Security Tips for MetaMask

Basic Safety and Security Tips for MetaMask

What is a Secret Recovery Phrase and how do I back it up?

The use of a seed phrase, or Secret Recovery Phrase, is a standard most crypto wallets use. It's generated randomly when you create your MetaMask wallet, and provides access to all the accounts (addresses) within your wallet.

You receive the 12-word Secret Recovery Phrase when you first create your wallet. MetaMask does not control any of your personal or private data on our servers. Everything is encrypted in your browser and protected via your MetaMask password. So, when you lose your MetaMask accounts and need to restore them, you can only do that with your Secret Recovery Phrase.

When you restore your MetaMask wallet using your Secret Recovery Phrase, it restores MetaMask accounts too, in certain circumstances. If you have imported accounts, you will have to import them again.

Why you need to store your Secret Recovery Phrase

MetaMask is not a cloud-based solution. If your device breaks, is lost, stolen, or has data corruption, there is no way for the MetaMask Support team to recover this for you. This Secret Recovery Phrase is the only way to recover your MetaMask accounts.

Don’t share your Secret Recovery Phrase and private keys

Anyone who has your Secret Recovery Phrase or private keys can send tokens out of your accounts. Never share them with anyone, including the MetaMask team. We will never ask you to provide your Secret Recovery Phrase. If someone claims that we do, insist on not sharing. If you encounter someone who claims to be a MetaMask or MetaMask Support team member, or asks for your Secret Recovery Phrase and/or private keys, report them by getting in touch with Support.

If you have a large value of tokens in your account(s), consider getting a hardware wallet.

Hardware wallets are commonly thought to be the safest way to store your tokens. They are often referred to as 'cold' wallets, since they're disconnected from the internet most or all of the time. This approach means your private keys are never reachable by bad actors online, with the hardware wallet itself required to sign (authorize) any transactions.

There is no such thing as too much safety. The basic guide here is by no means comprehensive. Always learn how to better protect your tokens, by learning from the community, informative materials or discussion channels.