Ethereum Address Checker: Validate Format, EIP-55 Checksum & Poisoning Lookalikes

What an Ethereum address is

An Ethereum account address is a public identifier: the prefix 0x followed by 40 hexadecimal characters (20 bytes). For an externally owned account it is derived from the last 20 bytes of the Keccak-256 hash of the public key. You can share the address so others can send ETH or tokens; the private key or recovery phrase that controls it must never be shared. Activity tied to the address is visible on the public ledger — see our wallet address guide and Ethereum wallet guide.

Contract accounts use the same visual format but hold code instead of a single private key. Explorers distinguish them by showing deployed bytecode. Sending value to a contract is not always the same as sending to a wallet: some contracts reject plain ETH transfers.

How EIP-55 checksums work

Hexadecimal letters a–f can be written upper or lower case without changing the underlying bytes. EIP-55 (ERC-55) uses that freedom as an error-detecting checksum. The algorithm lowercases the 40 hex characters, computes Keccak-256 over that ASCII string, then uppercases each letter whose corresponding hash nibble is ≥ 8. Compatible wallets reject mixed-case strings that fail this check, catching many copy and typing errors. All-lowercase or all-uppercase forms are still valid hex but carry no checksum — wallets typically accept them without that extra safety net. Spec: EIP-55.

Important implementation detail: Ethereum's hash is Keccak-256, not FIPS SHA3-256. Using the wrong hash function silently produces wrong capitalization. This page uses the js-sha3 keccak256 implementation and is tested against the official EIP-55 vectors.

Same address on L2s and other EVM chains

Keys that produce an address on Ethereum mainnet generally produce the same 0x string on EVM-compatible networks such as Arbitrum, Optimism, Base, and many others. That convenience is also a foot-gun: depositing on the wrong network, or sending a token that only exists on one chain, can lock funds until a recovery path exists — if one exists at all. Confirm network and asset in the receiving interface. For fee timing on mainnet, use the gas tracker.

Address poisoning, accurately

Address poisoning does not hack your private key. An attacker creates a vanity address whose leading and trailing characters mimic an address you already use, then sends you a tiny or zero-value transfer so the lookalike appears in your wallet or explorer history. When you later copy "your" or a contact's address from that history without reading the middle, you may paste theirs. Confirmed sends cannot be reversed by the protocol.

Reputable write-ups describe the same pattern and defenses (full-string comparison, contacts/address book, avoid history copy, hardware confirmation):

• Etherscan Info — What is address poisoning?
• MetaMask Help — Address poisoning scams
• MetaMask — Address poisoning detection (product update)
• ethereum.org — Accounts (address basics)

Safe-sending checklist

1. Obtain the destination from the recipient, deposit screen, or a saved contact — not from an unsolicited inbound transfer.
2. Run it through this checker for format and checksum; use compare mode against anything copied from history.
3. Read the full address on the hardware or software wallet confirmation screen, middle characters included.
4. Confirm network and asset. A familiar 0x shape is not proof you selected the right chain.
5. For large first-time sends, consider a small test transfer and confirm receipt before the remainder.
6. Review leftover token approvals periodically — see token approvals. Hang up on fake support: fake CEX support, Coinbase call scams, and Scam Watch.