What is Sign-In with Ethereum?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
Signing in with a wallet means signing a short message the site provides to prove you control an address. It is not a transaction, so there is no fee and nothing moves. The danger is that the prompt looks much like a transaction approval, and the habit of approving without reading is what attackers rely on.
Key points
- What you sign is a plain message, not a transaction
- No password and no email address is registered
- A nonce and an expiry stop the signature being reused
- The real weakness is the habit of not reading
Definition
An authentication method in which the site presents a formatted message, the wallet signs it, and the site recovers the address from the signature. EIP-4361 defines the message format.
The mechanism is simple. The site presents a message saying you are signing in to this domain with this address, plus a one-time nonce, an issue time and an expiry. You sign it, the site recovers the address from the signature, and if it matches it opens a session.
Because no password is stored, there is less for the site to leak. In exchange, your address stays public, so signing in to many sites with one address lets them be linked together through your on-chain history.
EIP-4361 requires the domain and a nonce to appear in the text. That is what stops a signature made for one site from being replayed at another. Check every time that the domain shown in the signing prompt matches the site you actually opened.
Watch out for
- · A signature you think is a login can grant permission to move assets — read the whole message
- · If the text mentions a token, an amount, or words like permit or approve, it is not a login
- · If the domain shown differs from the site you opened, reject it on the spot