Personal-message hashing prefixes the exact message length and bytes.
LET’S PICTURE IT
A document envelope can say this is a message rather than an ordinary transaction.
SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
An address is public receiving information. It is not the private key that authorizes actions.
An address is public receiving information. It is not the private key that authorizes actions.The local signing system uses secret authorization material. It produces a signature; the private key is not sent along with it.A verifier checks the signed request under the account’s rules. A valid signature does not by itself prove that the action is safe.Balances belong to network state. A wallet is an interface and signing system, not a box containing coins.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Use the message convention
The common Ethereum personal-message scheme includes a defined prefix and decimal byte length before the message bytes are hashed. It is not simply Keccak-256 of the text.
Count encoded bytes
For hello the length is five UTF-8 bytes. For non-ASCII text, visible character count and JavaScript string length are not reliable general byte counts.
Avoid a text-versus-hex mismatch
Signing the text 0x1234 differs from signing two raw bytes 12 34. The API input convention must agree between the signer and verifier.
Do not infer harmlessness
A personal-message signature can still authorize actions when a protocol accepts it. Read the actual message and application rules before signing.