Your wallet shows you a signature. It doesn't show you what it means.

Most crypto theft today isn't hacking — it's one tricked signature. A permit, an approval, a "verification" — and a wallet is empty. Paste the signing request here before you sign, and SignSafe translates it into plain English: who gets control, of what, for how long.

#1 way wallets get drained: malicious signatures

3 request types decoded — permits, approvals, messages

0 data stored — checks run in your browser

Try an example:

🔒 Private by design: the decoding runs entirely in your browser. What you paste is never uploaded or stored. SignSafe never asks you to connect a wallet — connecting is the risky step. Checking is not.

0RISK / 100

What this signature actually does

Risk flags

What to do

How it works

1 · Copy the request

From your wallet's signature screen — the JSON, the approval, or the message. Don't sign it yet.

2 · Read it in English

SignSafe decodes permits, approvals, typed data and raw calldata, and names the spender, the amount and the deadline — the three places risk hides.

3 · Then decide

A signature is a permission slip. Ten seconds of reading is the difference between using a dApp and handing over your wallet.

Pricing

Free

3 checks every day
Full plain-English decode
Permits, approvals, messages, calldata
No wallet connection, no account

Pro

$9 /month

Unlimited checks
Full plain-English decode
Priority pattern updates as drainer tactics change
For traders, collectors and anyone who signs daily

Pay with USDC on Base to:
0x48E78fFC3f02A65c6A9718b4dc293ae14cBb7985

Then send your transaction hash to our Telegram assistant @NenzyBrownAssistantBot (send /order) or by email to njakoiemmanuel10@gmail.com — your Pro code arrives within 24 hours, usually much faster.

Teams & Communities

$29 /month

Everything in Pro
Codes for up to 10 members
For trading groups, NFT communities and DAO teams whose members sign every day

Questions

Why do drainers use signatures instead of hacking?

Because it's easier. A signed permit or approval is a legitimate blockchain permission — you granted it yourself. There's nothing to "hack back" and usually nothing to reverse. That's why the defence has to happen in the ten seconds before you sign.

What should I paste, exactly?

Whatever your wallet shows you: the typed-data JSON (wallets show it under "message" or "details"), the approval screen's contents, or the message text. The more complete the paste, the more precise the decode. A bare risk word with no spender or amount can't be fully decoded.

I already signed something bad. What now?

Act in this order: (1) move any remaining funds to a brand-new wallet, (2) from a clean setup, revoke the old approvals — revoke.cash shows them by wallet address, (3) never sign anything sent to you about "recovering" the loss — recovery scams are the second wave.

Does SignSafe ever need my wallet connected or my keys?

Never. No connect button, no keys, no seed phrase — ever. Any tool that asks for those to "check" a signature is the thing you should be checking.

Honest limits: SignSafe is an educational decoding tool, not a security authority and not a guarantee. It explains the known structures drainers use. A clean result means no drainer patterns were detected in what you pasted — not that a request is certainly safe. If a signature involves real money and anything feels off, don't sign, and verify through the official app.