Ten years ago MetaMask was a fox icon in your toolbar that signed Ethereum transactions and did little else. That’s not what you’re installing in 2026. The same wallet now hands you a Bitcoin address, a Solana address, a debit card and an optional insurance plan, all behind one recovery phrase.
Who’s it for? Anyone who signs into decentralized apps often and would rather not keep four wallets open to do it. We’d steer you elsewhere if you insist on properly open-source software, or if what you want is somewhere quiet to leave savings you’ll never touch.
Below we go through what the wallet has become, how it feels in daily use, where its security actually holds, what it carries, what you’ll pay, and how to get it running without handing your phrase to a fake.
Table of contents
What Is MetaMask, Ten Years In?
MetaMask at a Glance | |
|---|---|
| What it costs | Nothing to install. Transaction Shield runs $9.99 a month or $99 a year, and the metal card is $199 a year, all at the time of writing (September 2026). |
| What it is | Software only. A browser add-on and a phone app, no device to buy. |
| Where it runs | Chrome, Firefox, Brave, Opera and Edge, plus iOS and Android. |
| Who holds the keys | You do. Everything grows out of a 12-word Secret Recovery Phrase stored on your own device, and MetaMask cannot fetch it back for you. |
| Is the code open | You can read it on GitHub. The Consensys licence attached to it is not a standard open-source one. |
| What it holds | Ethereum and the EVM chains, plus a Bitcoin and a Solana address inside every account. Extra networks can be added by hand. |
| How you back it up | By writing the recovery phrase down offline. MetaMask tells you to keep it away from the cloud. |
| Phone app | MetaMask Mobile, working off the same recovery phrase as the extension. |
| Who it suits | People signing into dapps most weeks who want a single wallet for all of them. |
Consensys builds MetaMask, and it’s a self-custody wallet: nobody else touches your keys. Kumavis and Dan Finlay started it back in 2016, and the first public build went out on July 14, 2016, roughly a year after that opening commit on July 31, 2015. July 2026 marked its tenth birthday.
Downloads have passed 100 million by the company’s own count, and it puts lifetime transaction volume in the trillions of dollars, across roughly 190 countries. The homepage throws in a 4.7 star App Store score as well.
Take those as a vendor’s own numbers, because that’s what they are. Nobody seriously argues about the scale, though. On a big slice of the web3 internet, the connect button assumes you’re running MetaMask.
Installing the wallet costs you nothing. Revenue comes from elsewhere: a 0.875% cut on swaps, 15% of your staking rewards, and a growing pile of subscriptions. No feature sits behind a paywall.
The MetaMask Features That Matter
- Each account carries an EVM address, a Solana address and a Bitcoin address, all traced back to the same phrase through BIP-44. No more shuffling between wallets to reach a different chain.
- Swapping happens inside the wallet, which hunts across decentralized exchanges for a rate and runs a test transaction first so quotes that would fail get dropped. MetaMask’s 0.875% sits on top of whatever gas costs.
- Scam, phishing and impersonation warnings ship switched on in both the extension and the phone app, drawing on chain analysis plus outside partners, Blockaid among them.
- Outside developers can bolt on Snaps, little sandboxed JavaScript programs that add non-EVM accounts, their own screens and transaction insights. Networks like Starknet arrive that way rather than being written into the wallet.
- Consensys Staking sits behind the staking tab, offering pooled staking on any quantity of ETH and liquid staking via Lido or Rocket Pool. The 32 ETH a validator node demands isn’t a barrier here.
- Ledger, Trezor, Lattice, Keystone, NGRAVE ZERO and a handful of QR devices all pair with it. Keys stay put on the device, and nothing moves until you press a button on the hardware.
Is MetaMask Easy Enough for a Beginner?
Give it five minutes. You pull the extension from your browser’s store, pick a password, and copy out the 12-word Secret Recovery Phrase it spits at you. Nobody asks for an account, an email, or your passport.
After that you’re looking at a narrow panel: balance up top, a network dropdown, and buttons to send, receive or swap. Signing into a dapp is a couple of clicks. That flow is why everyone standardized on MetaMask, and honestly it still holds up.
Rough edges remain. Gas, network choice and token approvals are all pushed into your face rather than tidied away, and since MetaMask won’t vouch for custom networks you add, the checking lands on you. Look at the help centre’s own shortcut links and the first two read "Not enough gas" and "Failed transaction", which tells you exactly where people trip.
There’s also a lot more crammed in than there used to be. Perpetual futures, prediction markets, tokenized stocks, a card and a Money Account all share the same window now, and if all you wanted was somewhere to keep ETH and click connect, that’s a noisier wallet than you asked for. Get your head around what a wallet address is first and the rest gets a lot less confusing.
How Safe Is MetaMask in Practice?
Nothing about this wallet is custodial. Your keys grow from a 12-word Secret Recovery Phrase that never leaves your device, and MetaMask says outright that a lost phrase means a lost wallet. That single fact is the entire model, and it protects you and exposes you in equal measure.
Warnings arrive pre-enabled and land as either Warning or Malicious. Chain analysis, ecosystem intelligence and outside security partners feed them, Blockaid included. What gets passed along is the dapp URL, the JSON-RPC method type, the chain ID and the transaction data, and MetaMask states your recovery phrase, private keys and other credentials aren’t part of that.
Paste a fresh address and the wallet now weighs it against ones you’ve used before, which shuts down a scam that has cost people a great deal. Across 2025, MetaMask counts 6.5 million malicious site visits blocked, close to 150,000 bad transactions stopped, and over $500 million in losses avoided.
Credit where it’s due: the documentation doesn’t oversell any of this. Simulations miss things, it says, and a flagged transaction will still go through if you push past the warning.
The licence is the part that bothers us. Everything’s on GitHub, sure, but Consensys wrote its own terms instead of reaching for MIT or GPL. Changes are allowed for Non-Commercial Use only, a category covering hobby work, charities, schools, government bodies and anything under 10,000 monthly active users.
So read it, audit it, satisfy yourself it does what it claims. Forking it into something that competes is off the table, and that’s the bit most people have in mind when they say open source.
Two disclosures deserve your attention. Halborn went public in June 2022 with CVE-2022-32969, nicknamed Demonic, which hit extension builds earlier than 10.11.3 and could leave a Secret Recovery Phrase sitting in plaintext on disk courtesy of the browser’s session-restore feature.
Pulling it off took three things at once: an unencrypted drive, a phrase imported on a machine someone else controlled, and the Show Secret Recovery Phrase box ticked while importing. Phones were never affected, and 10.11.3 closed it.
Earlier that year, in April 2022, MetaMask told iOS owners that switching on iCloud backup for app data sweeps up the password-encrypted vault along with everything else. Pair a thin password with phished iCloud credentials and the money walks. Neither case involved MetaMask’s servers being broken into, since there are no key servers to break into, yet both land the same point: your own setup carries the weight.
Holding anything substantial? Put hardware behind it.
Ledger talks to both the extension and the phone over USB, Trezor and Lattice are USB and extension only, and Keystone and NGRAVE ZERO handle both over QR. There’s a catch worth knowing: hardware wallets can’t take Solana yet, so anything you hold that way stays EVM-only.
What Coins and Chains Does MetaMask Cover?
For most of its life this was an Ethereum wallet and nothing more. July 2025 broke that, when Solana turned up on both mobile and the extension with sending, receiving, swapping, bridging and buying of SOL and SPL tokens, plus access to Solana apps. Bitcoin slotted into the same multichain account soon after.
Create an account today and you get all three addresses from one phrase. Bitcoin defaults to the Native SegWit derivation path, and anything you import has to be Native SegWit as well. Bitcoin moves far slower than Ethereum or Solana, which MetaMask says up front, and we’d call that honesty rather than a shortcoming.
Past those three, the claim is hundreds of blockchain networks. Adding your own by hand is allowed, with the warning that MetaMask verifies none of them. Anything preloaded stays put; anything you added, you can delete.
Where can you swap? Ethereum, Bitcoin, Linea, Base, Solana, Tron, Polygon, BNB Chain, Arbitrum, Monad, Robinhood Chain, OP, Sei, Avalanche, zkSync Era, MegaETH, HyperEVM and Tempo. Bridges lean on outside routes such as Li.fi, Socket, Hop, Celer cBridge, Polygon PoS Bridge, Squid, Across, Stargate, Relay, Mayan and CCTP.
A couple of holes are worth flagging. You can’t drop a raw private key into a Bitcoin or Solana account, only a recovery phrase. And Snaps, the add-ons that bring in networks like Starknet, come from developers who aren’t MetaMask, so every install is its own leap of faith.
NFTs and DeFi have always been the home turf here. Marketplaces and protocols default to the MetaMask button, which explains why it turns up on practically every roundup of the best decentralized crypto wallets.
What Does MetaMask Cost You?
Downloading and running it is free. Network fees apply on every transaction, same as any wallet, and swaps carry an extra 0.875%. Pooled staking skims 15% off your rewards, already baked into the rate the app shows you.
Subscriptions are the newer wrinkle. Transaction Shield is opt-in at $9.99 a month or $99 a year at the time of writing (September 2026), covering up to $10,000 a month spread over as many as 100 transactions. There’s a 14-day trial, and it only works in the extension.
Check what’s excluded before you sign up. Compromised seed phrases and private keys are out, so are speculative losses, protocol hacks, peer-to-peer transactions and anything sent from a wallet that isn’t MetaMask. Which strips out most of the ways people lose money in the first place.
Then there’s the card, in two flavours. Virtual costs nothing and returns 1% in mUSD; the metal one runs $199 a year and returns 3% on your first $10,000 of spending before dropping to 1%. It settles over Linea, Solana, Monad and Base, and takes mUSD, wETH, EURe, GBPe, USDC and USDT.
| Card fee | Free tier | Metal tier |
|---|---|---|
| Yearly charge | $0 | $199 |
| Paying with a stablecoin in your own currency | Nothing | Nothing |
| Paying with other crypto | 0.875% | 0.875% |
| Pulling cash from an ATM | 2% | Free to $1,200 a month, 2% after that |
| Spending abroad | 1% | Free, within fair usage |
| How much you can spend | $10,000 a transaction, $15,000 a day | $20,000 a transaction, $30,000 a day |
| Replacing a lost card | You can’t | $99 |
More than 40 regions can get the card. Fresh signups are paused in the US and the UK for now, although Americans can still order the metal version.
One rule holds no matter which tier you pick: download from official sources only. MetaMask’s own warning is blunt about it, because clones lift your Secret Recovery Phrase the instant it appears on screen.
MetaMask Strong Points and Sore Points
Back in 2020 compatibility alone won the argument. These days MetaMask still owns compatibility, but the cost and the clutter pull it back down. It stays the wallet we open when something needs connecting, and it stays the wallet we wouldn’t treat as a vault.
How to Set MetaMask Up Safely
- Key metamask.io in by hand instead of trusting a search ad, then hit "Get MetaMask". The company’s own warning is that clones lift your Secret Recovery Phrase the second it’s generated.
- Pick your browser, press the store button, something like "Add to Chrome", and confirm in the popup. Chrome, Firefox, Brave, Opera and Edge all carry it.
- Phone users: the App Store and Google Play, nowhere else. MetaMask suggests glancing at the Play listing for "10M+ downloads" before tapping install, an easy way to catch a fake.
- Launch it, choose to create a new wallet, and set a password. All that password does is encrypt the wallet on this machine, so don’t mistake it for a backup, because it recovers nothing anywhere else.
- Copy the 12-word Secret Recovery Phrase onto paper or steel, offline, then confirm it when asked. MetaMask’s instructions are to keep it off the internet entirely, cloud storage and password managers included, and never to hand it to anyone, its own staff included. Lose it and the wallet is gone, for you and for everybody else.
- Move a token amount across before you move anything real. Once a transaction lands on the wrong network or the wrong address, the funds are gone, and nobody can reverse it, not MetaMask, not the exchange, not the miner.
- Got more than beer money in there? Attach a hardware wallet before funding it. The device half of that pairing is covered in our Ledger Nano X setup guide.
Wallets to Weigh Against MetaMask
Coinbase Wallet
Already on the exchange? Then this is the first name to look at, and it’s a gentler landing for a first wallet.
The name on the door misleads a little, because it’s self-custody too. We pick the differences apart in our MetaMask vs Coinbase Wallet comparison.
Trust Wallet
Built for phones first, with a big spread of chains and its own dApp browser. If crypto mostly happens in your pocket, this suits the habit better. The head-to-head lives in MetaMask vs Trust Wallet.
Exodus
Prettier, calmer, and much nicer for watching a portfolio, with a proper desktop app that MetaMask has never shipped. Dapp connections are thinner and parts of it stay closed. Our Exodus wallet review lays out both halves.
FAQ
Can you trust MetaMask with your crypto?
Depends. Being non-custodial, MetaMask keeps no central pile of keys for anyone to raid, and the scam warnings run by default. Your 12-word Secret Recovery Phrase is still the whole wallet though, and the company cannot fetch it back. Store it offline, and hang a hardware wallet off it once the balance gets serious.
What will MetaMask cost you?
Nothing up front. Swapping costs 0.875%, and pooled staking keeps 15% of the rewards. Subscriptions are separate: Transaction Shield asks $9.99 a month or $99 a year, while the metal MetaMask Card is $199 a year, both at the time of writing (September 2026).
Can MetaMask hold Bitcoin and Solana?
Yes. One recovery phrase now produces an EVM address, a Solana address and a Bitcoin address inside every account. Bitcoin runs on the Native SegWit derivation path, and imports have to match it.
Is the MetaMask code open source?
Not really. GitHub carries the code, but Consensys attached its own licence, and it permits changes only for Non-Commercial Use. That bucket covers hobby projects, charities, schools, government bodies and anything with fewer than 10,000 monthly active users.
Does MetaMask work with a hardware wallet?
Yes, and several. Ledger runs over USB on the extension and on mobile. Trezor and Lattice are USB and extension only. Keystone and NGRAVE ZERO work on both by QR code, with a few more devices doing QR on the extension. Solana still cannot live on hardware, so those accounts stay EVM-only.
What if your Secret Recovery Phrase goes missing?
The wallet goes with it. MetaMask states that a lost phrase means lost access, and no support ticket has ever changed that. Which is why the thing belongs on paper or steel, offline, well away from a cloud document or a password manager.
Do MetaMask swaps beat an exchange on price?
Rarely. The 0.875% fee lands on top of gas, and you are also paying whatever spread the decentralized exchange behind the quote applies. Convenience has real value, but on a large trade where price matters, price a centralized exchange first.
Our Verdict on MetaMask
Install it if dapps are a regular part of your week and you want one wallet that reaches nearly all of them, Bitcoin and Solana now included in the same account. Hang a hardware wallet off it and it turns into somewhere you can reasonably keep real money. Our guide to the best non-custodial wallets shows where it lands against the rest.
Walk away if genuinely open software matters to you, if you swap often enough that 0.875% stings, or if you’d rather have a wallet without a trading floor attached. Our call: the most useful wallet on the web, and still not the place to leave your savings.
Treat everything here as general information, not as financial, legal, or investment advice. Features and prices shift, so check the vendor’s own page before you spend anything.
