Ethereum Address Checksum (EIP-55)
Validate and convert Ethereum addresses to their correct checksummed format. Prevents loss from typos and spoofed addresses.
Input
Checksummed Result
Why Address Checksums Matter
Ethereum addresses are 40-character hexadecimal strings. Without checksums, these addresses are case-insensitive — meaning 0xab...cd and 0xAB...CD resolve to the same account. This creates a dangerous attack vector.
The Spoofed Address Attack
An attacker generates a vanity address that looks similar to a known address but uses different capitalization. For example:
Spoofed: 0xAe7eC8B3C...dE4f (attacker's address)
Real: 0xaE7eC8b3C...De4F (victim's address)
At a glance, they look identical. But the capitalization differs — and on networks without EIP-55 validation, both are treated as valid inputs. A user copies the wrong one, sends funds, and they're gone forever.
Real-World Incidents
- The "Poisoned Address" Attack (2023-2024) — Attackers sent dust transactions from spoofed addresses to victims' wallets. When the victim later copied an address from their transaction history, they accidentally copied the attacker's lookalike address. Estimated losses exceeded $100M+ across multiple victims.
- ENS Name Spoofing — Attackers registered ENS names similar to well-known entities and generated addresses with matching first/last characters, making manual verification unreliable without checksum validation.
- Clipboard Hijacking — Malware replaces copied Ethereum addresses with attacker-controlled addresses that share the same first and last characters. EIP-55 checksum verification catches this because the case pattern won't match.
How EIP-55 Works
EIP-55 encodes the address using the Keccak-256 hash of the lowercase address itself:
- Take the lowercase address (without
0x) - Hash it with Keccak-256
- For each character in the address: if the corresponding hash nibble ≥ 8, uppercase it
- The result is a mixed-case address where the casing is a cryptographic checksum
Any change to even a single character produces a completely different hash, making the checksum fail. This gives ~15 bits of error detection — catching 99.998% of typos.
Protect Yourself
- Always verify addresses using EIP-55 checksum before sending
- Compare the full address, not just first/last characters
- Use address book features in wallets for frequent recipients
- Test with small amounts first for new addresses
Frequently Asked Questions
▶ What is an EIP-55 checksummed address?
An EIP-55 checksummed Ethereum address uses mixed-case letters as a checksum. The capitalization pattern is derived from the Keccak-256 hash of the lowercase address, creating a cryptographic fingerprint that catches typos and spoofing attempts with 99.998% accuracy.
▶ Can I use lowercase Ethereum addresses?
Yes, lowercase addresses are valid and will work. But using the checksummed version adds a layer of safety — wallets and exchanges can detect if the address was altered or mistyped. Always prefer the checksummed format for copying and sharing addresses.
▶ Does EIP-55 work on L2 networks?
Yes. All EVM-compatible networks (Polygon, Arbitrum, Optimism, Base, Avalanche, etc.) use the same address format and support EIP-55 checksums. The checksum algorithm is identical across all EVM chains.
▶ What should I do if the checksum fails?
Stop immediately. Do not send funds to the address. A failed checksum means either there's a typo in the address or it has been deliberately modified (spoofed). Re-copy the address from the original source and verify again. If it still fails, contact the recipient through a different channel to confirm.
About the Address Checksum
Ethereum addresses are 20-byte hex values, and the raw form is case-insensitive - which makes a typo completely silent. If one character is wrong, your funds go to a valid-looking but wrong address, forever. EIP-55 checksumming fixes this: the casing of each letter encodes a hash of the address itself.
Paste any Ethereum address to verify its EIP-55 checksum or convert it to the checksummed form. A mistyped address produces a different casing pattern and fails validation instantly - catching errors before a transaction does. The checksum is computed with Keccak-256 entirely in your browser.
How to use
- Paste the Ethereum address (0x...).
- The tool reports whether the EIP-55 checksum is valid.
- Copy the properly checksummed form of the address.
- Use checksummed addresses in contracts and configs to catch typos.
Frequently Asked Questions
What is an EIP-55 checksummed address? ▾
An Ethereum address where each letter is capitalized according to a hash of the address itself (EIP-55). Any single-character typo changes the expected casing, so checksum validation catches the error before funds are sent.
Is an all-lowercase address invalid? ▾
No - lowercase is the raw, valid form. Checksum validation only applies when the address mixes upper and lower case. Tools and exchanges increasingly require the checksummed form because it is self-verifying.
Is this tool free to use? ▾
Yes! This tool is 100% free. No signup, no credit card, no limits. It's part of Formatho's privacy-first developer toolkit.
Is my data safe? Does this tool send data to a server? ▾
Absolutely. This tool runs entirely in your browser. Your data never leaves your device. Zero server-side processing, zero tracking.