✍️ Signing Messages: Proof of Ownership
Learn how users sign messages without gas fees
Integrate Web3 wallets into your dApp
Your Progress
0 / 5 completed✍️ Message Signing & Authentication
Message signing is how Web3 does authentication. Instead of "username + password", users sign a message with their private key to prove they own an address. Zero gas cost, instant verification. OpenSea uses it for login ("Sign this message to authenticate"), Snapshot.org for voting, ENS for metadata updates. The signature proves: "I control this wallet, I approve this action." Let's see how it works.
🎮 Interactive: Message Signing Simulator
Type a message, sign it with your simulated wallet, and see the cryptographic signature. Verify the signature to prove message authenticity.
54 characters • This message will be signed with your private key
🎯 Real-World Use Cases
Prove you own the wallet without password. Sign = authentication.
Sign your vote without gas fees. Signature proves vote authenticity.
Update ENS metadata off-chain. Signature authorizes change.
Approve token spending via signature instead of on-chain transaction. Saves gas.
🔐 How Signature Verification Works
Wallet uses private key to sign message. Produces 65-byte signature (r, s, v values). Code: ethereum.request({ method: 'personal_sign', params: [message, address] })
Signature returned to dApp: 0x6f4e8b...a3c2 (130 hex characters). This signature is proof of ownership without revealing private key.
Server recovers signer address from signature + message using ecrecover (elliptic curve cryptography). If recovered address matches claimed address, signature is valid.
Code: ethers.verifyMessage(message, signature) // returns address
Server creates session token, stores it with verified address. User is now authenticated. Subsequent requests include token for authorization.
⚠️ Security Best Practices
Add random nonce to message: "Sign in. Nonce: 8f3a2c". Prevents replay attacks (attacker reusing old signature).
Include expiry: "Valid until: 2024-01-01 12:00". Server rejects expired signatures. Limits attack window.
Include domain in message: "Sign in to app.uniswap.org". Prevents phishing (signature won't work on evil.com).
Structured data signing. Better UX (wallet shows parsed fields). Safer (harder to trick users). Standard for permits, votes, orders.
💡 Key Insight
Message signing is Web3's killer feature: passwordless authentication that's more secure than traditional login. No password database to hack, no 2FA codes to intercept, no session cookies to steal. Your private key (stored in hardware wallet or MetaMask) signs messages locally—keys never leave your device. The signature is the proof. This unlocks gasless voting (Snapshot), gasless approvals (EIP-2612 permits), and seamless auth across all dApps. One wallet, infinite apps, zero passwords. This is the future of identity.