# eth-sig-util: the small signing library behind MetaMask's key handling

> @metamask/eth-sig-util is a TypeScript package of functions for signing and verifying data with Ethereum keys, published on npm under the ISC licence and used across MetaMask's own libraries. It exposes four entry points for general signing, encryption, personal sign and typed data, and it follows a documented release process with manual npm publishing.

**MetaMask/eth-sig-util** — A collection of functions for signing and verifying data with Ethereum keys.

- Repository: https://github.com/MetaMask/eth-sig-util
- Stars: 584 · Forks: 231
- Language: TypeScript
- License: ISC
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/metamask-eth-sig-util

## A small package with four deliberately separate entry points

The package describes itself as a small collection of Ethereum signing functions, and the repository description calls it a collection of functions for signing and verifying data with Ethereum keys. The export map in the package manifest shows how small and how deliberate it is. There are four entry points: the root export at dist/index.js, then dist/encryption.js, dist/personal-sign.js and dist/sign-typed-data.js. The package description is even more spare, a few useful functions for signing ethereum data. The audience is a developer working in TypeScript who needs to sign or verify a payload and does not want a wallet library, and the split into entry points means an application can pull in only the scheme it uses rather than the whole surface.

## The dependency set explains what it actually does

The runtime dependencies are the best available description of the library's mechanics, since the README does not walk through them. There is @ethereumjs/rlp for the recursive length prefix encoding that Ethereum data uses, and @ethereumjs/util alongside @scure/base and ethereum-cryptography for the underlying key and hash primitives, with tweetnacl providing the NaCl-style signing operations. The MetaMask packages @metamask/abi-utils and @metamask/utils supply the typed data and ABI handling. The architecture that emerges is a thin, dependency-light layer over well known primitives, with the MetaMask-specific work concentrated in typed data and ABI encoding rather than in cryptography. The build is a plain TypeScript compile, tsc --project ., with typedoc for the API documentation and a prepack script that runs before publishing, so the published artefact is the compiled dist directory and nothing else.

## Installing it takes one package manager command

Installation is documented with two alternatives, either of which pulls the same package from npm:

```bash
`yarn add @metamask/eth-sig-util`
```

or

```bash
`npm install @metamask/eth-sig-util`
```

The full API documentation for the latest published version is hosted separately, and the README points at that site rather than duplicating the function list, which is the usual arrangement for a package this size. The repository is TypeScript throughout, with src for the source, tests run under jest, a typedoc.json for the documentation generator, and a yarn.lock with a .yarn directory indicating Yarn's modern install layout.

## The release process is a documented, human-approved pipeline

The release section is the most detailed part of the README and it is worth reading, because it tells you what to expect when you pin a version. The project follows the same release process as the other libraries in the MetaMask organisation, using two GitHub Actions, action-create-release-pr and action-publish-release. A release starts by choosing a version according to SemVer, analysing the changes for breaking changes, new features or deprecations. Backports need a major version branch set to the most recent release of that major version. The Create Release Pull Request workflow is then triggered manually with workflow_dispatch, the changelog is updated and validated with yarn auto-changelog validate --rc, the release is reviewed and squashed, and the publish workflow tags the commit. Publishing to npm is a separate job, publish-npm, which waits for a run approval from the npm publishers team, and the README notes you should check npm afterwards to verify the release landed.

## Version 9 is a major bump, and the licence is not the usual one

The release history shows v8.1.2 on 2024-12-17, v8.2.0 on 2025-01-28 and v9.0.0 on 2026-08-26, with the last push to the repository on 2026-09-18. A jump from 8 to 9 is the point at which the SemVer process in the README starts to matter in practice, since the release instructions are specifically written around choosing the right major version for a set of changes. The licence is ISC, which is the identifier in the package manifest and a permissive licence with a short notice requirement, and it is worth noting that this differs from the GPL and other copyleft terms some of the wider MetaMask ecosystem uses, so if your compliance process tracks licence types per dependency, this one deserves a line of its own. The author field in the manifest names Dan Finlay.

## What it is not, and when to reach for something else

The boundaries matter more here than the features, because the name invites assumptions. This is not a wallet, and it does not manage keys, store them, or protect them. It does not talk to a node, broadcast a transaction, or resolve a name service. It is a set of functions that take data and an Ethereum key and produce a signature, or take a signature and a key and tell you whether it verifies. If your requirement is to sign a message on behalf of a user without ever holding their private key, this is the wrong layer, because the key still has to reach the function. If your requirement is a personal sign prompt in a dApp, the MetaMask extension is the layer that talks to the user, and this library sits underneath the wallet's own signing code, which is why it is published as a standalone package in the first place. The honest framing is that it is infrastructure for code that already had to deal with keys, not a way to avoid dealing with them.

## Conclusion

eth-sig-util fits a team that needs to sign and verify Ethereum data with the same primitives MetaMask uses, and that wants the library kept small and focused rather than a full wallet stack. It does not fit an application that needs key custody, a provider, or transaction broadcasting, because that is a different layer of software entirely. Before depending on it, look at the four export paths in the package manifest, confirm your key handling and network assumptions are yours to make, and read the release notes for the version you pin, because the 8.x to 9.x jump is a major version and the ISC licence is not the same terms as the rest of the MetaMask organisation.

## FAQ

### What is @metamask/eth-sig-util and what does it do?

It is a small collection of Ethereum signing functions, described as functions for signing and verifying data with Ethereum keys. The package manifest exposes four entry points: the root export plus ./encryption, ./personal-sign and ./sign-typed-data.

### How do I install eth-sig-util?

With yarn add @metamask/eth-sig-util or npm install @metamask/eth-sig-util, both pulling the same package from npm. The full API documentation for the latest published version is hosted separately and linked from the README.

### What licence is eth-sig-util released under?

ISC, according to the license field in the package manifest. The version history shows v8.2.0 on 2025-01-28 and v9.0.0 on 2026-08-26, and the last push to the repository was on 2026-09-18.

### How are releases published for eth-sig-util?

The project follows the MetaMask organisation release process using the action-create-release-pr and action-publish-release GitHub Actions. A release PR is created manually, the changelog is validated with yarn auto-changelog validate --rc, the release is squashed and merged, and publishing to npm requires approval from the npm publishers team before the release can be verified on npm.

## Sources

- [Issues](https://github.com/MetaMask/eth-sig-util/issues)
- [License: ISC](https://github.com/MetaMask/eth-sig-util/blob/main/LICENSE)
- [MetaMask/eth-sig-util on GitHub](https://github.com/MetaMask/eth-sig-util)
- [README](https://github.com/MetaMask/eth-sig-util/blob/main/README.md)
- [Releases](https://github.com/MetaMask/eth-sig-util/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/metamask-eth-sig-util