Identify the signature type first
Wallet prompts may contain a login message, human-readable text, structured typed data, or an on-chain transaction. Their consequences differ, so identify the category before deciding whether to sign.
Unintelligible hexadecimal data or fields unrelated to the task deserve extra caution.
Login signatures still communicate intent
A message signature may prove control of an address without moving assets, but the signed text can still be meaningful. Check the domain, statement, nonce, expiration, chain, and any requested scope.
“Not a transaction” does not mean “irrelevant to security.”
Typed data improves readability, not trust
EIP-712 style prompts can expose fields such as verifying contract, spender, value, and deadline. Read those fields and compare them with the action you initiated.
A readable format can still contain an excessive value or unfamiliar contract.
Transaction signatures change on-chain state
Transfers, approvals, NFT actions, and contract calls may all be transactions. Review the sender, destination, network, value, fee, and contract details before signing.
Keep the transaction hash after submission so you can verify the result on the correct chain.
Rejecting an unclear signature is normal
Closing or rejecting a prompt does not damage the wallet. If the request cannot be explained, stop and verify rather than trying variants until one succeeds.
No support agent needs your recovery phrase to cancel a signature.
Do not reduce it to a routine confirmation click.
How to read a wallet signature prompt
Read the request type, originating site, account, and network first. Then inspect contract, amount, allowance, expiration, and other fields that determine what the signature authorizes.
Important fields in typed-data signatures
Compare the wallet prompt with the exact action you just took on the page. A “sign in” button that produces a token approval or transfer is a clear mismatch.
You do not need to decode every byte, but you should be able to explain the important party, value, and permission before signing.
- Match the signature type to your intended action
- Verify site, account, network, and target
- Inspect amount, allowance, and expiration fields
- Reject requests you cannot explain