imtoken Knowledge Center
Security
Build layered wallet security habits across backups, devices, signatures, approvals and transaction checks.
On this page
Protect the Most Sensitive Secrets First
Placing Protect the Most Sensitive Secrets First inside the full wallet workflow helps avoid decisions based only on balance displays, labels or third-party instructions. Security comes from a collection of habits rather than one setting: keep secret recovery material offline, keep devices under your control, verify domains and contracts, review old approvals and use a small test transaction when the context makes that useful. For concrete questions involving 助记词, use verifiable context instead of treating one successful past action as a permanent rule. If you cannot explain the purpose, target and expected result of a request, stop and verify it before continuing.
Protect the Most Sensitive Secrets First also makes more sense when it is evaluated within the full operation context. Public troubleshooting data must remain separate from secret credentials. A transaction hash, public address and network name can often help explain a problem; a seed phrase, private key, recovery phrase or verification code should never be sent to another person or entered into an ordinary web page. For imtoken users, the goal is not complexity. The goal is a workflow that can be checked: confirm the network, confirm the target and permission, then confirm the on-chain result. A practical security test is whether you can answer four questions before submitting: who, on which network, doing what, and with what scope.
Evaluate Every Request Independently
Decisions around Evaluate Every Request Independently should be grounded in information that can be verified on-chain rather than unconfirmed screenshots or messages. A wallet helps the user control keys and organize interactions, while the network is what records a valid transaction. Before an action, check the network, destination, amount or permission scope. After it, review status, confirmations and the transaction hash to verify what actually happened. For concrete questions involving 私钥, use verifiable context instead of treating one successful past action as a permanent rule. A practical security test is whether you can answer four questions before submitting: who, on which network, doing what, and with what scope.
Evaluate Every Request Independently also makes more sense when it is evaluated within the full operation context. Different networks can use similar address formats, and assets with similar names can exist on more than one chain. Icons and tickers are not enough for verification; network context, contract addresses and public explorer records provide stronger evidence. For imtoken users, the goal is not complexity. The goal is a workflow that can be checked: confirm the network, confirm the target and permission, then confirm the on-chain result. With that sequence in place, you can still make sound decisions even when the interface changes.
Device and Network Environment
A useful way to understand Device and Network Environment is to focus on the on-chain cause and effect, not the position of a button in an interface. If a request is unclear, declining it and verifying first is usually safer than trying to repair the consequences later. This matters especially for signatures, approvals and cross-network actions because a confirmed blockchain transaction generally cannot be reversed by the wallet alone. For concrete questions involving 签名, use verifiable context instead of treating one successful past action as a permanent rule. With that sequence in place, you can still make sound decisions even when the interface changes.
Device and Network Environment also makes more sense when it is evaluated within the full operation context. Security comes from a collection of habits rather than one setting: keep secret recovery material offline, keep devices under your control, verify domains and contracts, review old approvals and use a small test transaction when the context makes that useful. For imtoken users, the goal is not complexity. The goal is a workflow that can be checked: confirm the network, confirm the target and permission, then confirm the on-chain result. Turning these checks into a routine reduces errors caused by the wrong network, the wrong target or misunderstood permissions.
First Actions When Something Looks Wrong
When working with First Actions When Something Looks Wrong, identify the network, target and permission involved before deciding what to approve or submit. Public troubleshooting data must remain separate from secret credentials. A transaction hash, public address and network name can often help explain a problem; a seed phrase, private key, recovery phrase or verification code should never be sent to another person or entered into an ordinary web page. For concrete questions involving 授权, use verifiable context instead of treating one successful past action as a permanent rule. Turning these checks into a routine reduces errors caused by the wrong network, the wrong target or misunderstood permissions.
First Actions When Something Looks Wrong also makes more sense when it is evaluated within the full operation context. A wallet helps the user control keys and organize interactions, while the network is what records a valid transaction. Before an action, check the network, destination, amount or permission scope. After it, review status, confirmations and the transaction hash to verify what actually happened. For imtoken users, the goal is not complexity. The goal is a workflow that can be checked: confirm the network, confirm the target and permission, then confirm the on-chain result. If you cannot explain the purpose, target and expected result of a request, stop and verify it before continuing.
Security principles
Your seed phrase and private keys are controlled by you. imtoken staff will not ask for your seed phrase, private key or verification code. Review addresses, networks, amounts, signatures and approval scope before acting. Third-party DApps and smart contracts can carry risk, and confirmed on-chain transactions generally cannot be reversed by the wallet alone.