Wallet specification / research record
MetaMask
A self-custodial browser extension and mobile wallet. Focus on the origin of the app, account recovery method and permissions you approve.
- Format
- Software wallet
- Asset category
- Multi-asset; verify edition
- Prepared by
- WalletClause research desk
- Source check
- 9 November 2026
Documented configuration
| Attribute | Documented approach |
|---|---|
| Key location | Software wallet; hardware-linked accounts differ |
| Signing interface | Browser or mobile app |
| Connection | Browser extension / mobile |
| Asset scope | Multi-chain; verify current network support |
| Backup approach | Depends on account setup and import method |
| Primary workflow | Apps, transfers and account management |
Detailed research
4 notes / expand or collapse eachWhat the documentation establishes
MetaMask is available as a browser extension and mobile app. Its installation guide sends readers through the official website to the appropriate app store. Its recovery documentation distinguishes recovery phrases, imported private keys and newer login-based setups. Record which setup you actually use rather than assuming one recovery route covers every account.
MetaMask also documents token approvals: permissions can allow a contract to move a specified token. Merely disconnecting a website is not the same action as revoking an on-chain permission.
The decision that matters
For a wallet used with applications, review the request as a separate decision from visiting the website. A familiar visual design does not authenticate a domain. A correct domain does not establish that a particular contract request matches your intention.
Build a habit of pausing when the action changes. Reading an account balance, connecting an account, signing a message and granting token spending are different events. If you cannot explain the effect of a prompt, reject it and consult the app’s current documentation through a known address.
Do not merge different account types mentally
A locally generated software account and a hardware-linked account can appear in the same interface while protecting keys differently. Write down the origin of each account. Never import a hardware wallet’s recovery words into an extension simply to make the account appear there; follow the documented hardware connection route.
Likewise, an imported private key may need separate recovery records from the wallet’s original phrase. An account inventory is useful only if it says how each account can be restored without exposing those secrets to a website.
Questions to resolve before use
- Did installation begin at the official website?
- What recovery method applies to each account?
- Which network and contract is a request targeting?
- Does a permission persist after the current session?
Our directory classifies MetaMask as software because that is the app format; this does not imply that every account shown by it stores its keys in software. We have not audited the extension or evaluated an individual dapp.
Sources & scope
Source-based desk research. Checked . Product specifications and documentation can change. No hands-on testing or independent security audit is claimed.