What is EIP-712 and what are typed data signatures?

EIP-712 is an Ethereum standard for signing typed, structured data. Before it, apps often asked users to sign an unreadable string of hex characters. With EIP-712, the wallet can show labeled fields, such as which token, which spender and what amount, so the user can see what they are approving.

What is a typed data signature?

A typed data signature is a signature over a message that comes with its own description of the data types inside it. The EIP-712 proposal, authored by Remco Bloemen, Leonid Logvinov and Jacob Evans and dated September 2017, has Final status. It says older signed messages gave users almost no context, and it set out a way to encode data with type information so wallets can display it.

Signing costs no gas and sends nothing to the chain by itself. The app or contract that receives the signature checks it later. Our guide to what signing a message means covers signatures in general.

How does EIP-712 typed data work?

Every EIP-712 message includes a domain, a short record that says where the signature is meant to be used. It can include the app's name, a version, the chain ID and the address of the contract that will verify it. EIP-712 tells wallets to refuse to sign if the chain ID does not match the active network.

The standard does not include replay protection on its own, so each app must stop the same signature from being used twice. Apps reach it through a wallet method called eth_signTypedData_v4. MetaMask's developer docs recommend it for most cases and say its confirmation screen shows the domain name and the type of message prominently.

What are permit signatures?

ERC-2612, created in 2020, added a permit function to tokens. Instead of sending a paid approval transaction, a holder signs an EIP-712 message naming a spender, an amount, a nonce and a deadline. Anyone can then submit that signature, and the spender gets permission to move the tokens. Uniswap's Permit2 contract extends a similar idea to any ERC-20 token.

Permits are convenient because they save a transaction. ERC-2612 notes that a very large deadline effectively means the permission never expires.

How does EIP-712 signature phishing work?

A fake site asks you to sign what looks like a harmless login or claim, but the message is really a permit for your tokens. Because nothing happens onchain at signing time, the theft only appears once the attacker uses it.

Scam Sniffer's 2025 report found Permit and Permit2 signatures behind 38% of losses in phishing cases over 1 million dollars. The single largest theft that year, about 6.5 million dollars in September, used a Permit signature.

Before signing, read the spender address, the token, the amount and the deadline, and check that the site is genuine. Our guide to phishing and wallet drainers explains common tricks, and how to revoke token approvals shows how to clean up permissions already granted.