Alby
getAlby
Data verified on unchanged since the sources
Worth it if you want a full Lightning and Nostr ecosystem: Alby Hub, browser extension and mobile with Nostr Wallet Connect and automatic on-chain swaps, self-hostable.
Avoid it if you're after a simple wallet: the breadth of the ecosystem is complex and the managed cloud version requires an account and is paid.
Alby is an open-source Lightning ecosystem built by getAlby, not a single product. At its centre is Alby Hub, a self-custodial Lightning wallet/node that can run in the cloud (always online) or be self-hosted on your own server, VPS or via Docker; around it are the Alby Extension for the browser and Alby Go for mobile. Together they cover Lightning with a lightning address (an email-like address to receive), automatic swaps to on-chain (via Boltz) and deep Nostr integration through Nostr Wallet Connect (NWC), which lets you connect third-party apps to your node with configurable permissions and spending budgets. The model is freemium: the software is open-source and free, while the cloud-managed Alby Hub version is paid. Alby Hub's code is released under the Apache 2.0 licence.
Data & conditions
| Fund custody | Self-custody (funds in your control) |
|---|---|
| Type | Software (hot wallet) |
| Source code | Open-source |
| Recovery | Seed self-custodial di Alby Hub (backup delle chiavi del nodo) |
| Bitcoin-only | Yes |
| Supported chains | Bitcoin, Lightning Network |
| Built-in swap | No |
| Built-in staking | No |
| dApp browser | No |
| WalletConnect | No |
| Segment | B2C |
| MiCA / License status | Nessuna (wallet self-custody non-custodial) |
Strengths
- Complete Lightning + Nostr + browser ecosystem (Alby Hub, Extension, Go); lightning address, automatic on-chain swaps and Nostr Wallet Connect to link third-party apps with configurable budgets; open-source and self-hostable.
- Self-custody: funds stay in your wallet — the platform cannot touch them.
- No KYC: usable without identity verification.
- Open-source, verifiable code.
- Self-hostable: you can run your own instance or node.
Weaknesses
- The managed cloud version requires an account and is paid (freemium); the breadth of the ecosystem can feel complex for those who just want a simple wallet; for maximum sovereignty it must be self-hosted.
- No notable sovereignty drawback documented.
Verdict
Score 4.2/5, very strong profile. In its favour: complete Lightning + Nostr + browser ecosystem (Alby Hub, Extension, Go); lightning address, automatic on-chain swaps and Nostr Wallet Connect to link third-party apps with configurable budgets; open-source and self-hostable. The trade-off to weigh: the managed cloud version requires an account and is paid (freemium); the breadth of the ecosystem can feel complex for those who just want a simple wallet; for maximum sovereignty it must be self-hosted.
On the Sovereignty lens the score is 4.2/5 (very strong): the strength is fund control (5.0/5), while privacy & anonymity (2.8/5) is the weak link.
Promp's editorial rating based on real fees and net annual cost. Promp reviews third-party products independently.
"Sovereignty" rating: score computed on privacy/anonymity (30%), fund control (20%), censorship resistance (20%), trustless/auditability (20%) and costs (10%). Same data, different weights.
Reputation
What happened to people who used Alby, and what users say. External signals: they do not feed the promp.it rating.
Incidents & regulatory actions
Notable incidentsDocumented events with consequences still open. Each entry carries a source and a date.
-
Hack / funds theft Severe ● open
Critical vulnerability confirmed in Alby Hub v1.7.0–v1.18.5: an attacker could reach the management API and move funds. One user impacted
This is not a break-in at the company's servers: Alby Hub is self-custodial and runs on the user's own machine. On 9 September 2026 getAlby publicly confirmed a critical vulnerability in Hub versions v1.7.0–v1.18.5 (releases prior to August 2025) when the management interface is reachable from the internet: in the company's words, «the vulnerability could allow an attacker who could reach the Hub's management API to gain unauthorized access and send funds». Versions from v1.19.0 (29 August 2025) onwards are unaffected: the flaw had in fact been closed for over a year, but anyone who does not update stays exposed. Alby states that, to its knowledge, «one user has been impacted and thankfully reported these details»: the company has NOT quantified any loss and did not say whether that user lost money. Technical details are deliberately withheld («we will publish full details at a later date, following responsible disclosure practices»), there is no public CVE identifier, and the company thanks Bitcoin Team Red, Project Loupe and other researchers for issues fixed in the latest release. No compensation has been announced, because no loss has been quantified.
↗ source
verified on
FAQ
Is Alby custodial?
No. Alby Hub is a self-custodial Lightning wallet: you keep control of your keys. It can run in getAlby's managed cloud or be self-hosted on your own server, VPS or via Docker for maximum sovereignty (source: getAlby's official repository, August 2026).
Which products make up Alby?
Alby is an ecosystem: Alby Hub is the self-custodial Lightning wallet/node (cloud or self-hosted), the Alby Extension is the browser extension and Alby Go is the mobile app. Together they handle Lightning payments, lightning addresses and Nostr integration.
How much does Alby cost?
The model is freemium: the software is open-source (Apache 2.0 licence) and free, while the cloud-managed Alby Hub version, which stays always online, is paid (source: getAlby's official site, August 2026).
Sources
- Official service page Prodotti hub extension go · Freemium · Account · Url ufficiale Data verified on Aug 3, 2026
- github.com Azienda · Self custody · Licenza apache 2.0 · Nostr · +3 Data verified on Aug 3, 2026