Security Center
Security
A practical imtoken guide to security, including core concepts, verification steps and risk-aware usage.
imtoken staff will never ask for your seed phrase, private key or verification code.
Core concepts
From a risk perspective, approval security and phishing detection deserve an independent review. Once a transaction is confirmed on-chain, a wallet normally cannot reverse it unilaterally. DApps and smart contracts can also introduce permission and contract risks, so every signature, approval and transfer should be understood before it is accepted.
For seed phrase protection, first define its role in the current task, then check whether private key protection and approval security are consistent. When phishing detection is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For transaction checks, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: seed phrase protection
- Cross-check: private key protection and approval security
- Review carefully: phishing detection
- Verify afterward: transaction checks
Checks before you act
After a Security task is completed, review transaction checks and seed phrase protection to make sure the outcome matches the intent. Long-lived approvals and persistent connections should be revisited periodically. Good wallet hygiene is a repeated process of checking critical details and retaining traceable on-chain information, not a one-time setting.
For private key protection, first define its role in the current task, then check whether approval security and phishing detection are consistent. When transaction checks is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For seed phrase protection, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: private key protection
- Cross-check: approval security and phishing detection
- Review carefully: transaction checks
- Verify afterward: seed phrase protection
How to evaluate a live request
To understand Security, treat approval security and phishing detection as parts of the same on-chain workflow. The interface is only the entry point; the selected network, current chain state and permission scope determine what actually happens. Confirm the destination, source and network before continuing so the meaning of the request stays clear.
For approval security, first define its role in the current task, then check whether phishing detection and transaction checks are consistent. When seed phrase protection is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For private key protection, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: approval security
- Cross-check: phishing detection and transaction checks
- Review carefully: seed phrase protection
- Verify afterward: private key protection
Risks and boundaries
phishing detection rarely appears in isolation. It often intersects with transaction checks and seed phrase protection. A useful pattern is to separate each action into four checks: identify the object, verify the network, review permissions, and confirm the result. If one of those checks cannot be completed, stop and verify rather than relying on an unfamiliar site or remote instructions.
For phishing detection, first define its role in the current task, then check whether transaction checks and seed phrase protection are consistent. When private key protection is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For approval security, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: phishing detection
- Cross-check: transaction checks and seed phrase protection
- Review carefully: private key protection
- Verify afterward: approval security
How to verify the outcome
When using imtoken for Security, prioritize information that can be independently verified, such as addresses, network names, contract addresses, transaction hashes and block-explorer records. Visual design, urgency messages or claims from an unknown support account are not substitutes for verifiable on-chain details.
For transaction checks, first define its role in the current task, then check whether seed phrase protection and private key protection are consistent. When approval security is involved, do not rely only on a default option; understand which account, asset or permission it may affect. For phishing detection, use on-chain records and the actual status as the source of truth. imtoken will not ask users to enter a seed phrase, private key or wallet recovery phrase on a web page, and it will not require remote control of a device for sensitive wallet actions.
- Confirm: transaction checks
- Cross-check: seed phrase protection and private key protection
- Review carefully: approval security
- Verify afterward: phishing detection
Security checklist
- Never share your seed phrase, private key or verification code.
- Verify the address, network and amount before sending.
- Review each DApp signature and token approval independently.
- Use transaction hashes and block explorers to verify on-chain status.
- Revoke approvals and disconnect sessions that are no longer needed.