Token approvals let a dApp move tokens on your behalf. That capability is convenient for swaps and staking. But it is also a persistent permission: once you approve a spender, that allowance stays on-chain until it is changed or removed. I tested both desktop and mobile flows so you can reproduce the steps yourself (details below). And yes—revoking approvals requires an on-chain transaction (so gas fees apply).
When you approve an ERC-20 token (or other token standard) you write an allowance to the token contract: the contract records how many tokens a "spender" (a smart contract address) can move using transferFrom. Token approval is different from a wallet connection. Disconnecting a site from MetaMask prevents the site from initiating new RPC requests to your account in that browser session, but it does not change on-chain token allowances.
Why does that matter? Because a malicious contract (or a compromised dApp) can drain tokens if you leave an unlimited token allowance open. Should you revoke everything? Not always. But you should limit allowances and check them regularly.
Transparency: here's my test plan so you can reproduce the checks I ran.
If you want to reproduce those steps: use a small test amount, use a testnet first, and confirm tx hashes before you approve or revoke.
These steps show the difference between site connections and token approvals. They are related but distinct.
Note: Disconnecting here does not revoke token approvals stored on-chain.
Mobile users often search for "metamask connected sites mobile" when sites refuse to reconnect—usually the fix is to disconnect and re-open the dApp. But if you see many old entries, consider revoking allowances too.
Because token approvals are on-chain, revocation requires a transaction. Below are two common approaches.
Screenshot placeholder: 
But be careful: connecting to any third-party site carries risk. I always verify the domain, check community trust, and do a small test revoke before mass changes.
| Method | Where | On-chain tx required? | Pros | Cons |
|---|---|---|---|---|
| MetaMask “Disconnect” | Extension / Mobile | No | Quick; removes live session | Does not change token allowances |
| Explorer token-approvals | Browser (connect wallet) | Yes | Direct, transparent | Requires gas; must trust domain |
| Permission-revoke service | Web UI | Yes | Batch UI, friendlier | Extra trust surface; still on-chain |
But don't panic. Acting fast reduces further risk.
Q: Is it safe to keep crypto in a hot wallet? A: Hot wallets are convenient for daily DeFi and swaps. I use them daily for small balances and a hardware wallet for larger holdings. Hot wallets are non-custodial but exposed to phishing, so practice good link hygiene and limit approvals.
Q: How do I revoke token approvals? A: You revoke by sending an on-chain transaction that sets the token allowance to zero (or a lower amount). See the step-by-step above. If you're unsure, test on a public testnet first.
Q: What happens if I lose my phone? A: Losing a phone doesn’t immediately give an attacker access to your seed phrase, unless the phrase was stored on the phone. If you used cloud backups for recovery phrases, that creates extra risk. See backup-and-recovery-seed-phrase for more.
Q: How often should I check approvals? A: Monthly is a minimum for casual users. Weekly if you actively swap or interact with new dApps. I check mine each time I do a large swap.
Token approvals are a powerful convenience and a persistent risk. You can remove unnecessary permissions, but remember revocation is an on-chain action that costs gas. I recommend using a testnet to practice the flow, disconnecting unknown connected sites (see disconnect-and-remove-connected-sites), and using burner accounts for active trading.
Explore related guides: Connect MetaMask to dApps, Connected sites on mobile, and Token management and custom tokens.
Want a compact checklist? Use this: (1) disconnect old sites, (2) review allowances, (3) revoke unneeded approvals, (4) move large balances to hardware. Simple. And repeat.