How to Revoke Permissions on MetaMask & Check All Permissions

Learning how to revoke permissions on Metamask is one of the simplest ways to protect your wallet from drainers, bad contracts, and leftover token approvals you forgot about.

Revoking a token approval stops a dApp or smart contract from moving your tokens, even if you have already disconnected from the site. That single point catches many users off guard: disconnecting only cuts the session, it does not remove the contract’s permission to move assets.

If you clicked ‘Approve’ on a random site, rushed through a swap, or used a dApp during a hype cycle, you may have granted unlimited spending rights to you without realizing it. That’s normal. Most dApps push ‘infinite unlock’ by default because it reduces gas costs. 

The UX naturally pushes speed over safety, and you pay the price later. How? Well, you may end up worrying you clicked the wrong button and now someone can drain your tokens at any moment. Or you might think disconnecting was enough, so you move on, unaware the contract still has full access. 

RugDoc’s Diagnosis: Crypto approvals can also create confusion around which permissions matter, which tokens are exposed, and whether third-party revocation tools are safe to use.

This guide aims to cut through the confusion. We’ll show you how to check wallet permissions, how to revoke them safely inside MetaMask, and how to use trusted tools like Etherscan’s Token Approval checker. 

What Permissions Mean in MetaMask

Permissions in MetaMask control what a dApp or smart contract is allowed to do with your wallet. The most important permission is the token spending approval. When you approve a contract, you allow it to move a specific token on your behalf. 

The token spending approval can be limited or unlimited. The dangerous part is that, until you revoke it, the contract keeps that access even if you never visit the site again.

Most swaps, farms, mints, bridges, and NFT marketplaces rely on these approvals. They are normal, but they create risk when you leave them open for months or forget which contracts you interacted with. If a contract is compromised or was malicious from the start, it can drain any token it has permission to spend.

Disconnect vs Revoke Permissions

Disconnecting only severs your browser session with a dApp. It stops the site from reading your wallet address or prompting new requests. But it does not remove any token approvals you granted earlier. Think of disconnecting as closing the browser tab. 

Revoking removes the contract’s permission to move your tokens. Once revoked, the contract cannot spend or transfer your assets again unless you manually approve it in the future. This is the action that actually protects your funds.

Disconnecting feels safe, but revoking is what cuts the access.

Emergency Checklist to Verify Permissions Risk

If you interacted with a suspicious dApp or approved a contract you do not recognize, act fast. The goal is to stop any contract that could move your tokens. Run through this checklist:

1. Disconnect from the suspicious dApp: Cut the live connection so the site cannot trigger new requests. Remember, this does not stop existing token approvals, but it removes immediate interaction.
2. Check all active approvals for the affected wallet: Use a trusted tool like Etherscan’s Token Approval Checker or MetaMask’s ‘Spending Cap’ view. These tools show every contract that can move your assets. Focus on tokens with real value first.
3. Revoke high-risk approvals immediately: If you see a contract you do not recognize, or you know you approved something during a rushed transaction, revoke it. Anything with unlimited allowance should go to the top of the list.
4. Move funds to a fresh address if you suspect a drainer: If the dApp was malicious or the contract looks dangerous, transfer your assets to a clean wallet. A compromised approval can be revoked, but a compromised seed phrase cannot.
5. Monitor the wallet for pending or unexpected transactions: Any unrequested approvals, gasles signatures, or failed interactions can signal an attack attempt.
6. Re-verify using a second trusted tool: Double-check with another reliable platform like DeBank or revoke.cash for peace of mind. Cross-verification is one of the fastest ways to confirm you shut down all dangerous access.

This checklist keeps you ahead of most approval-based attacks and helps you lock down your wallet before any funds move.

How to Revoke MetaMask Permissions 

Revoking permissions in MetaMask removes a contract’s ability to move your tokens. This is the only action that fully cuts off access after you’ve clicked ‘Approve.’ You can do it directly inside MetaMask for many dApps, or you can use trusted external tools that scan every contract your wallet ever approved.

Here is a clear walkthrough using MetaMask’s Spending Cap controls, followed by optional steps using third-party checkers like revoke.cash and Etherscan’s Token Approval Checker.

Step 1: Open MetaMask Portfolio

Go to your portfolio dashboard on the MetaMask web app and connect your wallet.

You cannot revoke spending caps through the extension or mobile app, so this is the required starting point.

Step 2: Switch to the ‘Spending Caps’ Tab

In the dashboard, select the ‘Spending Caps’ tab. This will now show every token allowance active on your wallet, across all networks.

Step 3: Review All Active Allowances

You will see a list of contracts that can move your tokens. Focus on:

• Unlimited allowances
• Contracts you do not recognize
• Old interactions from farms, mints, bridges, or test sites

Stablecoins and blue chips should always be checked first because they’re the highest-value targets for drainers.

Step 4: Revoke the Spending Cap

Next to any contract, you can click ‘Revoke.’ MetaMask will open a transaction window where you will need to confirm it to reset the allowance to zero.

Each revocation requires you to pay a gas fee, but it instantly removes the contract’s ability to move the token again.

Step 5: Repeat for Other Tokens 

Now you can work your way through the list from highest-value assets to those with smaller exposure.

Treat this like wallet maintenance. Cleaning up old allowances prevents long-term risk from forgotten interactions.

Even if you choose to revoke within MetaMask using the ‘Spending Tab,’ we still recommend double-checking with another trusted tool like revoke.cash or Etherscan Token Approval Checker.

How to Revoke Permissions Using revoke.cash

revoke.cash is one of the most widely used tools for clearing token approvals. It works with MetaMask, supports 100+ networks, and gives you a full list of every contract that can move your tokens. 

Start by opening revoke.cash and either connect your wallet or paste your address into the search bar. Here you can choose the network you want to review. Once the tool loads, you will see a complete list of approvals for that chain.

You can sort the list, apply filters, or search by spender address. If you think you approved something malicious, sort by ‘Newest to Oldest’ so the most recent approvals appear at the top. This makes it easy to catch suspicious contracts you interacted with minutes or hours earlier.

When you find an approval you want to remove, click the ‘Revoke’ button. MetaMask will then prompt a transaction to remove the permission for the contract to spend tokens from your account. After clicking ‘Confirm’, you can return to the revoke.cash dashboard and wait a few moments while the tool revokes your asset.

How to Revoke Permissions Using an Explore (Etherscan, Polygonscan, BscScan)

You can also revoke token approvals directly from a block explorer. Etherscan’s Token Approval Checker is the most common example. But this process is similar across most major explorers.

Open Etherscan and navigate to ‘More → Services → Token Approvals.’ Paste your wallet address to load the approvals for that address.

This will allow you to view all contracts that are approved spenders. Choose the token standard you want to check (ERC20, ERC721, ERC1155) and toggle ‘Show all approvals’ so you can see every contract with access.

But to actually revoke a permission, you must connect your wallet through the ‘Connect to Web3’ button. Without connecting, the revoke button will remain inactive.  

After connecting your wallet, you can review the list, find the contract you want to remove, and click ‘Revoke.’ You will need to click ‘Revoke’ one more time to approve the pop-up on Etherscan and then confirm the gas payment via MetaMask to reset the contract’s allowance to zero.

How to Develop Permission Hygiene

Good permission hygiene keeps your MetaMask wallet clean so you do not rely on emergency revokes every time you interact with a new dApp.

The goal is simple: reduce unlimited approvals, avoid shady contracts, and make it harder for anything unexpected to move your tokens. A few habits go a long way.

Below is a quick reference table you can use to prevent the most common mistakes.

Common Permissions Mistake	How to Avoid
Approving unlimited spending for every token	Set a custom spending cap for the exact amount you need
Clicking ‘Approve’ on a site you visited for the first time	Bookmark official URLs and avoid links from DMs or comments
Forgetting old allowances from past farms and mints	Do a monthly approval check using MetaMask or a trusted tool
Assuming ‘Disconnect’ removes token access	Treat disconnecting as step one. Revoking is the actual protection
Using new dApps during hype cycles without checking contracts	Verify the contract address on Etherscan before approving anything
Approving stablecoins on risky sites	Always check stablecoin approvals first. They are prime drainer targets
Keeping all assets in one wallet	Spread funds across multiple addresses to limit exposure

Build these habits early and you reduce the need for reactive fixes later. Clear approvals, custom caps, and verified links are the easiest way to keep your wallet safe day to day.

Revoking Token Approvals and Smart Contract Allowances is Sometimes Necessary 

Revoking token approvals is not something you only do after a scare. It is part of normal wallet maintenance, the same way you clear old browser extensions or unused app permissions on your phone. 

Any time you interact with a dApp, there is a chance you granted more access than you meant to. Especially if you accepted an unlimited allowance or rushed through a transaction during a busy moment.

Taking a few minutes to review and revoke old approvals removes leftover risks. It stops forgotten contracts from moving your tokens, reduces exposure to compromised dApps, and gives you a clear picture of which services you still trust with spending rights.

Using MetaMask Spending Tabs and trusted tools like revoke.cash or Etherscan Token Approval makes this process simple. A clean allowance list keeps your wallet safer, your approvals intentional, and your Web3 experience far more secure.

FAQs

References

1. https://etherscan.io/tokenapprovalchecker?search=0xdac17f958d2ee523a2206206994597c13d831ec7
2. https://www.coinbase.com/learn/crypto-glossary/what-is-erc-20
3. https://www.investopedia.com/terms/d/decentralized-applications-dapps.asp
4. https://metamask.io/
5. https://bscscan.com/
6. https://debank.com/
7. https://revoke.cash/
8. https://www.coinbase.com/learn/crypto-glossary/what-is-erc-20