Wallet Signature Checker
Fake airdrop checkers and claim pages do not steal your seed phrase; they get you to sign one request that hands your tokens over. Paste what your wallet is asking you to sign, or type the name it shows, and see in plain words who gets what, how much and until when - before you press Confirm.
What is this wallet request asking for?
Paste the request's data, the typed message, or just the name your wallet shows at the top. It says what signing lets happen, to whom, how much and for how long. Nothing you paste leaves this page.
Most wallets show the raw data under a Data, Hex or View raw tab of the request. Typed messages are JSON; transactions start with 0x and eight characters naming the function.
Try an examplePaste a request, or pick an example.
This reads the request's own words; it cannot see whether the address on the other end is honest. A request it marks safe on a fake site is still on a fake site: check the address bar first.
What a real claim asks for, and what a drainer asks for
Claiming an airdrop is a transaction that sends tokens to you: a claim call naming your address, sometimes after a sign-in message. It never needs you to approve, permit or list anything. Wallet drainers took about $494 million from 332,000 addresses in 2024, and in the large cases the signature used was a Permit 56.7% of the time and a setOwner 31.9% (Scam Sniffer, 2024 report). Blind signing and airdrop claim drainers tells the story of how they work; this page is for the moment the request is in front of you.
| The wallet shows | What signing lets happen | On a claim page |
|---|---|---|
| Sign-in message ("wants you to sign in with your Ethereum account") | Logs you in; proves you own the address (EIP-4361) | Fine, if the domain is the site in your address bar |
| claim(...) | Sends tokens to the address named | What you expect |
| approve / increaseAllowance | A spender can take that token, up to the amount, until you revoke (ERC-20) | Never needed |
| setApprovalForAll | An operator can move every NFT you hold in that collection (ERC-721) | Never needed |
| Permit (a typed message) | The same as approve, with no gas and nothing on-chain until the spender uses it (EIP-2612) | A drainer |
| PermitSingle, PermitBatch, PermitTransferFrom | An allowance or a one-off transfer through Uniswap's Permit2 contract (Permit2) | A drainer |
| OrderComponents | A marketplace listing: whoever fills it gets your items for the price in it (Seaport) | A drainer, usually priced at nothing |
| setOwner / transferOwnership | Hands a contract, such as a smart wallet or vault, to a new owner | A drainer |
| A string of 64 hex characters and nothing else | Blind signing: the bytes can stand for anything | Never sign |
How to read the request in your wallet
A transaction carries data that starts with 0x and eight hex characters, the function selector: the first four bytes of the keccak-256 hash of the function's name and argument types. 0x095ea7b3 is always approve(address,uint256), 0xa22cb465 always setApprovalForAll(address,bool), whatever the site calls the button. The checker knows the ones that matter for airdrop farmers and reads their arguments; for any other, 4byte.directory looks the selector up. A typed message (EIP-712) is JSON with a primaryType, the domain it is for (name, chain, contract) and the message fields; paste it whole. Most wallets can show either under a tab named Data, Hex or View raw. If yours cannot, type the name it shows at the top of the request.
Amounts are in the token's smallest units; the checker turns them into USDC, USDT, DAI or WETH on Ethereum, and calls anything above 296 units unlimited, since no real balance comes near it. The two values drainers use, 2256−1 for ordinary approvals and 2160−1 for Permit2, are both shown as unlimited. A Permit2 allowance with an expiry of 0 lasts only for the block it is used in (Allowance.sol), so the checker says so.
If you already signed
- An approval or setApprovalForAll stays until you revoke it. Set it back to zero or off from a block explorer's token approval page or a revoke tool, such as revoke.cash or Etherscan's Token Approval Checker. It costs gas, and it is worth it.
- A permit not yet used has nothing on-chain to revoke. A permit is only good with the owner's current nonce, so using any other permit for that token voids it; otherwise it dies at its deadline. The quickest fix is to move the tokens to a wallet that never signed.
- A Permit2 signature can be voided through Permit2 itself:
invalidateNoncesfor an allowance,invalidateUnorderedNoncesfor a one-off transfer, andlockdownzeroes allowances (Permit2 interfaces). - A Seaport listing can be cancelled on the marketplace, or every order you have signed at once with Seaport's
incrementCounter. - A change of owner, or a bare hash: assume the worst and move everything you can to a fresh wallet. A burner wallet for airdrops keeps the next mistake small.
Before the request appears
Most losses start one step earlier, on a fake checker or claim page reached from a reply, an ad or a direct message. Is it safe to connect your wallet to an airdrop checker and checking eligibility without connecting your wallet cover that part; how to claim an airdrop safely the claim itself. A hardware wallet shows the request on its own screen, which helps only if you read it: connecting a Ledger to MetaMask goes through it.
What the checker cannot tell you
It reads the request's own words. It does not know who owns the spender address, whether the token contract is genuine or what a contract it has never seen will do, and it does not simulate the transaction. A request it calls low risk on a fake site is still on a fake site. Nothing you paste is sent anywhere; the last thing you checked is kept in this browser only.
General information, not security or financial advice. When in doubt, do not sign.