Check the official domain letter by letter
Only enter the download page from metamask.io. Beware lookalike addresses with an extra letter, a hyphen, similar glyphs, or an unfamiliar suffix.
Verify the official site, avoid fake extensions, then create your first on-chain wallet. We turned every error-prone step into a checklist you can verify item by item.
The browser extension suits desktop DApps; the mobile app suits on-the-go use. The same seed phrase restores your wallet — but never transmit it online.
Fake extensions and phishing approvals are more dangerous than technical glitches. Verify the domain, the developer, and the requested permissions.
Only enter the download page from metamask.io. Beware lookalike addresses with an extra letter, a hyphen, similar glyphs, or an unfamiliar suffix.
The developer name in the store should be MetaMask. Leave immediately if reviews suddenly look sparse, the name is oddly spelled, or extra permissions are requested.
Promoted results above the brand term are not the official site. Type the domain yourself or use the verified official links on this page.
Support staff, airdrops, upgrades, sync or unlock pages have no reason to ask for your seed phrase. Back it up by hand, offline.
MetaMask is more than “just install a plugin.” Understanding network switching and approval boundaries is what keeps you safe.
Prefer the project's official site or a trusted network directory to add BSC or Polygon. Verify the RPC, Chain ID, and block explorer.
Check the Chain ID firstGas is the chain's execution cost, not a MetaMask fee. When congested, wait or lower the priority fee — never blindly raise the limit.
Before signing, check the site's domain, the asset scope, and the amount. Unlimited approvals are not always malicious, but they carry higher risk.
Keep your daily-interaction wallet separate from long-term storage; for large holdings, add a hardware wallet to reduce private-key exposure.
Back up first, then fund; test small before going big.
Jump to the app store from the official site, then pin the extension icon so you never click a lookalike.
Set a unique strong password. The password only protects this device — it is no substitute for a seed-phrase backup.
Write two copies in order and store them separately; never screenshot it or paste it into chat apps or cloud drives.
Ethereum works by default; when adding BSC or Polygon, verify every network parameter item by item.
Check the first and last characters of the address and the network; test with an amount you can afford to lose before moving more.
A wallet that frequently connects to DApps has a larger attack surface. For long-term assets, consider a hardware wallet; use compliant, available exchanges to buy crypto.
Official rules prevail; prices, supported devices, and product features may change over time.
The software is a mainstream self-custody wallet, but safety depends on your device, how you guard the seed phrase, and your signing habits. The most common losses come from fake extensions, phishing approvals, and leaked seed phrases.
Fees are mainly set by how congested the blockchain is and how complex the transaction is — MetaMask does not price them. You can wait for quieter periods, lower the priority fee, or use a cheaper network.
If you can still open the wallet, move your assets to safety immediately and back up again. If the device is also inaccessible and you have no seed phrase or private key, the wallet usually cannot be recovered.
First confirm the extension is enabled and the browser is up to date, then switch RPC, clear site connections, and re-authorize. Never share your screen or seed phrase with “remote support.”
Use the chain's block explorer or a trusted approval manager to check allowances, and revoke ones you no longer use or that are too large. Revoking itself costs on-chain gas.
Start from the official entry and keep your seed phrase in the offline world.