Where to find the data in your wallet
In MetaMask, open the confirmation and look for the tab or link marked Data, Hex, or Raw. In Rabby and most other wallets there is an equivalent view. Copy the whole string, starting with 0x, and paste it above. If the request is a signature rather than a transaction, the wallet shows a JSON object instead: copy that whole object, and this page reads it too.
You can also paste the entire JSON-RPC request if you have it from a developer console. The decoder looks for the parts it recognises and ignores the wrapper, because insisting on one exact format would fail the most common paste.
What it recognises
Token approvals
approve and increaseAllowance. Standing permission for an address to move a token out of your wallet. The amount matters enormously, and an unlimited one is the usual shape of a drain.
Permit and Permit2
Off-chain signatures that grant the same power with no transaction and no gas. Nothing appears in your history until the tokens are already moving, which is why they are the most common drain vector there is.
setApprovalForAll
Control of an entire NFT collection at once, including anything you buy later. One signature, every item.
EIP-7702 delegation
The newest and the worst. It hands your whole account to a contract, and revoking token approvals does not undo it. We treat one as the most serious finding available.
The three things worth checking every single time
First, who. The address gaining the power is the part nobody reads and the part that matters most. Open it on a block explorer. A contract deployed four minutes ago with no verified source and no history is not the router of a major exchange, whatever the website around it looks like.
Second, how much. If a site needs to swap a hundred dollars and asks for unlimited permission over your balance, that mismatch is the whole story. Plenty of legitimate apps still request unlimited approvals out of habit, so it is not proof of malice, but it is always worth a second look and often worth setting a limit manually.
Third, whether it expires. Most approvals do not. They sit there working indefinitely, which is why a wallet you stopped using two years ago can still be drained through a permission you granted and forgot. Rejecting a request costs nothing and is always reversible. Signing one frequently is not.
If we cannot decode it
We say so plainly, and that is deliberate. A tool that goes quiet on anything it does not recognise trains people to read silence as approval, and the reader here came looking for permission to sign. An unidentifiable request from a site you do not fully trust is a reason to reject it and ask the project directly, not a reason to proceed.
Questions people ask
What am I actually signing?
Paste the hex or the typed-data JSON from your wallet's details panel and this page decodes it into a plain sentence: which contract gains a power, over which token, for how much, and whether it expires. Most drains are not complicated. They are an ordinary approval or Permit signature for an unlimited amount, sent to an address the victim never checked, which looks identical to a routine action in the wallet popup.
What does 0x095ea7b3 mean?
It is the function selector for approve, the most common signature request in crypto. It grants an address standing permission to move a token out of your wallet, up to a stated amount, and it keeps working until you revoke it. When the amount is the maximum value, which shows as a long run of the letter f, the permission is unlimited and covers everything you hold now plus anything you receive later.
Why is signing a Permit more dangerous than a transaction?
Because nothing happens on chain when you sign it. A Permit is an off-chain signature, so there is no transaction, no gas, and no trace in your history until somebody submits it and the tokens move. People check their transaction history, see nothing unusual, and conclude they are fine. It is the single most common drain vector, which is why this tool never calls one routine even when the amount is capped.
What is an EIP-7702 delegation and why does it matter?
It hands control of your entire account to a contract, rather than granting permission over one token. Every token, every NFT, and anything that arrives later. The part people get wrong is that revoking token approvals does not undo it, because the delegation sits on the account itself and has to be replaced. This tool treats one as the most serious thing it can find, and a delegation marked valid on every chain at once is a hallmark of a drainer rather than of a real application.
Is it safe to paste a signature request here?
A signing request contains a contract address, an amount and a spender, all of which are public information. It never contains your private key or your seed phrase, and no wallet will ever ask you to paste either of those anywhere, including here. We do not store what you paste: the decode happens on the request and nothing about the content is written down.
What should I do if the decode looks wrong?
Reject the request in your wallet. Nothing is granted until you approve, so closing the popup costs you nothing and is always reversible, where signing is often not. If the amount is unlimited and the site only needs a small trade, that mismatch alone is reason enough to decline. If we could not decode the payload at all, treat that as a reason to be more careful rather than less: we tell you plainly when we do not know, and an unidentifiable request from a site you do not fully trust is not one to sign.