CRYPTOGRAPH™
Ethereum · ETH
Your iPhone connects to apps and prepares requests. You approve transfers, contract actions, messages, and permissions on Apple Watch.
Current support
Native assets, token standards, and connection methods differ by network.
On Apple Watch
An Ethereum request can transfer value, grant spending authority, or delegate control of the account. Apple Watch treats each as a different authorization.
Network-specific security
Apple Watch builds the approval from its own parse of the signed input or typed data. The iPhone cannot supply a separate trusted summary.
Immediately before signing, the watch parses the payload again. A missing display field, changed schema, unknown token unit, or chain mismatch stops key use.
Ethereum security
Transfers, token permissions, messages, and account delegation do not share one approval model. Cryptograph gives each its own watch-side checks.
Apple Watch binds the signing account to the key it derives. It matches the EIP-155 chain ID, destination, value, nonce, transaction mode, and gas ceiling to the signed input. A cross-chain mismatch or unsupported field stops the request.
ERC-20 amounts use decimals from the watch-reviewed asset registry for that contract and chain. Cryptograph refuses unverified token units and swap paths instead of guessing.
Permit2, DAI Permit, and ERC-2612 requests are decoded as spending authority. ERC-2612 review includes the owner, token, spender, amount, nonce, deadline, domain, chain, and verifying contract.
Personal-sign requests show the complete UTF-8 message and bind review completion to its byte count and digest. Empty messages, invisible controls, and unreviewable bytes cannot reach approval.
The watch reparses the exact payload and repeats the display contract immediately before key use. After approval, the iPhone checks the nonce and fee state again before broadcast and requires a fresh review if either changed.
Cryptograph lists active ERC-20 and Permit2 allowances with the spender, token, amount, and risk. Permit2 entries also show expiration. A revoke request sets the allowance to zero and receives its own approval on Apple Watch.
Verified contract registry
Cryptograph checks each contract address and chain against a registry built into the app. Apple Watch names recognized contracts. Unknown contracts show their full address and a warning.
With Time Lock active, you must complete the delay before approving an unknown contract call or spender. The registry changes only with an app update.
Verification identifies the address Cryptograph reviewed. It does not promise that the protocol has no bugs.
Current limit
Cryptograph does not support raw eth_sign requests. An opaque digest can conceal a transaction hash, so there would be no complete transaction for Apple Watch to show you.
Through WalletConnect, set-code transactions, access lists, user operations, unknown typed-data schemas, and contract calls without complete disclosure are blocked.