imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

imtoken

Device Security

Understand security boundaries around phones, browsers, public Wi-Fi, shared computers and remote-access tools.

On this page

Understand System updates first

Device Security brings several connected concepts together. A clear decision order is more reliable than memorizing interface steps. System updates tells you what is being reviewed now, while Browser environment and Public Wi-Fi provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Device Security workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With System updates, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving System updates, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how System updates relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

How Browser environment changes the workflow

To understand Browser environment, place it back inside the full Device Security workflow. Browser environment tells you what is being reviewed now, while Public Wi-Fi and Shared computers provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Device Security workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Browser environment, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Browser environment, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how System updates relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Build a review sequence around Public Wi-Fi

To understand Public Wi-Fi, place it back inside the full Device Security workflow. Public Wi-Fi tells you what is being reviewed now, while Shared computers and Remote tools provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Device Security workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Public Wi-Fi, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Public Wi-Fi, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how System updates relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Risks and common mistakes involving Shared computers

To understand Shared computers, place it back inside the full Device Security workflow. Shared computers tells you what is being reviewed now, while Remote tools and System updates provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Device Security workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Shared computers, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Shared computers, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how System updates relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.

Turn Remote tools into a repeatable habit

To understand Remote tools, place it back inside the full Device Security workflow. Remote tools tells you what is being reviewed now, while System updates and Browser environment provide context for whether the next action makes sense. Before proceeding, confirm that the wallet and network are the ones you intended to use, then review the address, contract or request origin. If the purpose is unclear or the network does not match, stop rather than guessing.

A reliable Device Security workflow keeps verifiable references such as the network name, address or contract address, transaction hash, block-explorer status and the exact permission being requested. Asset names and icons are useful hints but are not a substitute for on-chain identifiers. With Remote tools, avoid confirming something simply because it looks familiar; spoofed pages, wrong networks and malicious requests are designed to exploit that shortcut.

After an action involving Remote tools, review the result. If a transaction was created, use its hash to check broadcast, block inclusion and confirmations. If a DApp session or approval was created, identify the connected origin and permission scope, and consider disconnecting or revoking access when it is no longer needed. This turns a one-time action into a process you can verify later.

What to review in practice

  • Confirm the active network is the one you intended and understand how System updates relates to the action.
  • Verify addresses, contracts and request origins rather than trusting names or icons alone.
  • Before submission, review amount, gas, approval scope or signature details; afterward, keep verifiable on-chain references.
Security principle: Users remain responsible for their seed phrases and private keys. imtoken will never ask for a seed phrase, private key or verification code. Third-party DApps and smart contracts can carry risk, so review each signature and approval separately.

Related reading

Ready to use imtoken?

All download actions go through the dedicated download page.

Download imtoken