A Web3 wallet is a crypto wallet designed to connect to decentralized applications (DApps), not just to send and receive coins. It runs as a browser extension or mobile app, holds the user's keys, and lets websites ask it to reveal an address, sign a message or approve a transaction. Traders on a decentralized exchange (DEX), collectors buying non-fungible tokens (NFTs), and members voting in a decentralized autonomous organization (DAO) all use one.
The term grew up alongside Web3, the idea of web services built on public blockchains. MetaMask, first released by ConsenSys in 2016, is the best-known example; others include Coinbase Wallet, Rabby, Phantom on Solana and many exchange-branded apps. Most Web3 wallets are non-custodial and, because they stay online, are a type of hot wallet.
Web3 wallet in plain terms
Imagine a single membership card that works at hundreds of clubs. Instead of creating a username and password at each club, you show the card at the door, and the club recognises you by the card number. When you want to buy something inside, the club hands you a slip and you stamp it with your personal seal.
A Web3 wallet is that card and seal. The card number is your wallet address, which websites use instead of an account login. The seal is your private key, used to stamp every payment or agreement. The wallet's job is to show you each slip clearly before you stamp it, because a stamped slip cannot be taken back.
How a Web3 wallet connects to applications
Browser-extension wallets on Ethereum-style chains place a "provider" object in each web page. The interface for this object is standardised in Ethereum Improvement Proposal (EIP) 1193, and EIP-6963 later added a way for several installed wallets to announce themselves so they do not fight over the same page. A DApp calls the provider to request the user's accounts; the wallet asks the user to approve the connection, then returns the wallet address.
Mobile wallets connect in a different way. WalletConnect, an open protocol introduced in 2018, lets a website show a QR code or deep link; the phone wallet scans it and opens an encrypted session through a relay network, so signing requests travel to the phone and signatures come back. This is how many desktop DApps work with mobile wallets and with hardware devices.
Once connected, the wallet handles three kinds of request:
- Transactions. Calls to a smart contract (SC) such as a swap or a deposit, which the wallet signs and broadcasts, paying a gas fee in the chain's native token.
- Token approvals. Permissions allowing a contract to move a set amount of an ERC-20 token, which many DApps need before they can trade on the user's behalf.
- Message signatures. Off-chain signatures used to log in ("Sign-In with Ethereum"), list an NFT for sale or authorise a gasless transfer.
Features beyond sending and receiving
Web3 wallets usually support many networks, including Layer 2 rollups and Ethereum-compatible blockchains, and let users switch between them. Many resolve human-readable names from the Ethereum Name Service (ENS), display NFTs, and offer built-in swaps. Newer designs based on ERC-4337 account abstraction, and the EIP-7702 upgrade that lets an ordinary account use smart-contract code (see address delegation), add batched transactions, gas sponsorship and recovery options.
Risks and safety practices
Because a Web3 wallet will sign whatever the user approves, most losses come from approving the wrong thing rather than from broken cryptography. Common problems include:
- Drainer sites. Phishing pages copy a real DApp and ask for an unlimited token approval or a signature that transfers assets.
- Blind signing. Some signature requests are shown as unreadable data, so users cannot tell what they authorise.
- Lingering approvals. Unlimited approvals granted to a contract stay active until revoked, and remain dangerous if that contract is later exploited.
- Seed phrase theft. Fake support staff and fake wallet extensions ask for the seed phrase, which no legitimate service needs.
- Unwanted tokens. Unknown tokens sent to the address, as in a dusting attack, may link to scam sites when users try to sell them.
Good practice is to keep a separate wallet for experimenting with new DApps, pair the extension with a hardware device for larger balances, read each prompt, set approval limits instead of unlimited amounts, and review and revoke approvals regularly. Many wallets now simulate transactions and warn about known malicious addresses before the user signs. None of these checks helps if the user types the recovery words into a website, so the seed phrase should be kept offline and never entered anywhere except the wallet itself during a restore.