If you have ever scanned a QR code to connect a mobile wallet to a website open on your computer, you have used WalletConnect. It is one of the most common ways people interact with dapps, yet the mechanics behind that scan are rarely explained. Understanding them makes it easier to spot when something looks wrong and to clean up old connections you no longer need.
Two different ways a wallet can connect
There are, broadly, two paths a wallet takes to talk to a website.
The first is a browser extension injecting itself directly into the page you are viewing. The extension exposes an object the page's code can call, and when you click "Connect," the request and the response both happen inside the same browser, on the same device. This is how most desktop extension wallets work.
The second path is what WalletConnect solves: your wallet lives on your phone, but the dapp is open in a browser on a different device, like your laptop. There is no shared browser to inject into, so the two need a way to exchange messages across devices. WalletConnect is that bridge.
What actually happens when you scan the QR code
The QR code you scan is not a link to a website. It encodes a pairing request, essentially a topic and an encryption key that both sides will use to talk to each other through a relay server.
Here is the sequence, in plain terms:
- The dapp generates a pairing request and displays it as a QR code (or a deep link, on mobile to mobile connections).
- Your wallet scans it, which gives it the same topic and key the dapp generated. Both sides now share a private channel.
- Messages between the dapp and your wallet travel through a relay server, encrypted so the relay operator cannot read their contents. The relay's job is only to pass encrypted messages back and forth. It cannot see your address, your balance, or what you are signing.
- Your wallet asks you to approve the session, showing you the site's name and the network it wants to use, the same kind of prompt described in our guide on connecting your wallet to a dapp safely.
- Once approved, a session exists between the two apps. Every further request, a swap, a signature, a transaction, gets routed through the same encrypted channel and shows up as a prompt on your phone.
The key point is that the relay server is a message courier, not a party with access to your funds. Approving a WalletConnect session grants the dapp the same limited visibility any wallet connection grants: your address and network, plus the ability to send you requests you still have to approve individually.
Why sessions stick around
A WalletConnect session does not expire the moment you close the browser tab. It is designed to persist so you do not have to rescan a QR code every time you refresh a page or come back the next day. That persistence is convenient, but it also means the list of apps your wallet has an open session with tends to grow quietly over months of use, including sites you tried once and never went back to.
Most wallets that support WalletConnect have a screen, often under settings or a "connected apps" section, listing every active session. It is worth opening that screen occasionally and revoking sessions for anything you do not recognize or no longer use. Revoking a session does not affect any past transaction. It simply closes that communication channel, so the site can no longer send your wallet new requests.
What to watch for
A few habits keep WalletConnect pairing safe:
- Only scan a QR code from a site you intentionally opened. A pairing code is just an invitation to open a channel. If you scan one from an unfamiliar source, whether a screenshot sent in a chat or a code shown on a public screen, you may be pairing with something you did not mean to connect to.
- Read the prompt on your phone before approving. It shows the requesting site's name and domain. If it does not match the site you were just looking at, decline and check both screens again.
- Treat every request after pairing as its own decision. A session being open does not mean anything happens automatically. Each swap or signature still needs your explicit approval, and the same scrutiny you would apply to any signature request still applies here.
- Review your active sessions periodically, the same way you might review token approvals you no longer need. Both are forms of standing access that outlive the moment you granted them, and both are worth pruning.
Why this matters for a Base wallet
Because WalletConnect is a general purpose protocol, not something built for a specific network, the same session mechanics apply whether the dapp you are pairing with runs on Base or elsewhere. When you approve a session, check that the network shown matches what you expect. If a site requests a network switch you did not ask for, that is worth pausing on before you continue.
Understanding what a pairing session is, and is not, turns a routine QR scan back into a deliberate choice. The relay server moves messages, your wallet holds the keys, and every meaningful action still waits for your explicit approval on the device where your wallet actually lives.