Token approval and permit explainer
Paste the data of a transaction (0x…) or the JSON of a signature request. The tool decodes approve, increaseAllowance, setApprovalForAll, permit and Permit2, shows the spender, amount and expiry, and explains the risk. It runs in your browser; it does not replace reading Rabby's own signing screen.
The approvals and signatures that matter
| Request | What it allows | Main risk |
|---|---|---|
| approve | A spender can move up to an amount of one token | Unlimited approvals stay open forever |
| setApprovalForAll | An operator can move every NFT in a collection | Used by NFT drainers |
| Permit / Permit2 signature | Sets an approval with a gas-free signature | Feels harmless, so drainers use it heavily |
| Marketplace order | Lists your assets for sale | Fake listings that sell your NFTs for nearly nothing |
How Rabby helps
Before you sign, Rabby simulates the transaction and shows the balance changes and the approvals it would create, with risk warnings for unknown or flagged spenders. Read that screen every time. Afterwards, Rabby's Approvals page lists your open approvals so you can revoke ones you no longer need; see how to revoke approvals in Rabby and how transaction simulation works.
Where to find the data
In Rabby's signing screen you can view the raw data of a transaction or signature request. A block explorer also shows the input data of past transactions. Paste either here.
Frequently asked questions
Is an unlimited approval always dangerous?
Not always: many trusted dapps request it for convenience. But it stays open until you revoke it, so if the spender contract is ever exploited, your tokens are exposed. Approving only what you need is safer.
Why does a gas-free signature matter?
Permit and Permit2 signatures cost nothing to sign but can authorise a spender to take your tokens. Many drainer sites ask for these instead of transactions.
Does revoking cost gas?
Yes. Revoking is an on-chain transaction, so you pay a normal network fee.
Is pasting transaction data safe?
Yes. It is public data and the tool runs only in your browser. Never paste a seed phrase or private key.