EIP-55: How Ethereum's Mixed-Case Checksum Protects Your Addresses

Every Ethereum address is 40 hexadecimal characters preceded by 0x. Hexadecimal uses the digits 0 through 9 and the letters a through f, which means the letters in an Ethereum address can be written in uppercase or lowercase without changing the address itself — 0xab5801a7 and 0xAB5801A7 refer to the same account.

But if you've looked closely at Ethereum addresses displayed by MetaMask, Etherscan, or any modern wallet, you've noticed that the letters aren't uniformly uppercase or lowercase. They're a specific mix of both — and that mix is not random. It's a checksum defined by EIP-55, a simple but effective error-detection mechanism created by Vitalik Buterin and Alex Van de Sande in 2016.

This article explains what EIP-55 does, how the checksum algorithm works, why it matters, and how our EIP-55 checksum address tool can validate and convert addresses.

The Problem: No Built-In Error Detection

When Ethereum was first designed, addresses had no error-detection mechanism. Bitcoin had already solved this problem with Base58Check encoding, which appends a 4-byte checksum to every address. If you mistype a single character in a Bitcoin address, the checksum almost certainly won't match, and your wallet will reject the address as invalid.

Ethereum addresses, by contrast, are plain hexadecimal strings. The original design used all-lowercase addresses. If you accidentally changed one character — typing a b instead of a d, for example — the result was a valid-looking address that pointed to a completely different (and almost certainly empty) account. Your funds would be sent to an address nobody controls, and there would be no way to recover them.

This was a serious user-experience gap. Blockchain transactions are irreversible. An error-detection mechanism that catches even a small percentage of typos before they become permanent fund losses is enormously valuable.

How EIP-55 Works

EIP-55 adds a checksum to Ethereum addresses by selectively capitalizing the hexadecimal letters. The algorithm is remarkably simple:

First, take the Ethereum address and remove the 0x prefix, leaving the 40-character hex string in all lowercase.

Second, compute the Keccak-256 hash of that lowercase hex string. This produces a 64-character hex hash. You can compute this using our Keccak-256 hash generator.

Third, iterate through the 40 characters of the address. For each position, if the character is a letter (a through f), look at the corresponding nibble (hex digit) in the hash. If that nibble's value is 8 or greater, capitalize the letter. If it's 7 or less, keep it lowercase. Digits (0 through 9) are unchanged because they have no uppercase form.

Fourth, prepend 0x to the result.

That's the entire algorithm. No extra characters are added. The address length stays at 42 characters (including the 0x prefix). The only change is the casing of the letters — but that casing now encodes checksum information derived from the Keccak-256 hash of the address itself.

An Example

Take the address 0x5aaeb6053f3e94c9b9a09f33669435e7ef1beaed (all lowercase).

Hash the lowercase hex string 5aaeb6053f3e94c9b9a09f33669435e7ef1beaed with Keccak-256. The resulting hash starts with specific hex digits.

For each letter in the address, check the corresponding hash nibble. If the hash nibble at that position is 8, 9, a, b, c, d, e, or f (i.e., its integer value is 8 or higher), capitalize the letter. Otherwise, keep it lowercase.

The result is 0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed — the official EIP-55 checksummed version of that address. Every wallet and block explorer that implements EIP-55 will display this exact mixed-case version.

Checksum Strength

Each letter in the address has a roughly 50 percent chance of being uppercase or lowercase based on the hash output. Since the average Ethereum address contains about 15 hex letters (out of 40 hex characters), EIP-55 provides approximately 15 check bits per address.

The probability that a randomly modified address will accidentally pass the checksum is approximately 0.0247 percent — about 1 in 4,000. This means that if you randomly change one or more characters in a checksummed address, there is a 99.98 percent chance the checksum will detect the error.

This is not as strong as Bitcoin's 4-byte (32-bit) checksum, which catches errors with 99.99999998 percent probability. But it is dramatically better than no checksum at all, and it achieves its error detection without adding any extra characters to the address — a key design advantage.

Backwards Compatibility

One of EIP-55's most elegant features is its backwards compatibility. Any system that treats hex as case-insensitive — which is the standard interpretation — will accept a checksummed address as identical to its all-lowercase or all-uppercase equivalent. Old software that doesn't implement EIP-55 simply ignores the casing and processes the address normally. New software that does implement EIP-55 can validate the casing and warn the user if the checksum doesn't match.

This means EIP-55 could be introduced gradually across the ecosystem without breaking any existing functionality. Wallets, exchanges, and dApps adopted it incrementally, and today virtually all Ethereum software validates EIP-55 checksums.

Addresses in all-lowercase or all-uppercase are treated as not checksummed — they bypass validation. Only mixed-case addresses trigger checksum verification. This prevents false alarms from legacy software that outputs all-lowercase addresses.

Why Keccak-256?

EIP-55 uses Keccak-256 — the same hash function that Ethereum uses throughout its protocol for address derivation, transaction hashing, state tree construction, and the ABI function selector mechanism described in our article on ABI encoding. Using Keccak-256 rather than SHA-256 or another hash function keeps the implementation simple, since every Ethereum client already has Keccak-256 available.

The choice of hash function doesn't significantly affect the checksum's error-detection strength — any good hash function produces pseudorandom output that provides the roughly 50/50 uppercase/lowercase distribution EIP-55 needs. What matters is that the function is deterministic and widely available, both of which Keccak-256 satisfies.

When Checksums Fail

EIP-55 catches most accidental typos, but it is not infallible. Approximately 1 in 4,000 random modifications will accidentally produce a valid checksum. And there are scenarios where EIP-55 provides no protection at all.

Copy-paste substitution attacks replace an entire address with a different valid checksummed address. If malware on your clipboard swaps your intended recipient's address with the attacker's address, the attacker's address will have its own valid EIP-55 checksum. The checksum only detects random errors — it cannot detect deliberate substitution. Always verify addresses by checking multiple characters, not just the first and last few.

Cross-chain address confusion is another risk. Ethereum addresses and addresses on EVM-compatible chains (Polygon, Arbitrum, BNB Chain, Avalanche C-Chain, and others) use the same format. An address that is valid on Ethereum is technically valid on every EVM chain. EIP-55 cannot tell you whether an address exists or has funds on any particular chain — it only validates that the checksum is correctly formatted.

ICAP format (International Bank Account Number-compatible Ethereum addresses) is an alternative representation that EIP-55 doesn't cover. ICAP addresses are rarely used in practice, but they exist in the Ethereum specification.

How Our Tool Works

Our EIP-55 checksum address tool accepts an Ethereum address in any format — all lowercase, all uppercase, or mixed case — and outputs the correctly checksummed version. If you paste a mixed-case address, the tool also validates whether the existing checksum is correct and warns you if it isn't.

You can use this tool to validate addresses before sending transactions, to convert all-lowercase addresses from older software into checksummed format, or to verify that an address displayed by a dApp or exchange matches the expected checksum.

For related tools, our crypto address validator checks whether an address is structurally valid across multiple blockchain formats. Our Keccak-256 hash generator lets you compute the hash used in the checksum algorithm. And for understanding the hexadecimal system that underpins Ethereum addresses, our hex-decimal converter and our article on hex, RGB, and HSL color models provide broader context for working with hex values.

EIP-55 and Smart Contract Addresses

EIP-55 applies equally to externally owned accounts (wallets controlled by private keys) and smart contract addresses. Contract addresses are derived deterministically from the deployer's address and nonce (or, for CREATE2, from the deployer, salt, and init code hash), and the resulting address is checksummed with the same algorithm.

This is particularly important for developers deploying contracts. If documentation or configuration files contain a contract address, that address should always be in EIP-55 checksummed format. Any integration that compares addresses should either normalize both addresses to the same case or perform a case-insensitive comparison — a common source of bugs in dApp development.

The Bottom Line

EIP-55 is one of those rare protocol improvements that is trivially simple to implement, perfectly backwards compatible, and meaningfully protective against real-world errors. By encoding a Keccak-256-derived checksum in the casing of hexadecimal letters, Ethereum addresses gain error detection without gaining extra characters, without requiring any protocol changes, and without breaking any existing software. It catches approximately 99.98 percent of random transcription errors — and while it can't protect against deliberate address substitution or phishing, it's an essential first layer of defense that every wallet, exchange, and dApp in the Ethereum ecosystem now supports. Use our EIP-55 checksum address tool to validate any address before trusting it with your funds.

References

EIP-55: Mixed-case checksum address encoding — The original Ethereum Improvement Proposal by Vitalik Buterin and Alex Van de Sande.

Medium — EIP-55 Explained: Solving the Address Checksum Problem — Walkthrough of the motivation and implementation.

Ethereum.org — Accounts — Official documentation on Ethereum account types and address format.

Wikipedia — Ethereum — General reference for the Ethereum protocol.