Sign-In with Ethereum (SIWE)

SIWE defines a plain-text message that a site asks the wallet to sign. It states the requesting domain, the user's address, a short statement, the chain, a random nonce and issue and expiry times. The site's server checks the signature against the address and opens a session. Because the message is human-readable and includes the domain, wallets can warn when the site asking for the signature does not match the domain in the message.

It gives decentralised apps a common login that works across wallets, including smart contract wallets through ERC-1271 signature checks. Many dApps, NFT platforms, token-gated communities and developer dashboards use it, sometimes alongside ENS names and profile data, to recognise a user without collecting emails or passwords. Extensions let the same signature grant limited, scoped permissions to an app.

A login signature should never move funds, cost gas or grant token approvals; a so-called login prompt that shows spenders or amounts is a red flag. SIWE proves control of an address, not real-world identity, and losing the wallet means losing the login.