Zapstore

The open app store powered by your social network

Download 1.1.2 for Android: https://zapstore.dev/

SHA-256 checksum: 29b7aae256ef567e466c30fac13b8a7794d84a79862162d69f029f61c2ce5dd2

APK certificate hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Support: https://zapstore.dev/community/forum

Nostr DMs will be ignored, tag us instead.

Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

NIP-05 Address

zapstore.dev

Profile Code

nprofile1qqs83nn04fezvsu89p8xg7axjwye2u67errat3dx2um725fs7qnrqlgpp4mhxue69uhkummn9ekx7mqpz4mhxue69uhhyetvv9ujumn0wd68ytnwv46q03w9mr

Publishing to

Author Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

Show more details

Published at

2026-09-04T17:40:45Z

Kind type

0 Metadata

Event JSON

{ "id": "d20a3ec624c8920f13d21ab5e1b1ca697d55bcddd41760801ab602607fbf0da1", "pubkey": "78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d", "created_at": 1788543645, "kind": 0, "tags": [ [ "alt", "User profile for Zapstore" ], [ "name", "Zapstore" ], [ "display_name", "Zapstore" ], [ "picture", "https://image.nostr.build/a45cd91548e9d6e587da80b43ad7d3686898b9a10bb710f8b820aaae28020bd0.jpg" ], [ "banner", "https://image.nostr.build/811fe63bac01e01fee170b8023328211cb9d8b4ea012f6e490f1206e257bfb09.jpg" ], [ "website", "https://zapstore.dev/" ], [ "about", "The open app store powered by your social network\n\nDownload 1.1.2 for Android: https://zapstore.dev/\n\nSHA-256 checksum: 29b7aae256ef567e466c30fac13b8a7794d84a79862162d69f029f61c2ce5dd2\n\nAPK certificate hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320\n\nSupport: https://zapstore.dev/community/forum\n\nNostr DMs will be ignored, tag us instead." ], [ "nip05", "[email protected]" ], [ "lud16", "[email protected]" ], [ "client", "Amethyst" ] ], "content": "{\"name\":\"Zapstore\",\"picture\":\"https://image.nostr.build/a45cd91548e9d6e587da80b43ad7d3686898b9a10bb710f8b820aaae28020bd0.jpg\",\"banner\":\"https://image.nostr.build/811fe63bac01e01fee170b8023328211cb9d8b4ea012f6e490f1206e257bfb09.jpg\",\"about\":\"The open app store powered by your social network\\n\\nDownload 1.1.2 for Android: https://zapstore.dev/\\n\\nSHA-256 checksum: 29b7aae256ef567e466c30fac13b8a7794d84a79862162d69f029f61c2ce5dd2\\n\\nAPK certificate hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320\\n\\nSupport: https://zapstore.dev/community/forum\\n\\nNostr DMs will be ignored, tag us instead.\",\"website\":\"https://zapstore.dev/\",\"display_name\":\"Zapstore\",\"nip05\":\"[email protected]\",\"lud16\":\"[email protected]\",\"displayName\":\"Zapstore\"}", "sig": "4b71fbe3fe59bb6891514c427572ee2d8cf552d78093787c4e57973c49c0224d9be5ebded9fbfe7e42228182e708b4a55ecbf1d2f105910940fc389e6ffb001a" }

Last Notes

2026-09-04 17:39:37 UTC

🚨 Please update to Zapstore 1.1.2
It was released last week and contains a fix for a major security bug found in an underlying library, related to nostr event verification.
I don't believe it has been exploited as apps are loaded primarily from relay.zapstore.dev (which properly verifies nostr events) and we haven't heard of any report.
Found by ethicnology, thank you Sir (couldn't find his nostr profile, he deserves some zaps!)
https://github.com/zapstore/zapstore

2026-08-28 20:29:19 UTC

Thank y'all for the kind words but also for the bug reports.
I hear you and know many things are suboptimal.
We are designing Zapstore v2 (mainly a new indexer with hard lessons learned, revamped zsp and a new mobile app)
I won't spill the beans yet but I'm excited. Everything starting to make much more sense.

2026-08-19 14:54:20 UTC

- reply

Thank you for your words! And your em-dashes

2026-08-18 17:10:29 UTC

- reply

Yes. Everybody should be moving to #GrapheneOS
On stock Android there is a way, though annoying, to bypass this check.

2026-08-12 13:03:07 UTC

- reply

Which app?
Are you suggesting it should be taken down?

2026-08-11 21:52:03 UTC

Starting to push Zapstore repos to ngit, finally!
https://gitworkshop.dev/npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8/relay.ngit.dev/zapstore

2026-08-10 23:11:41 UTC

- reply

Good point, and true there are few reproducible apps.
Would be nice to tag a version (as per Software Applications NIP) against which the latest analysis was run, rather than a git commit.
These reports also contribute to reputation to the keystore/certificate signing the APK so they help anyway.

2026-08-10 16:32:29 UTC

If we can figure this out and link to a specific APK hash, I will implement this
#nevent1q…z259

2026-08-10 16:29:26 UTC

- reply

Is there an existing NIP we could use for it?

2026-08-10 16:17:17 UTC

- reply

Definitely interesting. Maybe self-identified "red teams" though, followed/allowed by users, in order not to overwhelm?

2026-08-05 00:02:35 UTC

- reply

It probably won't be available in cucked devices

2026-08-04 21:39:03 UTC

🎯
https://blossom.primal.net/6ce0bb53b832e5d43825090e59fe95ebbdf291508ad799feec9bfb63a5d39b46.jpg

2026-08-03 20:51:58 UTC

Seeing more Certificate Mismatch errors?
Deployed an upgrade to the indexer.
As we deprioritize F-Droid signed releases in favor of developer-signed (as it should be) you may find some new Certificate Mismatch errors.
To keep updating those apps you'll need to reinstall them. Unfortunately there is no other way. (If you have multiple profiles on your device, ensure to remove app from all of them!)
Apologies for the inconvenience, but it's the right move to minimize certificate mismatches in the future!

2026-08-03 20:46:19 UTC

@nprofile…qc9f try again

2026-07-29 19:02:01 UTC

Someone is constantly releasing updates to an app.
It's cool too see how frictionless app publishing can be, on the other hand they live in Latest Releases which takes space away from other projects.
We're going to move away from this dumb REQ approach and work on a smarter feed for discovering new stuff.

2026-07-28 12:39:17 UTC

- reply

Great!

2026-07-27 22:05:29 UTC

- reply

@nprofile…gnen I found the issue. You are not bumping the version code, so Android thinks it's the same version. "1.5.0" means nothing, it's the 2001 that counts.
We may put a guard for this in zsp in the future, but this is standard Android dev.

2026-07-25 21:04:05 UTC

- reply

Yes definitely weird. Will try with 1.4.1 -> 1.5.0

2026-07-25 21:02:53 UTC

- reply

No Google please, hold your keys

2026-07-24 18:43:13 UTC

- reply

I was unable to reproduce but fed the issue to the agent to create a potential fix, curious does this happen with just this app or others? Screenshots?

2026-07-24 16:21:46 UTC

Amazing charts of apps on Zapstore!
https://dev.nostrolo.gy/zapstore

2026-07-24 15:05:20 UTC

- reply

Or maybe a post-install action we can trigger for Amber users? @nprofile…xcpk

2026-07-24 15:03:34 UTC

- reply

Love this idea but it's on the app developer and Amber side.
Zapstore can help with app stacks, unfortunately can't avoid per-app install confirmations enforced by the OS.
Having a one-tap install experience would be wonderful, including a "restore my apps" on a new device just with a Nostr sign in.

2026-07-24 14:57:48 UTC

GM developers
When publishing, don't skip linking your Android keystore/cert to your Nostr identity!
(We need to know that you actually own the app)
Soon, apps without it will show as unclaimed, as any other indexed app regardless of who published the app metadata.

2026-07-24 14:49:26 UTC

- reply

Are you publishing PosterChan nonstop every few hours? It's not wrong but it's always present in latest releases

2026-07-23 20:46:30 UTC

- reply

Done

2026-07-23 19:56:24 UTC

- reply

Thanks. That is a different error. Sorry I should make this more clear in the UI.
What version are you on? Have you installed those apps via another store?
You can now swipe left on those apps to unmanage (prevent Zapstore from checking for updates)

2026-07-23 19:54:28 UTC

- reply

#nevent1q…d0fd

2026-07-23 19:52:15 UTC

- reply

I can't reproduce the error with any of those. It also doesn't make sense as there is no C1 proof for indexed apps (obviously)
Can you share screenshots when that happens?

2026-07-23 19:41:06 UTC

- reply

Unfortunately the publisher signature is broken, I will reach out for them to re-sign

2026-07-20 19:46:46 UTC

🚀 zsp release 0.4.14 :
- Fix bad name and icon extraction regression
- Fix Gitlab parser download path
- Add fastlane as metadata source
- Add Tor fallback for failing requests, retries
- Add default image compression
https://github.com/zapstore/zsp

2026-07-18 14:39:29 UTC

- reply

Sorry, it opens a can of worms and I have many other things to do. It is literally the first time someone asks for wearos

2026-07-18 14:38:01 UTC

- reply

I would like it too, but that will have to wait. I don't have time or even those devices to test with

2026-07-17 22:55:10 UTC

- reply

Against known certs

2026-07-17 21:11:47 UTC

NEW FEATURES
- Background auto updates (opt in)
- Check certificate ownership before installation
- Back up settings, bookmarks, and more to a device key
- Ability to exclude apps from updates
- NIP-56 reporting
- Shareable app dagnostics
- Efficient image loading
#nevent1q…2732

2026-07-17 21:06:15 UTC

Who wanted to exclude apps from updates on Zapstore?
You can now "unmanage" apps by swiping left on it
https://blossom.primal.net/a16222a238744edd955b64f37220ffab498cb202d008ea662ca40d7a918e9ce9.jpg
#nevent1q…2732

2026-07-17 20:57:07 UTC

Also released new zsp and fixed several issues with apps stuck in the indexer.
Brave, Ironfox, Aurora Store, Flow and others are back!

2026-07-17 20:55:34 UTC

Implemented on the fly image compression for icons, profile pictures and screenshots.
For some images gains are slight and for others up to 30x
Live on the website and on latest zapstore 1.1.0, it should feel way faster!

2026-07-17 20:46:01 UTC

🥏 Zapstore 1.1.0 just dropped
New features and lots of fixes!
https://zapstore.dev/apps/dev.zapstore.app
Update from the app or download at zapstore.dev

2026-07-15 15:33:14 UTC

- reply

Yeah I always liked the language but used Flutter because of my previous experience with it. It's great too but the situation with coding agents now is different.

2026-07-15 15:27:50 UTC

Over the past week I have also been working on a completely new codebase for the Zapstore app, in pure Kotlin.
(A recurrent issue with the current Flutter app is the boilerplate/overhead to interact with native features.)
Things require less code and feel significantly faster, but to be fair it has 10% of the features so far. Promising option for Zapstore v2.

2026-07-15 15:05:14 UTC

- reply

Which main list? Are you currently having an issue?

2026-07-14 14:20:35 UTC

- reply

Let me know if you need help. Two options now:
- publishing from your CI as usual (full control but more involved)
- link your npub to android certificate (NIP-C1 via zsp), and let us take care of pushing updates (one event)

2026-07-14 14:16:28 UTC

- reply

2026-07-14 01:20:29 UTC

- reply

Trust is placed on the FoggedLens github user

2026-07-13 18:26:54 UTC

- reply

This kind of indexing is non trivial to set up and manage. It will probably become a feature for supporters only in the future

2026-07-13 18:06:00 UTC

Great to see an increasing number of nostr-signed apps on the relay!
We also slowly keep adding more indexed apps and will soon re-enable the ability for anyone to add.
In parallel working on lots of code for the new product vision of Zapstore v2, can't wait to share more.
On the app side, ironing out last bugs for a new release. This week we'll have 1.1.0 if all goes well.

2026-07-12 01:56:34 UTC

- reply

Which error? Tell me more

2026-07-12 01:54:25 UTC

- reply

I need a link to the APK

2026-07-10 00:20:06 UTC

- reply

This is not correct, the proximity with the source is exactly the same. Obtainium and Zapstore both pull the APKs from the exact same place.

2026-07-10 00:18:58 UTC

- reply

I am not angry. You are angry. Good luck!

2026-07-09 19:49:09 UTC

- reply

How about asking for help instead?
All apps on Zapstore are available "on a website" if you fetch the relay events

2026-07-09 16:56:27 UTC

- reply

I'll have a look!

2026-07-09 00:40:48 UTC

- reply

Thank you for recommending it!

2026-07-08 16:10:51 UTC

I've been silent lately, very busy cookin' the next gen of Zapstore.
Major building blocks to something that makes even more sense in the world of Android apps, and among many other things making it even simpler for developers to publish.
More soon!

2026-07-08 16:07:11 UTC

Radar indexed on Zapstore!
https://zapstore.dev/apps/com.radarlabs.radar
#nevent1q…4xpk

2026-07-08 15:53:16 UTC

- reply

We need Radar on Zapstore! @nprofile…ws96

2026-07-06 16:09:13 UTC

- reply

Download latest from zapstore.dev 🙏

2026-07-03 21:47:06 UTC

- reply

Please confirm which version or send screenshot, 0.1.7 not latest

2026-06-22 14:14:34 UTC

- reply

Done

2026-06-21 23:01:16 UTC

Publishing your app to Accrescent in two simple steps:
1) Login with Github exclusively
2) Figure that it's invite only
🤡
https://blossom.primal.net/ba00f92cfd88e8853ce081fb2a02ac070b69259825046cc2a49677efc1549649.png
https://blossom.primal.net/19b91577be2bcdfb4c625c9d0afda189a7318b7628e22e353609767cc86ae0fb.png

2026-06-19 16:58:22 UTC

- reply

See the docs on our website

2026-06-18 11:47:09 UTC

- reply

You don't need to. Please read the documentation and use the latest zsp 0.4.11

2026-06-11 23:17:30 UTC

- reply

Yes, working on it

2026-06-09 18:31:51 UTC

- reply

Send a delete request or sign in to your Studio and delete there

2026-06-04 15:57:45 UTC

- reply

Could you share them at zapstore.dev/community/forum ?

2026-06-03 15:32:41 UTC

- reply

What should I do?

2026-06-03 15:30:54 UTC

- reply

Yes, that's coming

2026-05-27 19:11:31 UTC

- reply

@npub1c9d…sqfm would you know?

2026-05-27 19:05:14 UTC

Thinking of discontinuing the indexer and just keep developer-signed apps (as every other Nostr client)
#nevent1q…glvc

2026-05-27 19:02:45 UTC

Signal started marking their releases as "pre-release" on Github: https://github.com/signalapp/Signal-Android/releases
Reason why those are not showing up as latest on Zapstore.
We used to fetch pre-releases, at that time a Termux pre-release screwed up lots of setups.
Pulling pre-releases then needs to be evaluated on a per-project basis, this is hard.

2026-05-27 18:32:05 UTC

👀
https://image.nostr.build/183d5c72994c58cc6550ff8f38c872f4e986aa2f438c4c637161b52995d4ed67.png

2026-05-27 18:30:36 UTC

- reply

https://image.nostr.build/694cb313e8f6f46c0b75ca5f28f4e5ebd95865a689750cffab86c1315e180d3b.png

2026-05-24 18:08:23 UTC

Current estimate of active Android smartphone users worldwide: 3.9 billion
About 5 million use custom ROMs (LineageOS, GrapheneOS, crDroid and others)
That is 0.13%
🤯

2026-05-24 17:40:27 UTC

Dear @npub1235…0ht5, does an app store where users choose their curators (essential for censorship-resistance) violate your security model? 👀
> App stores are supposed to be a single source of apps. You should look at the device management APIs where app stores must be a single source of apps in order to be permitted when disallowing unknown app sources and only permitting first party or specific known app sources.
https://discuss.grapheneos.org/d/26788-why-does-an-app-store-using-multiple-sources-violate-the-security-model/3

2026-05-24 17:31:35 UTC

- reply

@npub1dd9…xe7p wen signing your own releases on Zapstore? 😉

2026-05-21 19:44:25 UTC

https://zapstore.dev/apps/app.bro.mobile
#nevent1q…wga3

2026-05-21 19:43:57 UTC

- reply

It's here

2026-05-21 19:43:36 UTC

On Zapstore now!
(They will be self-publishing soon 🤞)
#nevent1q…56nc

2026-05-21 16:13:56 UTC

- reply

Absolutely, let's get in touch

2026-05-20 16:18:37 UTC

- reply

Welcome 👋
We are an Android app store built on nostr and bitcoin

2026-05-20 15:54:52 UTC

- reply

Thank you again 💜

2026-05-19 14:51:07 UTC

- reply

You can choose not to update?
Otherwise older releases UI will come soon, yes

2026-05-18 14:11:39 UTC

- reply

We sent them an e-mail to cosign the open letter and never got back to us, or included us

2026-05-16 21:52:07 UTC

- reply

You are on a very old version. Please go to zapstore.dev and download the latest

2026-05-15 21:05:19 UTC

- reply

2026-05-15 20:58:56 UTC

🙃
https://image.nostr.build/85ba53da8b694c0b598bb24c4a1e6294d5f869bb644049673362f24eb6f23c7f.png

2026-05-15 17:31:02 UTC

- reply

Moderation is less clickbaity than censorship 😂
Yes I agree

2026-05-15 16:22:02 UTC

- reply

When Epstein wants to publish an app on my relay

2026-05-15 16:12:14 UTC

Censorship is fine, even necessary.
The problem is when that is a monopoly - both in theory and in practice. And this problem has shades of grey.
Apple/Google having unique app stores as centralized chokepoints and telling you to quit their ecosystems if they ban an app is a problem, because there is no credible exit. For some that exit is acceptable, not for me.

2026-05-14 19:59:37 UTC

- reply

Fixed since this morning

2026-05-14 19:58:14 UTC

- reply

If there "should be" then someone has to do the work to run it, right?
This is not your typical relay, it's built specifically for communities that require strong curation (of apps in this case). Developers were having an issue related to whitelisting that needed an important refactor, which caused the downtime.
Running a second relay in another continent is definitely in the medium-term plans.

2026-05-14 14:04:54 UTC

- reply

Yes, we gave the relay activated charcoal and it's contained so far 🤞

2026-05-14 14:03:13 UTC

- reply

You're not entitled to any relay, just saying

2026-05-14 04:27:33 UTC

- reply

Congratulations! 🫂

2026-05-13 14:08:20 UTC

We're having backend issues since last night, and working on it

2026-05-13 13:45:56 UTC

- reply

Yes, trying to fix

2026-05-13 13:45:34 UTC

- reply

Yes, trying to fix

2026-05-12 12:47:58 UTC

- reply

It's a protocol issue because signers can't possibly inform what is supposed to be decrypted (not even the kind, apparently). A malicious app could tell you it's for "encrypted settings" or whatever, and instead use it to pull your nutzaps and rug you.
DMs are just one kind of thing that can be encrypted. Obviously allowing all makes that even worse.

2026-05-12 12:17:54 UTC

Nostr signer UX for decryption is broken and should be used minimally and carefully.
Redesigning parts of the Zapstore app such that there is one single request for decryption, by delegating to a device key. It also has nice UX side effects.
Funds (NWC strings and eventual seed phrases) will not be tied to any Nostr key.