Why Do NFT Sites Ask for Signatures?
NFT sites ask for signatures for one legitimate reason — proving you control your wallet — and one dangerous use — disguising permission grants. The signature itself is just cryptographic ID; the risk is entirely in what you’re asked to sign and who asked.
The legitimate use: login by ownership#
There’s no username/password in web3 — your wallet is your identity. “Sign this message” is how a marketplace or app verifies you control the address you’re claiming: you sign a piece of text with your private key, the site checks the math, you’re logged in. It costs nothing, grants nothing, and the popup is clearly a plain-text message. This is normal and safe as a mechanism.
Where it goes wrong#
- Typed-data signatures that hide permissions — not all “sign” requests are plain text: some signing requests (typed data / permits) can authorize token movements or marketplace listings. A popup showing structured fields, “approve”, “permit”, or contract addresses is NOT a login signature — read before signing.
- Blurred lines by phishing — malicious sites present signature steps to seem official, then escalate to real approvals. A signature on a fake site proves nothing worth proving and normalizes the prompt — see approvals vs signatures.
- Off-chain listing signatures — marketplaces legitimately ask you to sign listing orders off-chain; scammers have historically phished these signatures to “buy” assets for ~0. Only sign order-style payloads on marketplaces you navigated to yourself.
The practical rules#
- Login signature = plain text message, on a site you reached deliberately. Fine.
- Anything with fields, contract addresses, “approve”/”permit” wording = a real authorization. Stop and verify what it does.
- When in doubt, don’t sign — a site that needs your signature will still be there tomorrow.
Explainer drafted 2026-10-08 — signature mechanics are stable; specific payload types evolve.
What to read next#
- What Am I Signing When I Buy an NFT? (Signatures, Approvals & Safety)
- How to Revoke Wallet Permissions Safely (Beginner Guide)
- NFT Security Checklist for Beginners (Protect Your Wallet & NFTs)
- How Wallet Drainers Steal NFTs (And How to Avoid Them)
- What Is a Malicious Smart Contract? (NFT Security Guide)
