your Nostr identity key never touches a browser or a phone's general-purpose OS. Three devices, one family, one 12-word seed — pick the tradeoff that fits how you sign: plugged in for daily posting, camera-only for real air-gapping, or radio-free for the key you almost never touch.
ONE OF THREE LIVE TODAYAll three devices derive your Nostr key the same standard way — NIP-06: a 12-word BIP-39 mnemonic, hardened-derived to your nsec/npub. Write the words down once, restore on any VibeSigner (or any NIP-06-compatible signer) later. The mnemonic is the backup; a PIN still gates the key at rest on the device itself.
More air gap generally means slower, clunkier signing — that trade is deliberate. Use the fast one daily, keep the slow one for the key you can't afford to lose.
Plugs into your computer or phone over USB. Sign requests arrive over serial (WebSerial in the browser, or the LNbits-NSD-compatible protocol for any host app); a physical button on the device approves or rejects. Key is AES-GCM encrypted at rest behind a PIN entered on boot.
No cable during signing. Events arrive as a QR code shown on a phone or laptop screen and scanned by the onboard camera; the signature goes back out the same way, as a QR the host reads. No USB, no WiFi, no Bluetooth active while signing.
A signing OS image for standard SeedSigner hardware — swap the SD card to flip a SeedSigner between its normal Bitcoin role and Nostr signing. The Pi Zero 1.3 has no WiFi or Bluetooth radio at all, at the silicon level — the strongest "air-gapped" claim of the three.