What am I actually signing?
This tool runs entirely in your browser. Nothing you type here is transmitted.
A signature costs no gas, appears in no block explorer and asks for no confirmation anyone can read - which is why one signed permission is now the shape most large wallet losses take.
The dangerous ones do not look dangerous
A transaction announces itself: a fee, a pending state, a line in your history. A signature does none of that. It is a string your wallet hands back to whoever asked, and the two requests that matter most - an ERC-2612 permit and a Permit2 allowance - are indistinguishable from a harmless login unless you read the fields. Both grant a named contract the right to move a named token out of your wallet, usually with no limit, often with no expiry, and always without another prompt. Paste the request here and it is decoded field by field, with the permission stated as a sentence rather than as JSON. It runs entirely in your browser, and the address you paste is never transmitted.
- Decoded here: the domain, the type, every field, and the exact type string that gets hashed.
- Stated plainly: which spender, over which token, at what limit, until when.
- Computed locally: the same digest your wallet signs, so a hardware screen can be checked against it.
Check the hash against the device, not the page that asked
A hardware wallet shows the digest it is about to sign. That number is the only thing the device actually commits to, and it is computed from the domain and the message together - so a request that swaps the contract, the chain or a single amount produces a different one. This page computes that digest the way the EIP defines it, which gives you something to compare the device against that did not come from the site making the request.
What it will not do
It does not sign, does not connect a wallet and cannot tell you whether the contract asking is honest. What it can tell you is exactly what you would be handing over, which is the part that is normally hidden.
- Never asked for: a private key, a seed phrase, or a wallet connection.
- Not claimed: that a recognised request is safe, or that an unrecognised one is dangerous.
- Not guessed: a payload whose type we do not know gets its fields and hashes, and no invented summary.
Questions
- Where do I get the payload to paste?
- Most wallets show the raw request behind a "details" or "data" toggle on the signature prompt, and a browser console shows it as the argument to eth_signTypedData_v4. Copy the whole JSON object, including its types and domain.
- Does anything I paste get sent anywhere?
- No. What you paste is never transmitted - parsing and hashing happen on your device. You can watch the network tab while you paste.
- The hash here does not match what my hardware wallet shows. What now?
- Do not sign. A mismatch means the request your device received is not the request you pasted, and the difference is somewhere in the domain, the chain id or the message. Close the prompt and start again from a page you navigated to yourself.