What Is a Checksum Address? Crypto Address Safety (2026)

Intent check: This is the beginner friendly guide to what a checksum address is, why Ethereum addresses have a mix of capital and lowercase letters, and what that mix does and does not protect. It sits alongside How to Read a Wallet Signature Request.

Look closely at an Ethereum address and you will notice something odd. It is a long string of numbers and letters, and some of those letters are capitalised while others are not. That mix is not random and it is not decoration. It is a built in error check called a checksum, and it quietly protects you from one of the most painful mistakes in crypto: sending funds to a mistyped address.

This guide explains what a checksum address is, the problem it was designed to solve, how the capitalisation is actually decided, and, just as importantly, what a checksum cannot save you from. Understanding this small detail will make you read addresses more carefully and help you see why a single wrong character is not something any network will undo for you.

What Is a Checksum Address?

An Ethereum address is 40 hexadecimal characters, made up of the digits 0 to 9 and the letters a to f. At the protocol level the network does not care about capitalisation at all. The all lowercase version and a mixed case version of the same address point to exactly the same place. So why do wallets show a mix?

The answer is a standard called EIP-55. It uses the pattern of capital and lowercase letters to encode a checksum, a small piece of verification data derived from the address itself. A checksummed address carries a built in fingerprint. If even one character is wrong, the capitalisation pattern will almost certainly no longer match, and wallet software can flag the address as invalid before you ever hit send.

The Problem It Solves

Crypto transactions are final. There is no support line that can claw back a transfer, and there is no undo button. If you send tokens to an address that exists but was not the one you meant, those tokens are almost always gone for good. Given that addresses are long, unfamiliar strings, a single typo is a very real risk, especially for anyone typing or hand copying one.

The checksum exists to catch exactly this class of error. It cannot know which address you meant to use, but it can detect when the address in front of it has been corrupted from a valid checksummed original. That turns a large share of typos into an obvious error message instead of a silent, permanent loss.

How EIP-55 Actually Works

The mechanism is elegant and worth understanding at a high level, even if you never compute it by hand.

Start with the address in all lowercase. Run it through the keccak-256 hash function, which produces a long deterministic output. Then walk through the address one character at a time. For each letter, the corresponding value in the hash decides whether that letter is written in uppercase or lowercase. Digits from 0 to 9 are left alone, because they have no uppercase form. The result is an address whose specific pattern of capital letters is mathematically tied to its contents.

Because the pattern comes from a hash of the whole address, changing any single character produces a completely different expected pattern. A wallet can recompute the expected capitalisation and compare. If it does not match, the address is rejected. This catches the overwhelming majority of accidental single character mistakes.

An all lowercase address is still technically valid, but it carries no checksum protection. The mixed case version is the same address with an error detecting layer switched on.

What Your Wallet Does With It

When you paste an address into a modern wallet, it usually checks the capitalisation against the EIP-55 rules in the background. If the address is properly checksummed, it passes silently. If it is mixed case but the pattern is wrong, the wallet warns you that the address looks invalid, which is your cue to stop and recheck the source. If it is all lowercase, many wallets accept it but cannot offer the same safety net, because there is no checksum to verify.

This is one of several safety layers that sit between you and a mistake. It works together with reading each transaction carefully before you sign, a habit covered in How to Read a Wallet Signature Request.

What a Checksum Cannot Protect You From

This is the part most guides skip, and it matters. A checksum only detects corruption of a specific address. It does nothing about a wrong address that is itself perfectly valid.

Address poisoning. Scammers seed your transaction history with an address that looks similar to one you use. If you copy it from your history, it is a valid checksummed address, so no warning appears. The checksum has nothing to catch.
Clipboard malware. Some malware silently swaps an address you copied for the attacker's own. The replacement is a real, valid address, so it passes every checksum test.
Sending to the right format, wrong network or wrong contract. A checksum confirms an address is internally consistent, not that it is the destination you actually intended.

In every one of these cases the address is valid, so the checksum stays quiet. The only defence is verifying the destination itself.

How to Verify You Have the Right Address

Check the whole thing, not just the ends. Attackers match the first and last few characters. Verify several characters in the middle too, or compare the full string.
Get the address from the official source every time. Do not reuse an address from your transaction history, and be suspicious of any address that arrives in a message.
Send a tiny test amount first when moving a large balance to a new address, then send the rest once it arrives.
Confirm the address on a block explorer so you know it matches the contract or wallet you expect. If DEXTools is your starting point, see How to Read DEXTools Charts for Beginners.

Key Takeaways

The mix of capital and lowercase letters in an Ethereum address is a checksum defined by EIP-55.
It is an error check that catches most accidental typos before you send.
The capitalisation pattern is derived from a keccak-256 hash of the address, so any change breaks the pattern.
An all lowercase address is valid but has no checksum protection.
A checksum cannot stop address poisoning, clipboard malware, or simply choosing the wrong valid address, so always verify the destination yourself.

The capital letters scattered through an address are a small piece of engineering doing a quiet, important job. They will catch your fumbled keystroke, but they will not catch a valid address that is the wrong one. Treat the checksum as a seatbelt, useful and worth having, but never a substitute for looking where you are going.

This article is educational and is not financial advice. Always do your own research and verify addresses from official sources before sending funds.