SECURE YOUR METAMASK WALLET

Protect the keys that control your crypto.

MetaMask is a self-custody wallet. That means you control the wallet and its recovery credentials. The most important security rule is simple: protect your Secret Recovery Phrase and never give it to anyone.

This is not a normal account.

Unlike an exchange account, MetaMask does not have a central administrator who can simply reset your wallet for you. Your Secret Recovery Phrase is the foundation of a traditional MetaMask wallet.

Anyone who controls that phrase can potentially control the accounts derived from it. MetaMask says it cannot recover an SRP for you if you lose it.

What should I never share?

Never share your Secret Recovery Phrase, private keys, MetaMask password or other wallet credentials. MetaMask says its support team will never ask for your Secret Recovery Phrase.

What if someone says my wallet needs verification?

Stop. Be suspicious of any website, message or person telling you to enter your Secret Recovery Phrase to verify, synchronize, unlock or secure your wallet. MetaMask warns that scammers commonly use fake support and phishing pages for exactly this purpose.

Does changing my password protect an exposed wallet?

No. If someone has your Secret Recovery Phrase or a private key, changing the local MetaMask password does not remove their control. The safer response is to create a new wallet with new credentials and move assets after carefully verifying the destination.

METAMASK WALLET SECURITY

Protect the recovery phrase, then verify every interaction.

Work through these checks one at a time. With self-custody wallets, a single unsafe signature or exposed recovery credential can have consequences that cannot be reversed.

Protect your Secret Recovery Phrase

Your Secret Recovery Phrase is the master key to a self-custody MetaMask wallet. Anyone who obtains it can potentially control the accounts derived from it.

Click to see protection steps

Step-by-step

Open MetaMask only through the official extension or mobile application.
Locate your wallet's Secret Recovery Phrase backup if you have not already secured it.
Write the phrase down carefully in the exact order in which MetaMask provides it.
Keep the backup in a secure physical location that only you can access.
Consider keeping more than one secure physical backup if losing the only copy would put your wallet at risk.
Never store the phrase in an ordinary email, screenshot, public note or internet-accessible document.
Never give the phrase to MetaMask Support or anyone else.

VERIFY: Confirm that you have a reliable backup of the correct Secret Recovery Phrase and that no untrusted person or online service has access to it.

Never share your Secret Recovery Phrase

MetaMask will never need your Secret Recovery Phrase to troubleshoot an ordinary problem. Anyone requesting it is attempting to obtain control of your wallet.

Click to see protection steps

Step-by-step

Treat your Secret Recovery Phrase like the master key to your wallet.
Never enter it into a website because a pop-up or message tells you to verify your wallet.
Never send it through WhatsApp, Telegram, email or social media.
Never give it to someone claiming to be MetaMask Support.
Never enter it into a form supplied by an unknown person offering to recover your funds.
Only use the phrase when you are intentionally creating or restoring your own wallet through the legitimate MetaMask application.

VERIFY: If anyone has ever seen or received your Secret Recovery Phrase, treat the wallet as potentially compromised and follow the exposed-phrase response below.

Use a strong MetaMask password

Your MetaMask password protects the local wallet installation on your device. It is important, but it is not a replacement for your Secret Recovery Phrase backup.

Click to see protection steps

Step-by-step

Open MetaMask.
Open the available Security & privacy or password settings.
Set a strong password that you do not reuse on another important account.
Avoid passwords based on easily guessed personal information.
Store the password securely if you use a password manager.
Never give the password to someone claiming to be MetaMask Support.
Remember that the password protects local access; the Secret Recovery Phrase remains fundamental to wallet recovery for traditional SRP-created wallets.

VERIFY: Lock MetaMask and unlock it again using your password or configured device authentication.

Use biometric or device authentication when available

Where supported, MetaMask can use device authentication such as biometrics to make local wallet access more convenient without weakening your need to protect the recovery credentials.

Click to see protection steps

Step-by-step

Open MetaMask on your supported device.
Open Security & privacy.
Review the available biometric or device-unlockoptions.
Enable the feature if it is appropriate for your device.
Make sure your phone or computer itself has a strong screen lock.
Do not enable biometric access on a device that other people regularly use.

VERIFY: Lock MetaMask and confirm that the configured device authentication is required before wallet contents can be accessed.

Use security alerts before connecting to websites

MetaMask provides security alerts and trust signals that can warn about malicious websites, addresses, tokens and potentially harmful activity.

Click to see protection steps

Step-by-step

Open MetaMask.
Review the available Security Alerts settings.
Keep security alerts enabled when the feature is available to you.
When connecting to a website, read the trust signal or warning shown by MetaMask.
Treat a Malicious warning as a serious reason to stop and investigate.
Remember that a missing Verified badge does not automatically mean a website is malicious.
Never ignore a warning simply because a person in a chat tells you that the site is safe.

VERIFY: Before connecting your wallet, confirm that you understand the security warning or trust signal displayed by MetaMask.

Review connected websites and dapps

Connecting your wallet to a decentralized application gives that application permission to interact with your wallet in specific ways. Remove connections you no longer need.

Click to see protection steps

Step-by-step

Open MetaMask.
Find the section for connected sites or connected applications.
Review the websites and dapps connected to the wallet.
Identify applications you no longer use.
Disconnect unnecessary or unfamiliar sites.
Remember that disconnecting a site does not necessarily revoke every previously granted token approval.
Review token approvals separately when appropriate.

VERIFY: Confirm that the remaining connected websites are ones you recognize and intentionally use.

Review and revoke token approvals

A token approval can allow a smart contract to spend specified tokens from your wallet. Old or unnecessary approvals can increase risk.

Click to see protection steps

Step-by-step

Identify the token approvals associated with your wallet.
Use a reputable blockchain explorer or approval-management tool that supports the network you are using.
Review the spender address and token associated with each approval.
Identify approvals you no longer need.
Revoke unnecessary approvals using a legitimate transaction.
Verify the network and transaction details before signing the revocation transaction.
Never sign a transaction merely because an unknown person tells you it is necessary to "secure" your wallet.

VERIFY: Confirm that unnecessary approvals have been revoked and that remaining approvals are associated with services you intentionally use.

Verify every transaction before signing

A malicious website can ask your wallet to sign a transaction or message that does something very different from what you expected.

Click to see protection steps

Step-by-step

Stop before approving any transaction or signature.
Read the information MetaMask displays.
Confirm the recipient address.
Confirm the asset and amount.
Confirm the network.
Review any token approval or contract interaction being requested.
If you do not understand what you are signing, chooseReject rather than guessing.
For high-value transactions, independently verify the destination address through a trusted channel.

VERIFY: Only sign after you can explain what the transaction does, where the assets are going and why the action is necessary.

Verify the network before sending assets

Crypto assets can exist on multiple networks. Sending through the wrong network or to an incompatible destination can create serious recovery problems.

Click to see protection steps

Step-by-step

Select the asset you intend to send.
Confirm the network you are currently using.
Confirm that the receiving wallet supports that exact network.
Copy the recipient address only from a trusted source.
Compare the beginning and ending characters of the address.
Check the amount carefully.
Confirm the transaction details in MetaMask before signing.
For a large transfer, consider sending asmall test transaction first when practical.

VERIFY: Before signing, independently verify the recipient, asset, network and amount.

Consider a hardware wallet for significant holdings

MetaMask recommends hardware wallets for long-term storage because the wallet's signing keys can remain isolated from an internet-connected computer.

Click to see protection steps

Step-by-step

Determine whether the value of your holdings justifies a hardware wallet.
Purchase the device directly from the manufacturer's legitimate source.
Initialize the hardware wallet as a new wallet when setting it up.
Write down the hardware wallet's own recovery phraseaccording to the manufacturer's instructions.
Never enter an existing MetaMask Secret Recovery Phrase into a new hardware wallet simply to "make it safer."
Connect the hardware wallet to MetaMask using the official supported connection process.
Confirm transactions on the hardware device itself before approving them.

VERIFY: Confirm that the hardware wallet generates and protects its own recovery phrase and that transaction approvals require the physical device.

Keep MetaMask and your device updated

Security updates can address vulnerabilities in MetaMask, browsers and operating systems.

Click to see protection steps

Step-by-step

Update MetaMask through its legitimate extension or mobile-app source.
Keep your browser updated if you use MetaMask Extension.
Keep your phone or computer operating system updated.
Avoid installing MetaMask from unofficial websites or links sent by strangers.
Remove suspicious browser extensions that could interfere with your wallet.
Restart the browser or device when necessary to complete legitimate security updates.

VERIFY: Confirm that MetaMask, your browser and your operating system are running current legitimate versions.

Recognize fake MetaMask support

MetaMask warns that scammers frequently impersonate support staff and try to obtain Secret Recovery Phrases or private keys.

Click to see protection steps

Step-by-step

Remember that MetaMask does not have a phone support number.
Never respond to an unsolicited person claiming to be MetaMask Support.
Never give support personnel your Secret Recovery Phrase, private key or password.
Be suspicious of anyone asking you to send funds to a secure, recovery or verification wallet.
Do not click a "verify wallet" link sent through an unexpected email, social-media message or chat.
Open the official MetaMask Help Center yourself when you need assistance.

VERIFY: Before accepting help, independently open MetaMask's official support site rather than following a support link supplied by a stranger.

Recover your wallet on a new device

A traditional MetaMask wallet can be restored using its Secret Recovery Phrase. The phrase must already be safely backed up before you need it.

Click to see protection steps

Step-by-step

Install MetaMask from its official source.
Choose the option to import or restore an existing wallet.
Enter your Secret Recovery Phrase only inside the legitimate MetaMask application.
Enter the words in the correct order.
Set a new strong MetaMask password for the new installation.
Check that your expected accounts and balances appear.
Remember that manually imported accounts may require their own private keys to be restored.

VERIFY: Confirm that the restored wallet addresses match the addresses you previously controlled before sending or receiving assets.

If your Secret Recovery Phrase is exposed

An exposed Secret Recovery Phrase should be treated as a critical wallet compromise. Changing the MetaMask password does not make an exposed phrase safe again.

Click to see protection steps

Step-by-step

Stop using the compromised wallet for new deposits.
Do not enter the exposed phrase into another website or send it to anyone claiming to help.
Create a new wallet with a new Secret Recovery Phraseusing a legitimate MetaMask installation.
For significant holdings, consider creating the new wallet using a hardware wallet.
Independently verify the new wallet addresses.
Move remaining assets from the compromised wallet to the new wallet only after carefully verifying the destination.
Review and revoke token approvals associated with the compromised wallet where appropriate.
Never reuse the exposed Secret Recovery Phrase.

VERIFY: Confirm that valuable assets are controlled by a new wallet with a new recovery phrase and that the exposed phrase is no longer trusted.

Secure your wallet after suspicious activity

If you signed something suspicious, connected to a malicious site or believe your wallet is compromised, treat the situation as urgent.

Click to see protection steps

Step-by-step

Stop signing transactions or messages.
Disconnect suspicious dapps and websites.
Review and revoke suspicious token approvals.
If the Secret Recovery Phrase may have been exposed, create a new wallet.
Move remaining assets to the new wallet after independently verifying every destination.
Check the blockchain using a trusted block explorerfor unauthorized transactions.
Preserve relevant transaction hashes and wallet addressesif you need to investigate what happened.
Secure your device, browser and email account if they may have contributed to the compromise.
Contact MetaMask through its official support channelif you need help understanding the wallet or transaction.

VERIFY: Do not return valuable assets to a wallet whose Secret Recovery Phrase or private keys may have been exposed.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →

Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →

Metamask security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts