What the fields mean
Typed data has four parts. The domain names the contract that will check the signature (verifyingContract), its name and version, and the chainId it is valid on. The types describe the structure. primaryType says which structure is being signed, and message holds the values. What you approve is decided by primaryType and verifyingContract together: a Permit on a token contract approves that token, a PermitSingle on the Permit2 contract (0x000000000022D473030F116dDEE9F6B43aC78BA3 on every major EVM chain) approves the token named inside the message.
Amounts are raw integers: for a token with 6 decimals, 1000000 is one unit. Permit2 uses 160-bit amounts, so its 'unlimited' value is 2ยนโถโฐโ1 rather than 2ยฒโตโถโ1. Deadlines and expirations are Unix timestamps in seconds; the tool converts them to dates.
Typical requests and the red flags
- Permit (EIP-2612) โ owner, spender, value, nonce, deadline. Legitimate dApps use it to save an approval transaction. A phishing site uses the same format to pull your USDC or DAI.
- Permit2 PermitSingle / PermitBatch โ allowances through Uniswap's Permit2 contract. Batch versions can cover several tokens in one signature.
- Permit2 PermitTransferFrom โ a one-time transfer of the listed tokens to whoever submits the signature.
- Seaport OrderComponents โ an NFT or token order. If the 'consideration' items pay a stranger or total close to zero, signing hands over the items in 'offer'.
- Red flags โ unlimited amounts, expirations months or years away, a spender you cannot identify, a chainId that is not the network you are using.
If you already signed something unwanted
A signature cannot be cancelled, but a Permit only works while its deadline has not passed and its nonce has not been used. Act quickly: revoke the token approval on-chain (for Permit2, revoke the allowance in the Permit2 contract) or move the funds to a new wallet. Treat a signed Seaport order like a live listing and cancel it through the marketplace.
Everything here runs in your browser. The tool needs only the typed-data JSON that a dApp sends to your wallet โ never a seed phrase or private key.
Frequently asked questions
+Can a signature without gas steal tokens?
Yes. A Permit or Permit2 signature gives a spender the right to move tokens; the spender then submits it and pays the gas. That is how many wallet drainers work.
+Where do I get the JSON?
Many wallets show the raw typed data on the signing screen or in an advanced view. Developers can copy the eth_signTypedData_v4 payload from the browser console or the dApp's request.
+What is Permit2?
A contract by Uniswap Labs that manages token allowances for many dApps. You approve Permit2 once on-chain, then grant individual dApps allowances by signature.
+Is a limited amount and short deadline safe?
It limits the damage, but only sign if you recognise the dApp and the spender. A small permit to a scammer is still a loss.
+Does this tool verify the signature?
No. It decodes the request you are about to sign so you can judge it. Signing and verification happen in your wallet.
Calculations run entirely in your browser; nothing you type is sent to KOT.CASH. Results are estimates for information only and are not financial, tax or legal advice.