In this track: Explore safely
beginner · 3 MIN READ

Read a domain carefully

A familiar brand name inside a URL is not enough.

LET’S PICTURE IT

A shop sign can mention a famous company without being that company’s actual shop.

SEE IT FOR YOURSELF
From a public address to a verified signatureStep 1 / 4
From a public address to a verified signaturePublic address0x0000…0001Share to receiveAnother personCan read the addressCannot sign for youPublic identifier ≠ secret authorizationLocal signerPrivate key stays hereSign the chosen requestSigned requestMessage + signatureSecret key not includedThe moving packet represents a signature, not a keySignatureCheck the exact messageCheck the signing contextVerificationAuthorization checkedIntent still mattersValidity and safety are different questionsWallet interfaceReads public dataRequests authorizationNetwork stateBalances and recordsIndependent verificationNo wallet is connected in this local illustration

An address is public receiving information. It is not the private key that authorizes actions.

Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.

Separate the host from the rest

A URL can contain a scheme, host, path and other components. Seeing a trusted name in a path or as part of a longer hostname does not make the whole address the trusted domain. Read the actual host.

Lookalikes use small changes

Extra letters, swapped characters and visually similar symbols can make a domain appear familiar. A search advert, message preview or copied screenshot is not a substitute for checking the final destination in the browser.

HTTPS protects a connection, not a business claim

An encrypted connection can lead to a malicious site that obtained its own certificate. It helps protect transport to that domain but does not validate every promise or wallet request on the page.

Navigate through established references

For a real service, use a source you already trust to find its official destination. Be cautious when a page unexpectedly asks for authorization material unrelated to the task. The phrase and signature lessons explain those capability boundaries.

QUICK CHECK · NO PRESSURE

Does HTTPS alone prove a website belongs to the brand it displays?

Your progress stays in this browser.
Keep exploring the original referenceethereum.org ↗

Original explanations by EtherTools. Examples are educational and source-linked; this site is independent of the Ethereum Foundation. Our approach.