Using MetaMask Safely

MetaMask is one of the most widely used self-custody wallets. It runs as a browser extension and as a mobile app, and it was built for Ethereum and the many chains compatible with it. This lesson uses it as the example because so many people start with it; the same habits apply to any wallet, and naming it is not a recommendation.

Installing it

• Install only through the official website, metamask.io, or the links it gives to your browser's extension store or app store. Fake MetaMask extensions and apps have been used to steal recovery phrases.
• Check the publisher name and the number of users in the store before installing.

Setting it up

1. Create a new wallet. MetaMask shows a Secret Recovery Phrase, its name for a seed phrase. Write it down and store it the way the course Protecting Your Keys describes.
2. Set a password. The password only unlocks MetaMask on that device; it cannot restore the wallet anywhere else. The phrase can.
3. Understand accounts. You can create several accounts from the same phrase, and they are all restored by it. An account you import with a separate private key is not covered by the phrase and needs its own backup.

Networks and tokens

• Ethereum is set up by default. To use another network, such as Base, Arbitrum or Robinhood Chain, add it using the network details from that network's official documentation. A malicious network setting can show false balances or record your activity.
• A token you hold may not appear until you add it. Add it by its contract address from an official source, not by searching its name.
• Tokens and NFTs you never asked for often appear in wallets as bait. Do not visit the sites they mention or try to sell them.

Signing with it

• When a site asks to spend a token, MetaMask shows the spending cap. You can usually change it to the exact amount you intend to use.
• MetaMask shows security alerts that flag some known malicious requests. They catch some attacks, not all, so read every request yourself.
• Signature requests that are not transactions can still grant permissions, as the lesson on approvals and permits explains.

How it fails

• A fake extension or app installed from an ad or a search result.
• A "support agent" or "validation" site that asks for the Secret Recovery Phrase. MetaMask staff never ask for it.
• A browser extension or computer infected with malware. Keep significant funds on a hardware wallet connected to MetaMask, or in a separate wallet.