🔒 WalletLock

When you use a DEX, NFT marketplace or bridge, you usually sign an approval first: an on-chain permission that lets that app’s contract spend a token on your behalf. Many apps ask for unlimited approvals so you don’t have to approve again next time.

The catch: approvals don’t expire when you close the app. Years later, that contract (or whoever compromises it, or the scam site you approved once) can still move those tokens without any further action from you. Most “wallet drained” stories start with an old or malicious approval.

This tool finds everything your address has approved and still-active today: classic token allowances, NFT operator approvals, Permit2 allowances (a newer signature-based system used by Uniswap and others), and EIP-7702 delegations (where your whole account runs contract code).

Checking is read-only. Paste any address — the page queries public blockchain endpoints directly from your browser and renders the result. There is no backend; nothing is stored or sent anywhere else. An address is public information, and this site will never ask for your private key or seed phrase. Anyone who does is scamming you.

Revoking is optional and works like any dapp: connect a browser wallet and this page proposes plain revocation transactions (set allowance to 0, set approval to false). Your wallet shows you each transaction and nothing is signed or sent until you confirm it there — the key never leaves your wallet. Prefer not to trust a hosted site? Run this app locally, use the bundled revoke.html (a single dependency-free file), or the revoke.ts script — all in the open-source repo.