What Does “Sign Message” Mean in a Crypto Wallet?

A wallet signature stamps a message with your private key to prove that the owner of the address agreed to it. Signing costs no gas and leaves nothing onchain at the time, so it feels harmless. Whether it can touch your assets depends on what you sign. A readable login message is generally fine; a structured approval signature can let someone move your tokens later.

Signature vs transaction

	Transaction	Signature
Gas	Yes	No
Onchain immediately?	Yes, visible on an explorer	No, the site keeps it
Can it move assets?	Yes, directly	Depends: approval signatures can be submitted onchain later by whoever holds them

MetaMask's guidance on signature phishing stresses that offchain signatures let the collector use them "at a time of their choosing", that signing is not recorded onchain, and that an attacker may not act right away.

The main kinds of signature

• Plain text (personal_sign): readable text, often a login such as Sign-In with Ethereum. A proper login message names the site and includes a time or one-time value. If it is readable text on a site you trust, it generally moves nothing.
• Structured data (signTypedData, EIP-712): the prompt lists fields such as spender, value and deadline. It might be an order or a vote, or a Permit or Permit2 token approval, or a marketplace listing. MetaMask describes fake NFT marketplaces getting users to sign bulk-listing messages that let them take every NFT in the account.
• Unreadable hex: a blob of data you cannot interpret. MetaMask's developer docs mark eth_sign as deprecated. If you cannot read it, reject it.

What to read in the prompt

1. The requesting site: is it the domain you bookmarked?
2. The type and title: treat Permit, Approval, Order or Listing as an approval or trade.
3. Spender and amount: who receives permission, how much, whether it is unlimited, and the deadline.
4. Whether it matches what you came to do: logging in should never require a token approval.

MetaMask recommends keeping security alerts on and checking the URL before signing. The alerts are on by default but cannot catch every threat.

When to reject outright

• You cannot read it, or it is hex.
• You did not arrive through a bookmark or the official site.
• A "free airdrop" wants a Permit or an approval for assets you already hold.
• Several prompts appear at once, or the page rushes you.

Rejecting costs nothing. If a signature is genuinely needed, you can start again from the official site.

FAQ

Can I take back a signature?

Not the signature itself. If it was a Permit-style approval, move the assets to another wallet before it is used, or follow the protocol's instructions for cancelling it. Once an approval has been used onchain, you can revoke the remaining allowance with a tool such as Revoke.cash; see how to revoke token approvals.

Is signing with a hardware wallet safe?

A hardware wallet keeps the key on the device, but you still decide what to sign. Approving something malicious on it has the same result as on any wallet.

Can a login signature let a site take my tokens?

A standard login signature only proves you own the address and contains no approval, provided what you saw was readable login text rather than approval fields.

Further reading

• What is a token approval, and how do you revoke it?
• What is a wallet drainer, and how can beginners avoid it?
• Does disconnecting a wallet remove token approvals?
• What does minting an NFT mean? A checklist

Sources

• MetaMask Docs: sign data (docs.metamask.io)
• MetaMask: signature phishing (support.metamask.io)
• MetaMask: security alerts (support.metamask.io)