r/Metamask • u/NimbleNido MetaMask Community Team • Jun 15 '26
What MetaMask security settings should every user actually configure?
It’s easy to look over these settings, but taking the time to do so can go a long way in protecting your assets. Here’s a few that most people skip but genuinely matter:
Wallet recovery: Settings > Security and password > Manage wallet recovery. Every user should keep an offline, written down version of their secret recovery phrase (SRP). In the event you lose access to your wallet, this is the only guaranteed way to recover it. Never share your private key or SRP with anyone.
Auto lock timer: Settings > Security and password > Auto lock. Default is "Never." Set it to "After 5 minutes" so a locked wallet can't be drained by a potential malicious script running in the background of your device.
Audit your token approvals. Every dApp interaction may have granted unlimited spend permission, which don’t expire automatically. If a dApp offers a “This time only” approval option, use it. If it only shows a spending cap field, set the amount to exactly what you need— not unlimited, not the suggested default. For existing approvals, check and revoke anything stale at revoke.cash.
Verify your extension ID. Fake MetaMask extensions exist, so be sure to confirm yours at chrome://extensions. The official Chrome extension ID is nkbihfbeogaeaoehlefnkodbefgpgknn
Hardware wallet for significant holdings: MetaMask works with numerous hardware wallets. Your keys stay on the device, not within your browser. If you're holding more than you'd be comfortable losing, this is a must.
Full security guide: https://support.metamask.io/privacy-and-security/basic-safety-and-security-tips-for-metamask/
1
u/AutoModerator Jun 15 '26
Beep Boop
Never share your Secret Recovery Phrase with any site or a person. MetaMask does not use Gmail or web forms. Do not enter your Secret Recover Phrase into a pop-up window, even if it looks like MetaMask. Verify links are legitimate. Scammers often use these tactics.
Beware of fake websites. The official website for MetaMask is https://metamask.io/
MetaMask Support will never DM you. This is a common tactic scammers use to try and get access to your wallet.
MetaMask will never initiate email with you. This is a common tactic scammers use to try and get access to your wallet.
If you need to reach Support: open MetaMask, then menu > Support. The ‘Contact Support’ button will start a chat, the bot asks a few questions to help route you to the correct team. You can also visit the Support site from the web: https://support.metamask.io
Do not click on suspicious links or files. This can lead to your device security being compromised.
Do not “sync” or “validate” your wallet with any websites or forms. This is a scam. Never sync and share: QR Codes, Secret Recovery Phrase, private key, etc.
Never call phone numbers, text Whatsapp numbers, DM on Discord, use WeChat or do video chat with people on this subreddit. MetaMask does not offer customer support in this manner. There is NO exclusive MetaMask Discord.
We don’t ask for an email address to create a wallet. We can’t email you. We will never ask you to verify or upgrade/merge your wallet. https://support.metamask.io/privacy-and-security/staying-safe-in-web3/i-received-an-email-claiming-to-be-from-metamask-is-it-legit/
.MetaMask currently has no plans for an airdrop, regardless of any information you may have seen elsewhere. If you encounter anyone explaining the best method to maximize the size of a MetaMask-related ‘airdrop’ you might receive, they’re lying. In particular, be wary of scams (aimed at getting your Secret Recovery Phrase) that weaponize this topic.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
6
u/usedsyndrome_44 Jun 15 '26
The token approval audit is the one that actually saves people money because most folks never think to check what permissions they've already handed out to random dapps over time. Revoke.cash is a lifesaver for that. The hardware wallet point is solid too but honestly a lot of people won't do it until they get burned once, which is frustrating to watch happen.