In this track: Cryptography with intuition
Signatures and permissions
Prove authorization without sharing the secret that creates it.
A signature is a checkable approval. The shape of the document matters just as much as who signed it.
An address is public receiving information. It is not the private key that authorizes actions.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Signing is not encryption
A digital signature lets someone verify authorization by the holder of a key. It does not hide the message. With Ethereum’s common externally owned account signatures, software can recover a signer address from a correctly formed signature and the expected message digest.
The message format matters
Signing a transaction, signing a personal message and signing typed data use different rules. EIP-712 typed data provides structured fields and domain information, often including chain and verifying contract. That makes requests easier to inspect, but a readable request can still authorize a dangerous action.
Watch for replay
A signature can be reused if the application does not design appropriate protections. Nonces, deadlines and domain separation help bind an approval to an intended context. The verifier must enforce these checks; simply displaying a deadline in a website is insufficient.
Contract wallets differ
A contract account can define signature validity through mechanisms such as ERC-1271. Recovering an ordinary signer address is therefore not a universal wallet signature check. Never infer that a signature is safe just because a verification step passes. Start with the permissions described in wallet safety.
Does a valid signature prove that the signed action is safe?
Validity and safety differ. The action, permissions and replay protections still need to be understood.
Original explanations by EtherTools. Examples are educational and source-linked; this site is independent of the Ethereum Foundation. Our approach.