Every Nostr key has a treasure: walk from the key until you hit a point with 20 zeros. Dig, and see how far you walk and how deep it goes.
Walks until it finds 20+ zeros, about a million steps. Runs in your browser in a few seconds.
A random key made in your browser. Paste any pubkey over it to see that key's treasure.
Private key (hex)
zeros
New personal best!
Treasure address (testnet4)
Treasure private key (hex) · spends from the chest
Private key (hex)
This page made this key just now and keeps it only in this tab. It's for testnet fun: anyone who sees these keys can spend from the chest. Copy them if you want to keep this treasure.
More details
Mainnet address
Treasure pubkey (hex)
Proof
Testnet first. Ordinary wallets won't recognise these addresses, and there is no spending tool yet. Anyone can find a key's spot from its pubkey, so it is public. How it works →
How it works
A treasure hunt where every key already has its treasure buried, everyone has the same map, and only the key's owner can dig it up.
1. Every key has a walk
A Nostr public key is a point P on the secp256k1 curve. Add the curve's generator point G to it, again and again, and you get a fixed sequence of new points:
PP+GP+2GP+3G…P+965551G…P+2²⁰G
Each step is one point addition, so anyone holding just your pubkey can walk it. No private key is involved and nothing has to be published first. The walk is the same for everyone who looks.
2. Some points are deeper than others
Each point has an x-coordinate, a 256-bit number. Its depth is how many zero bits it starts with. Depth behaves like a coin toss: about half of all points have at least one leading zero, a quarter have two, and only one in a million has twenty.
depth
how often
hex starts
address starts
8
1 in 256
00…
tb1pq…
16
1 in 65,536
0000…
tb1pqqq…
20
1 in ~1 million
00000…
tb1pqqqq…
32
1 in ~4 billion
00000000…
tb1pqqqqqq…
In an address, every q after tb1p is five zero bits. In hex, every 0 is four.
3. Your spot is the first point with 20 zeros
Walk from P, one step at a time, until you reach a point whose x-coordinate starts with at least 20 zero bits. That point is your treasure spot. Every treasure is 20 zeros or deeper. What varies is how far you walk: about a million steps on average, sometimes only a few thousand, occasionally several million. The walker on the map moves at the real pace of the search.
P = lift_x(pubkey) even-y point, as in BIP340
spot = P + i·G the first i with 20+ leading zero bits
proof = pubkey,20,i
Sometimes the treasure overshoots 20, and each extra zero is half as likely:
treasure depth
share of treasures
20
1 in 2
a fair find
21
1 in 4
a fine find
22–24
~1 in 5
a rare find
25 or more
1 in 32
a legendary find
4. Anyone can find it, only you can spend it
The private key for P + i·G is simply your private key plus i. The step number i is public, but it's useless without your private key. So anyone can work out where your treasure is, send testnet coins there for fun, or show it on a leaderboard, and only you can open it. Coins sent to someone's spot are a treasure payment: no invoice, no address to ask for, just their pubkey and a walk.
spot secret = privkey + i (mod n, negated if needed for even y)
5. Addresses with visible zeros
The spot becomes a taproot address by using its x-coordinate directly as the output key. Normal wallets first add a hidden tweak (BIP86), which would scramble the zeros; skipping it keeps them visible, so the address itself starts tb1pqqqq…. The cost is that ordinary wallets won't show or spend these coins; a dedicated sweep tool will.
6. Checking a spot
Given a proof pubkey,20,i, anyone can confirm the spot with one multiplication and one addition: compute P + i·G and count its zeros. Confirming it's the first such point means walking all the steps before it, which is exactly what this page does in a few seconds.
7. Things to know
It's public. Your spot is linked to your pubkey by design. It's a public tip jar, not a private address.
Guard the spot key like your private key. If privkey + i ever leaks, anyone can subtract the public i and recover your main private key.
Testnet first. Mainnet addresses are shown as a curiosity. Don't send real coins until there's a tool to spend them.