How to Revoke Wallet Permissions Safely (Beginner Guide)
Two different things are often called “wallet permissions”, and mixing them up is how beginners think they’re safe when they aren’t:
- On-chain approvals — recorded on the blockchain, letting a smart contract move specific tokens or NFTs from your wallet. These persist until you revoke them, and they are the ones that drain wallets.
- Website connections — a site your wallet is “connected” to, so it can see your address and request signatures. Disconnecting stops a site seeing you; it does not remove its approvals.
Last reviewed: September 2026
This guide covers the first kind: finding and revoking on-chain approvals with real, current tools — and knowing exactly what revocation can and can’t do.
What on-chain approvals actually allow#
Approvals let a smart contract move assets on your behalf — legitimate marketplaces need them to list and sell your NFTs, and DeFi apps need them to swap tokens. There are two common forms:
- Token allowances — a contract may move a token up to a set amount (“unlimited” means everything of that token).
- NFT operator approvals (“setApprovalForAll”) — a contract may move every NFT in one collection it was approved for.
Approvals are scoped: an approval touches only the token or collection it was granted for — it cannot move your ETH/native balance or unrelated NFTs. But within that scope it can act without asking you again, which is why a forgotten approval on a compromised or malicious contract is dangerous.
When should you revoke?#
- After interacting with a suspicious site, giveaway or mint
- When you no longer use a marketplace or dApp
- After approving something you don’t recognise
- Any time your wallet may be compromised — see what to do if your NFT wallet is compromised
Beyond incidents, a regular review is a good habit — after trying new sites, and every month or two as routine hygiene.
The tools (verified September 2026)#
revoke.cash — the dedicated checker (EVM chains)#
revoke.cash is the standard free tool: connect your wallet (or paste an address to inspect), and it lists every active approval across 100+ EVM networks, flagged by risk. Revoking a single approval is free apart from the network fee; batch revoking carries a small per-batch charge, and paid tiers now add monitoring and automatic revocation for users who want it. Its own FAQ confirms the key point: revoking is preventative — it cannot recover stolen funds.
Block explorer approval checkers#
Etherscan’s Token Approval checker (and the same tool on sister explorers like Basescan, Polygonscan and Arbiscan) lets you paste any address to view approvals read-only, then connect that wallet to revoke — grouped by ERC-20, ERC-721 and ERC-1155.
Your wallet’s built-in views#
Some wallets show connected sites or approvals natively (e.g. MetaMask’s connected-sites list, Phantom’s “connected apps”). Useful for disconnecting sessions — but remember that disconnecting a site does not revoke its on-chain approvals.
Warning: fake revocation tools exist and steal via signature prompts. Only use addresses you type or bookmark yourself — the tools above are linked here exactly as they appear on their official domains.
How to revoke, step by step#
Step 1: Stop interacting with the suspect site#
Don’t connect or sign anything else until you’ve reviewed approvals.
Step 2: Open a checker and list your approvals#
On revoke.cash or your chain’s explorer checker, paste your address (or connect read-only) and look for unlimited token allowances, collection-wide NFT approvals, contracts you don’t recognise, and old projects you no longer use.
Step 3: Revoke the risky ones#
Select revoke/remove (or set the allowance to zero) and confirm in your wallet. Each revocation is a real on-chain transaction — it costs a small gas fee per approval on mainnet.
Step 4: Confirm and re-check#
Refresh the dashboard and confirm the approval shows as removed or allowance zero. Repeat for anything else unfamiliar.
Step 5: Disconnect the site’s session too#
In your wallet’s connected-apps list, remove the suspicious site. This is hygiene, not protection — the on-chain revocation above is what actually closes the door.
A note on Solana#
Standing approvals are primarily an EVM mechanism. On Solana, apps interact per-transaction and token accounts can hold a single “delegate” with a capped amount — so the main hygiene task is disconnecting untrusted sites inside your wallet (e.g. Phantom’s connected-apps settings). If a specific Solana token account was given a delegate, a wallet or explorer that exposes token-account details is where you revoke it.
What revoking does — and doesn’t do#
- Stops the contract moving those assets in future
- Limits further damage after a bad approval
- Cannot undo transfers that already happened
- Cannot cancel a completed transaction — on-chain actions are final
- Doesn’t protect the rest of the wallet if your recovery phrase itself is exposed
Revoking is a door-lock, not a cure-all — and if your keys are compromised rather than just an approval, revoking isn’t enough; you need the compromise runbook linked above.
Bottom line#
Approvals outlive the session that created them. Once a month — and immediately after anything suspicious — list your approvals on revoke.cash or your explorer’s checker and revoke what you don’t recognise or no longer need. It costs a few cents in gas and closes the most common door drainers use. The sister guide How to Revoke Smart Contract Approvals covers the approval types in more depth, and the NFT security checklist keeps the full routine in one place.
