Token Approval Checker: Find Unlimited ERC-20 Approvals and Revoke Them
Short answer · Updated October 18, 2026
Paste a wallet address to see, live from Ethereum mainnet, which of 12 major tokens (USDC, USDT, DAI, WETH, stETH and more) it has approved to 16 widely used spender contracts such as Uniswap Permit2, 1inch, 0x, CoW Swap, Aave and OpenSea, including unlimited approvals and Permit2 sub-approvals. To revoke one, or to see every approval including unknown and drainer contracts, use Etherscan’s Token Approval Checker or revoke.cash.
Privacy: No wallet connection and nothing to sign. Your address goes from your browser to public Ethereum nodes (PublicNode, with dRPC and 1RPC as fallbacks) in a read-only call. We do not receive or store it. This page never asks for a seed phrase or private key, and neither does any legitimate revoke tool.
Your browser asks public Ethereum nodes for allowance(owner, spender) on 12 major tokens against 16 well-known spender contracts, plus Uniswap Permit2 sub-approvals, in one batched Multicall3 read. No wallet connection, no signature.
Try an example: ·
Step 2 · Any token, any spender
Check one specific approval
Found a suspicious address in a transaction, or use a token that isn’t in our list? Enter the token contract and the spender. Uses the wallet address from Step 1. Reads allowance, symbol, decimals and your balance.
Step 3 · NFTs
Check an NFT “approve all” (setApprovalForAll)
One setApprovalForAll signature lets an operator move every NFT you own in that collection. Enter the collection contract (ERC-721 or ERC-1155) and an operator. Uses the wallet address from Step 1.
We never ask you to sign anything. To revoke, use revoke.cash or Etherscan’s checker (NFT tab) from the wallet that gave the approval.
How to revoke token approvals, step by step
Run the check above and decide what to keep. Approvals for apps you use every week are a convenience; unlimited approvals to apps you tried once, or to older router versions, are exposure with no benefit.
Open Etherscan’s Token Approval Checker or revoke.cash by typing the address yourself, and connect the wallet that gave the approval. Both show approvals this page can’t, including NFTs and unknown spenders.
Click Revoke next to each approval. In your wallet (or on your hardware wallet’s screen), check that the transaction is an approval of 0 to the spender you meant, then pay the gas fee. Check current fees on our gas tracker.
Run this checker again: revoked approvals disappear from the table.
A wallet drainer doesn’t need your seed phrase if you approve its contract or sign a permit for it. Scam Sniffer’s 2025 report counted $83.85 million stolen by wallet-drainer phishing from 106,106 victims on EVM chains, down from $494 million in 2024. The largest single theft, $6.5 million in September 2025, used a malicious Permit signature, and Permit/Permit2 signatures were behind $8.72 million of the 11 cases above $1 million.
For each token it calls allowance(owner, spender) (EIP-20) for every spender below, plus balanceOf and totalSupply, and asks Permit2 for allowance(owner, token, spender) (amount and expiry) for three Uniswap routers. All reads are bundled into Multicall3 aggregate3 calls at 0xcA11bde05977b3631167028862bE2a173976CA11, so a full scan takes one to three requests. An allowance of 2^255 or more is shown as Unlimited (apps usually request 2^256 − 1); an allowance at or above the token’s total supply is flagged as effectively unlimited. Every address in the tables below was checked against the official source listed and confirmed on-chain on October 18, 2026.
Paste your public wallet address into the checker on this page. It reads allowance(owner, spender) live from Ethereum mainnet for 12 major tokens (USDC, USDT, DAI, WETH, WBTC, stETH, wstETH, LINK, UNI, AAVE, PEPE, SHIB) against 16 well-known spender contracts, plus Uniswap Permit2 sub-approvals, and lists every non-zero approval. For a complete list across every token, NFT and spender, use Etherscan’s Token Approval Checker or revoke.cash, which index approval history.
How do I revoke token approvals?
Revoking means sending a transaction from the wallet that gave the approval which sets the allowance back to zero. The simplest ways are Etherscan’s Token Approval Checker (etherscan.io/tokenapprovalchecker) or revoke.cash: connect the wallet, find the approval and click Revoke, then confirm the spender address in your wallet. It costs a small gas fee because it is an on-chain transaction. Type those web addresses yourself; fake “revoke” sites are a common drainer trick.
What is an unlimited token approval, and is it dangerous?
Many apps request the maximum possible allowance (2^256 − 1) so you don’t have to approve again before every swap. It lets that contract move all of that token you hold, now and later. With a widely used, audited contract the main risk is a future bug or exploit; with a malicious contract it means immediate theft. Approve exact amounts for apps you use rarely, and revoke approvals you no longer need.
Does disconnecting my wallet from a site revoke its approvals?
No. Disconnecting only stops the site from seeing your address. The approval lives in the token contract on-chain and stays until you revoke it or it is used up. MetaMask’s help center makes the same distinction between allowances and connected sites.
How can I tell if my wallet is approved to a drainer?
This checker covers well-known spenders only, so a drainer contract will not show up here; use the custom check if you already know the suspicious address. For everything else, open your address on revoke.cash or Etherscan’s checker and look for spenders you don’t recognize or approvals you don’t remember, then revoke them. Revoking stops future transfers but cannot reverse past ones, and if you ever typed your seed phrase into a site, revoking is not enough: move what is left to a new wallet.
What is Permit2, and why does my USDC show an unlimited approval to it?
Permit2 is a Uniswap contract that many apps share. You approve Permit2 once per token, usually for an unlimited amount; each app then gets its own sub-approval inside Permit2 with an amount and an expiry date, normally granted by signing a message. This checker shows both layers. An unlimited approval to Permit2 is normal for Uniswap users, but a signed Permit2 message can move tokens, so only sign those messages on sites you trust.
Do I need to connect my wallet? Is my address stored?
No wallet connection, signature or account is needed. Your address goes from your browser straight to public Ethereum RPC nodes (PublicNode, with dRPC and 1RPC as fallbacks) as part of a read-only eth_call; GrowYourEthereum does not receive or store it. Never paste a seed phrase or private key into any website.
Does it check Base, Arbitrum or other networks?
No, Ethereum mainnet only. Approvals are per network: the same token on Base, Arbitrum or Optimism has separate allowances that this page does not read. revoke.cash and the Etherscan family of explorers cover other networks.
Educational security tool only, not financial or legal advice. Results come from public Ethereum data at the moment you check and cover only the listed tokens and spenders. GrowYourEthereum is not affiliated with Etherscan, revoke.cash or any protocol named here, and we never ask you to connect a wallet or sign a transaction.
