What does signing a message mean in a crypto wallet?

Signing a message in a crypto wallet means using your private key to approve a piece of data. The signature proves you control a particular address. Some signatures are just a way to log in, while others are instructions that a website can later use to move your tokens, so the content matters more than the button you press.

What is a signature request in crypto?

When a website asks your wallet for a signature, it sends a message for you to approve. MetaMask explains that most signatures belong to transactions recorded on the blockchain, but some are signed off chain. An off-chain signature is never broadcast to the network on its own. Instead, the site that collected it keeps it and can use it at a time of its choosing.

Common reasons a site asks for a signature include:

• Signing in. Sign-In with Ethereum (the ERC-4361 standard) lets you log in to an app with your wallet instead of a password.
• Proving ownership. Coinbase, for example, lets you sign a message with one of your receiving addresses to show it belongs to you.
• Approving token use. Some approvals, such as Uniswap's Permit2, are granted by signature rather than by a separate on-chain transaction.

How do you sign a message in MetaMask?

You do not start it yourself. A connected website triggers the request, and MetaMask opens a window showing what you are being asked to sign. For Sign-In with Ethereum messages, MetaMask shows a sign-in screen, and if the domain in the message does not match the site you are on, it displays a prominent warning. You then choose to sign or cancel. If you did not expect a request, cancel it.

What is a smart contract call on Trust Wallet?

A "smart contract call" in your wallet history means your address interacted with a smart contract rather than sending coins directly to a person. Swaps, staking and token approvals all work this way. Trust Wallet explains that a token approval lets a contract, such as a decentralized exchange, spend a set amount of your tokens. Unlike an off-chain message, this kind of call is a real transaction and is recorded on the blockchain.

Is signing a message safe?

It depends entirely on what you are signing. MetaMask describes "signature phishing," where a fake app tells you a signature is a deposit or a listing when it actually grants unlimited token access or lets the attacker withdraw your NFTs. Because Permit2 signatures are not recorded on chain and can stay valid for a while, an attacker can wait and drain the account later. Trust Wallet warns that scammers often ask for unlimited approvals through fake airdrops and new token promotions.

To lower the risk, check the website address before signing, set spending limits instead of unlimited approvals, and review and revoke old approvals. MetaMask's security alerts, on by default as of October 2026, simulate requests and warn about known threats, though MetaMask says they cannot catch everything. Related tricks are covered in crypto phishing and wallet drainers and what blind signing is.