WalletConnect
Protocol and tooling for connecting wallets with applications.
WalletConnect is a protocol and set of tools that lets cryptocurrency wallets communicate with decentralized applications. A user can pair a wallet through a QR code, link, or app-to-app flow, approve a session, and receive requests in the wallet. Private keys remain under the wallet's signing system rather than being shared with the application.
During connection, the application proposes session rules such as supported networks, accounts, methods, and events. The wallet shows these details and lets the user approve or reject them. Once established, the session can carry requests to sign messages or transactions. Communication transport may use relay infrastructure or supported direct-link mechanisms depending on the integration.
WalletConnect matters because it separates the application interface from the wallet. A mobile wallet can authorize activity initiated on a desktop site without importing its seed into a browser extension. Applications can support many compatible wallets through common session standards. This improves interoperability, but users still need to understand what each session and request allows.
Pairing does not automatically transfer assets, yet later signatures can. A malicious site can request an unlimited approval, fraudulent order, or direct transfer through a legitimate WalletConnect session. Domain-verification features help wallets show matched, unknown, mismatched, or flagged origins, but they are warnings rather than guarantees. Users must confirm the actual domain and readable transaction details.
Sessions can remain active after a browser tab closes. Disconnecting prevents later session requests but does not cancel permissions already granted on-chain. Token allowances and NFT operator approvals require separate revocation transactions. Signed off-chain orders may remain valid until expiration or cancellation under their protocol. Wallets should make active sessions and permissions easy to review.
Users should open applications from trusted bookmarks, inspect session scope, reject unexpected prompts, and disconnect unused connections. Developers should request only necessary permissions, handle expiration and relay failures, present verified metadata, and support clear session deletion. Wallets should label the requesting origin and active account consistently across every prompt. Active session reviews should be routine. WalletConnect provides a secure communication channel, but application authenticity, wallet display, user decisions, and on-chain approvals determine the safety of the actions carried through it.
Frequently asked questions
- An application presents a pairing request through a QR code, deep link, universal link, or supported connection flow. The wallet receives a session proposal defining accounts, networks, methods, and events, then the user approves selected permissions. Later requests travel through the session for wallet review and signing. The wallet keeps private keys and should never send them to the application.
- The protocol protects communication, but it cannot make a malicious application safe or correct a harmful signature. Verify the domain, requested networks, accounts, methods, and every transaction. WalletConnect's Verify features can warn about domain matches, mismatches, unknown origins, or threats, but official documentation notes these checks are not foolproof. Reject unexplained prompts and suspicious links.
- Yes. End the session from the wallet and, where available, the application. Disconnection stops future requests through that session but does not revoke token approvals, NFT operator permissions, signatures, or transactions already recorded on-chain. Review and revoke unnecessary allowances separately using a trusted tool. Remove old sessions and investigate any request that continues after expected disconnection.