What am I signing? Signature and approval explainer
Paste the message or data from a signature request. The tool recognises Sign In With Solana and Ethereum messages and decodes EVM token approvals, Permit and Permit2 signatures and NFT approvals, then explains the risk in plain language. It runs in your browser and does not replace reading Phantom's own warnings.
The requests that matter
| Request | What it does | Risk |
|---|---|---|
| Sign-in message (Solana or Ethereum) | Proves you own the address | Low, if the domain matches the site you are on |
| Solana transaction | Moves tokens, swaps, changes token accounts | Read Phantom's preview of balance changes; drainers hide transfers inside |
| EVM approve / setApprovalForAll | Lets a contract move your tokens or NFTs | Unlimited approvals stay open until revoked |
| Permit / Permit2 signature | Approves token spending with a gas-free signature | Feels harmless, so drainers use it heavily |
How Phantom helps
Phantom previews the expected result of a transaction and warns when a site is on its blocklist or a request looks malicious. If Phantom shows a red warning, cannot preview the transaction, or the site asks you to "verify" or "sync" your wallet, stop. See Phantom's malicious dapp warnings explained and what to do if your wallet was drained.
Frequently asked questions
Can a sign-in message steal my funds?
A genuine sign-in message only proves ownership of your address. But drainer sites sometimes ask for a transaction or a token permit disguised as a sign-in, so check what type of request Phantom shows.
Does this tool decode Solana transactions?
No. Solana transactions are encoded and complex; rely on Phantom's preview, which simulates the result before you sign.
Is pasting this data safe?
Yes. Messages and transaction data are not secret, and the tool runs only in your browser. Never paste a recovery phrase or private key.