Web3 is the idea of internet apps built on blockchains, where users hold their own assets and identity in a wallet instead of in a company's database. In Web2, platforms like social networks own your account and data. In Web3, the core records live on a public ledger anyone can use without permission, and your wallet doubles as your login. In practice, many Web3 apps still rely on central services, and the model brings new risks.
Where did the term Web3 come from?
The term comes from Ethereum co-founder Gavin Wood, who coined it shortly after Ethereum launched in 2014. Ethereum's own introduction to Web3 frames his idea as a response to the problem that "the Web required too much trust."
That page describes three rough eras:
| Web1 | Web2 | Web3 | |
|---|---|---|---|
| Rough period | About 1990 to 2004 | 2004 to today | Emerging alongside Web2 |
| Short label | Read | Read-write | Read-write-own |
| Typical experience | Static company pages | Social media, apps, user posts | Apps connected to a wallet |
| Who holds your data | The site owner | The platform | Public ledgers, plus your wallet |
| How it makes money | Mostly direct sales | Mostly advertising | Fees and tokens, still being tested |
The dates are approximate, and the eras overlap. Most people use Web2 every day and Web3 rarely, if at all.
What actually makes an app "Web3"?
A Web3 app keeps its most important records on a public blockchain and lets users act through their own wallet. Four ideas come up again and again:
- Ownership. Assets you hold sit at your own address on the ledger. A company can't remove them by deleting your account.
- Permissionless access. Anyone can use the underlying contracts without an account approved by a company. This is also the core idea of DeFi.
- Native payments. Value moves in coins and tokens directly, without a bank or card network in the middle.
- Portable identity. One address can serve as your login across many apps, so you don't create a separate account for each.
The logic of the app usually lives in smart contracts, programs stored on the chain that run the same way for everyone. Ethereum popularized this model, as covered in how Ethereum differs from Bitcoin.
A worked example: logging in with a wallet
Logging in shows the difference most clearly. In Web2, the platform stores your username and a password hash, and it can lock you out. In Web3, you prove you control an address by signing a message.
The common standard is Sign-In with Ethereum, ERC-4361, which is marked Final. Here is how it works:
- The site creates a message. It names the site's domain, your address, a statement such as the terms you accept, version 1, the chain ID (1 for Ethereum mainnet), a time stamp and a random nonce of at least 8 letters or digits.
- Your wallet shows the message. Because the format is standard, the wallet can display it in plain text and check that the domain matches the site asking.
- You sign it. Your wallet uses your private key to sign. Nothing is sent to the blockchain, and no fee is paid.
- The site verifies it. The server checks the format, the nonce and the expiry, then verifies the signature. It starts a session tied to your address.
The nonce is a one-time value, so a stolen signature can't be replayed later. No password is stored anywhere, so there's no password database to leak.
The trade-off is that nobody can reset your key. If you lose your seed phrase, no help desk can restore access. And a sign-in prompt looks a lot like other signature requests. Some of those grant spending rights over your tokens, which is how wallet drainers work.
How is Web3 different from Web2 in daily use?
The biggest changes are who holds your things and who can stop you:
| Question | Web2 | Web3 |
|---|---|---|
| Who keeps your account? | The company | You, through your wallet |
| Can you be banned? | Yes, from the platform | From an app's website, yes; from the contracts, generally no |
| Can you take your assets elsewhere? | Rarely | Yes, any compatible app can read your address |
| Who fixes mistakes? | Customer support | Usually no one; transactions are final |
| What does an action cost? | Usually nothing visible | A network fee for each on-chain action |
That fee is part of what gas fees cover. Many apps now run on layer 2 networks to bring the cost down.
Ownership has limits too. With an NFT, you own a token that points to something, which isn't always the same as owning the thing itself.
Where has Web3 not delivered?
Web3 has fallen short of its own promises in several ways, and supporters say so too. Ethereum.org's own list of limitations names fees, a hard user experience, the need for education and continued reliance on centralized services.
Apps still lean on central services. Phones and browsers can't realistically run a full blockchain node, so wallets and apps call hosted servers. In January 2022, Signal founder Moxie Marlinspike wrote that "almost all dApps use either Infura or Alchemy" to reach the chain, and that those services didn't verify the data they returned. He also found that wallets displayed NFTs using OpenSea's API, not the chain, and that many NFTs store only a URL that the server owner can change.
Those services can fail. On November 11, 2020, Infura's Ethereum service went down. MetaMask, which used Infura by default, had trouble working, and Binance and Bithumb paused withdrawals of ETH and ERC-20 tokens, according to The Block. The chain kept running, but many users couldn't reach it. How wallets connect is covered in what an RPC node is.
Security losses are large. In February 2025, the FBI attributed the theft of about $1.5 billion from the Bybit exchange to North Korea. Fraud is a bigger drain on ordinary users. The FBI's 2025 report logged $11.37 billion in losses from complaints involving cryptocurrency.
Ownership often recentralizes. Many people keep assets on exchanges, which is Web2-style custody, as explained in custodial vs. self-custody wallets. And websites, app stores and stablecoin issuers can still block users, even when the contracts underneath are open.
None of this means the ideas are empty. It means "decentralized" is a property you check layer by layer, not one a label guarantees.
How can you tell how decentralized an app really is?
Ask the same questions of any app that calls itself Web3:
- Where are the key records? Balances and rules on a public chain are checkable. Data on the company's server is Web2 with extra steps.
- Who can change the code? Contracts with an admin key or an upgrade switch can be changed by whoever holds it. Some apps hand this to a DAO, which spreads control but doesn't remove it.
- Can you use it without the official website? If the front end disappears, can you still reach the contracts through another interface?
- Who holds your keys? If a company does, you have an account, not ownership.
- Which outside services does it depend on? Node providers, price oracles and bridges are all points of failure.
Is Web3 only about crypto money?
No, though finance is where it's most used today. Other uses include domain-style names for wallets, covered in what ENS is; social networks where your followers belong to you, covered in decentralized social media; and decentralized storage for files.
Each of these faces the same test as finance: whether it works better for users than the Web2 version, and not only whether it uses a blockchain. For more on building and using these apps, see our dApp development hub.
Key takeaways
- Web3 describes apps that keep core records on public blockchains and let users act through their own wallets.
- Its main ideas are ownership, permissionless access, native payments and a portable identity that doubles as a login.
- Signing in with a wallet replaces passwords with signatures, but nobody can reset a lost key.
- Many Web3 apps still depend on central node providers, websites and APIs, so outages and blocking can still happen.
- Hacks and scams have cost billions, so check how decentralized an app really is before trusting it with money.
Sources
Get the weekly commit
New blockchain deep dives every week.
