Three weeks ago you pointed a phone at a QR code on a swap site, tapped Connect, and shut the laptop. The swap already confirmed, and the session can still be in the wallet, so disconnect that site before it asks you to sign again.
A token approval from that same visit is a different record. Disconnecting the session leaves the approval where it is.
Button labels change between releases, so follow the words on your own screen, and keep this page as a cleanup checklist only.
What can a leftover session still do?
A browser extension and a phone wallet keep the link in different places. Both survive a closed tab.
MetaMask in the browser talks to the page directly. You clicked Connect once, and the extension stored the permission. The next time that domain loads, the site can read the account you allowed and can propose another transaction. MetaMask’s connect guide says those transactions still wait for your approval in the wallet.
WalletConnect is the path a phone wallet uses when the site is open on a computer. WalletConnect’s wallet docs describe the session as the link that starts when you accept the site’s proposal. It stays up until you disconnect or the timer runs out. The default lifetime is seven days, and the wallet can push that same session out by another seven. Closing the browser does not send a disconnect.
Either side can end a WalletConnect session. The other side hears about it when the message arrives. A QR you never approved dies in about five minutes. Once you approve, the pairing, the channel between the two apps, can last about thirty days. Those two clocks are on the wallet best-practices page. The session on that channel is the row in your list, and that row starts with the seven-day clock. A signature request inside a live session has its own timer, chosen by the site, from five minutes up to seven days. That is why a site from last week can still reach the phone.
The keys stay in the wallet. Moving coins into a wallet you control is a different job from this list. A connected site is also not the login on a custodial exchange. That login, with its second factor and withdrawal allowlist, is in exchange account 2FA.
How is a session different from a token approval?
A session lets the site see the address you shared and ask the wallet to sign. MetaMask’s disconnect article says removing the connection can stop the site from seeing the address, the balances, and the history, and from starting new transactions, depending on what you allowed. The warning at the top of that page says the disconnect leaves token approvals in place. A spender you approved can still move those tokens.
An approval, also called an allowance, sits on the token contract. The spender can pull up to that amount without a fresh prompt. Revoking it is its own transaction. The network has to include it, and you pay the fee in that chain’s own coin. Planning gas is how you keep a little of that coin ready. The click path on Etherscan, Arbiscan, Polygonscan, and for Solana delegates is in the token approval checker.
Clear the session list first. It does not cost a fee. Then open the approval checker on each chain you used.
How do you disconnect a site in MetaMask?
Use the account you connected.
- Open MetaMask and tap the menu at the top right, the icon made of three lines.
- Tap Permissions. Each row is a site, with a count of accounts that site can see. The steps are in the disconnect guide and the permissions guide.
- Tap the site you want gone.
- Tap the exit icon at the top right, then confirm with Disconnect.
To drop every site, stay on Permissions and tap Disconnect all at the bottom.
You can also open one site, uncheck accounts, and tap Save. If every box is empty, Save stays off. MetaMask wants a disconnect when no account remains.
The current help article uses Permissions, Disconnect, and Disconnect all. An older copy of that article said All Permissions. Earlier extension screens called the same list Connected sites, and some builds show a Sites list under a connections heading. Open the list your screen actually has. If none of those words appear, stop and re-read the help article before you wander into other settings.
When you want the site again, you connect from scratch.
How do you disconnect a WalletConnect session in Trust Wallet?
Trust Wallet’s WalletConnect guide puts the list in the app, not in the browser.
- Open Trust Wallet.
- Tap Settings. It is the tab along the bottom, on the right.
- Tap WalletConnect. You get the sessions that are still open.
- Tap the session, then Disconnect.
The row should leave the list. If a name is unfamiliar, disconnect it, then read recent activity on that address before you sign anything else. Do not scan a new QR from a chat while you are cleaning this screen. Fake connect prompts and lookalike domains are in the phishing guide.
A site you open often may stay past the first week, because a session can be extended. A site you have not opened since the laptop closed should not stay.
Where do Phantom and Coinbase Wallet keep the list?
Phantom uses the same names on the phone and in the browser extension. Tap or click the profile picture at the upper left, then Settings, then Connected Apps. Open the app and tap Disconnect. The three-dot menu at the upper right has Disconnect from all. Phantom’s connect article says taking a row off that list leaves token permissions in place. The same menu has Revoke permissions for all. That stops those apps from asking you to sign, and it leaves them on Connected Apps until you connect again. It is not the on-chain allowance. Check both.
On the phone, Phantom connects only inside its own browser. A site you opened in Safari is not on this list. The extension and the phone each keep their own Connected Apps, so clear both if you use both.
Coinbase Wallet, on the extension and the phone, uses a longer path. Open Settings, then the row named Recovery phrase, profile, connections, and more, then Connected dapps. On the phone, pick Web or Mobile. Open the menu beside that site and tap Disconnect. Coinbase’s permissions article keeps Token approvals on a separate screen, where Revoke is a transaction and needs a network fee. One shortcut belongs only to Coinbase’s own browser: closing a site there drops that connection. Closing a Chrome tab does not.
Should you disconnect on the website too?
Yes, when the site has the control. The address shown in the corner often hides Disconnect. Use it, then reload. The page should ask you to connect again, and it should not already know your address.
Look at the wallet list a second time. A disconnect on the website does not always reach the wallet. WalletConnect notifies the other side when the message gets there. An extension updates only if the page actually revokes the permission. If the row is still listed, disconnect it in the wallet.
If the site still shows your address after both steps, close every tab for that domain, lock the wallet, and open the site from a bookmark you typed. A page that fills your address back in without a prompt still has a stored permission.
What do you do if a signature prompt shows up later?
Reject it when you did not just start an action on that site. The wallet does not sign on its own. It signs when you approve the prompt. That prompt is where a leftover session becomes a loss, because a familiar logo is easy to tap through. Read the domain, the account, and what the request actually does. A request to permit, approve, or set an unlimited amount is an allowance, not a cleanup step. Back out and use the approval guide.
Phantom can ask you to approve a Sign message while you are connecting, on a site you just opened. A sign request days later, from a site you did not open, is a different event. Refuse it.
No cleanup step needs your recovery phrase. A page, a chat, or a support account that asks for the twelve or twenty-four words is not helping you clear a list. What those words control is why they stay off the screen.
When the session list is empty, open the approval checker for the chains you actually used. Any allowance you signed is still on the token contract until a revoke is included.
