Get certified
Guide

Is it safe to sign a message with your wallet?

Signing plain, readable text can't move your crypto. The danger is being asked to sign something that only looks like a message. Here's how to tell the difference.

Updated 13 Oct 2026

The short answer

A plain-text message signature proves you hold the key. It isn't a transaction: it can't send coins, can't approve spending, and can't be replayed as a payment. Wallets ask you to sign messages all the time, to log in to apps or prove ownership.

Scammers rely on people approving pop-ups without reading them. So the rule is simple: read what you're signing, and only sign readable text you understand, on a site you meant to visit.

Safe to sign: a readable message

  • Plain words you can read, saying what it's for.
  • It names the site you're on.
  • No amount, no token, no "spender", no "approve" or "permit".
  • No network fee is shown.

For example, a VerifiedWallet request looks like this:

VerifiedWallet certificate request
wallet: 0x71c7656ec7ab88b098defb751b7401b5f6d8976f
tier: 1
nonce: 3f9c2a7e5b1d4e8f9a0b6c2d7e1f4a3b
timestamp: 1791900000000

It names us, your own address and the tier you chose. The one-time code (nonce) and time mean it can only be used once, within minutes, for that certificate request. Bitcoin requests are the same on one line.

Stop and check: things that look like messages but aren't

  • Token approvals ("Approve", "Set approval for all", "Allow … to spend your …"). These let someone else move your tokens or NFTs later.
  • Permits (EIP-2612 permit, Permit2, "typed data" with a spender, value and deadline). They're signatures, not transactions, and cost no gas, yet they authorise spending. This is the most common way people lose funds by "just signing".
  • Blind signing: a long string of hex (0x3a9f…) with no readable text, or a hardware wallet warning that it can't show the details.
  • Anything with a network fee. If a fee appears, it's a transaction.
  • A site you didn't mean to visit, or one whose address is slightly off (verifled-wallet, extra words, odd endings). Check the address bar.

Never, for anyone

  • Never type your recovery phrase (seed words) into a website, form or chat. No genuine service needs it. VerifiedWallet will never ask for it.
  • Never share your private key, and never install a wallet from a link someone sends you. Use the official site or the links in our wallet guide.

If you think you signed something bad

For Ethereum-style wallets, check and revoke token approvals with a tool like revoke.cash, and move funds you're worried about to a fresh wallet. If you entered your recovery phrase anywhere, treat the wallet as compromised and move everything to a new one straight away.

Get a certificate anyone can check

Sign once with your wallet: free, no transaction. We counter-sign it and give you a link anyone can verify. From $1.

Get certified

More guides

How to prove you own a Bitcoin address

Sign a message with the address's key: free, instant, nothing on the blockchain.

How to sign a message with a Bitcoin wallet

Step by step in Xverse, Electrum, Sparrow, Trezor, Ledger and Bitcoin Core.

BIP-322 vs BIP-137: Bitcoin message signing explained

Why there are two formats, which wallets use which, and why Taproot needs BIP-322.

How to prove you own an Ethereum wallet

One signed message, no gas, and it covers every EVM network at once.

Questions

Can someone steal my crypto with a message signature?

Not with a plain-text message. Losses come from approvals, permits and blind-signed data presented as if they were messages. Read every request before you approve it.

Why does a site ask me to sign instead of paying gas?

Signing proves you hold the key without a transaction, so it's free. That's normal for logins and ownership proofs, as long as the request is plain readable text.

Does VerifiedWallet ever ask for my recovery phrase?

No, never. We only ask your wallet to sign a short readable message, which it shows you first.