Amber holds your nsec. It will sign things for other apps, so they never need to know your nsec. For instance Amethyst has a "login with Amber" button. I click it, approve Amethyst, and off I go.