Download MetaMask only from metamask.io (never app stores for desktop). Create a new wallet, write down the 12-word seed phrase on paper, set a strong password, then configure security settings: enable phishing detection, add custom networks (Arbitrum, Base) via chainlist.org, and connect a hardware wallet for signing high-value transactions. The whole setup takes 10 minutes and prevents the most common attack vectors.
How to Set Up MetaMask Correctly
4 min read
The short version
MetaMask is the most popular crypto wallet and also the most targeted by phishing attacks. Setting it up correctly from the start is the difference between wallet that works fine and wallet that gets drained next month. These steps protect you from the top 3 ways people lose funds: fake MetaMask downloads, exposed seed phrases, and unlimited token approvals.
How It Works
Setup sequence that maximizes security. Step 1: Download from the correct source. Desktop: go to metamask.io directly (type it, never click ads or links). Click Download. Install the browser extension. Mobile: iOS App Store or Google Play (search MetaMask and verify the developer is ConsenSys). Warning: fake MetaMask extensions exist on browser stores. Verify the developer and review count. Step 2: Create a new wallet. Click Create New Wallet. Set a strong unlock password (this encrypts the key on your device, it is NOT your seed phrase). Step 3: Write down your Secret Recovery Phrase. MetaMask shows 12 words. Write them on paper in order. Never screenshot, never type into any website, never store digitally. Verify by selecting words in order when prompted. Step 4: Configure security settings. Go to Settings > Security & Privacy. Enable: Phishing Detection (warns on known malicious sites), Use Hardware Wallet (if you have one), and set Auto-Lock timer to 5-15 minutes. Step 5: Add networks via Chainlist. Go to chainlist.org, connect MetaMask, and add: Arbitrum One (chain ID 42161), Base (8453), Optimism (10). This is safer than manually entering RPC URLs (typo risk). Step 6: Connect hardware wallet (optional but recommended for large holdings). Settings > Connect Hardware Wallet. Plug in your Ledger/Trezor. Select the accounts to import. Now those accounts use hardware signing while showing in MetaMask interface. Step 7: First transaction test. Send a tiny amount ($1) to another address you control. Verify it arrives. This confirms your setup is working before you move larger amounts.
Setting up MetaMask with Ledger connection in 15 minutes
Minute 0-3: Install MetaMask from metamask.io on Chrome. Create wallet. Password: 16+ characters. Write down 12-word phrase on the included card (or your own paper). Store in desk drawer. Minute 3-5: Verify phrase by selecting words in order. Settings > Security > enable Phishing Detection. Set Auto-Lock to 5 minutes. Minute 5-8: Open chainlist.org, connect MetaMask, search Arbitrum One, click Add to MetaMask. Repeat for Base and Optimism. Three L2 networks added. Minute 8-12: Plug in Ledger Nano. Settings > Connect Hardware Wallet > Ledger. Select first ETH account. It appears in MetaMask as Ledger 1. This account signs with the hardware device (maximum security). Minute 12-15: Send $5 from Coinbase to your Ledger-connected MetaMask address on Ethereum. Wait 2 minutes. $5 appears. Setup complete. You now have: a hot account (the MetaMask-generated one) for small DeFi interactions, and a hardware-secured account (Ledger 1) for larger holdings, both visible in one interface.
What People Get Wrong
The MetaMask password IS my wallet backup
The password only encrypts the local key file on your device. If your computer dies and you only know the password, your funds are gone. The 12-word seed phrase is the actual backup. The password is convenience (unlocking the app), not security (recovering the wallet).
MetaMask stores my crypto
MetaMask stores your private keys. Your crypto exists on the blockchain. MetaMask is a window to view and interact with it. If MetaMask the company disappeared tomorrow, your seed phrase still works in any other wallet (Trust Wallet, Rabby, etc.).
One MetaMask account is enough
Using one account for everything (DeFi, NFTs, receiving payments, testing random protocols) concentrates risk. Better: hot account for exploration/testing, hardware account for savings, separate account for public-facing activity. MetaMask supports multiple accounts from one seed or via hardware wallet.
Keep Reading
Sources & Further Reading
- MetaMask Download
Official MetaMask download page (only legitimate source for desktop)
- Chainlist
Add EVM networks to MetaMask safely with verified RPC endpoints
- MetaMask Support
Official knowledge base and troubleshooting guides
Questions People Also Ask
- Is MetaMask safe?
- MetaMask itself is safe (open-source, audited, used by millions). The risks are: phishing sites that trick you into signing malicious transactions, malware that extracts the encrypted key file, and user errors (sharing seed phrase, approving unlimited spending on sketchy contracts). The wallet is secure; the user must also be careful.
- Should I use MetaMask or Rabby?
- Rabby offers built-in transaction simulation (shows exactly what will happen before you sign), better approval management, and multi-chain balance views. MetaMask has more dApp compatibility and broader ecosystem support. If you value security features: Rabby. If you value maximum compatibility: MetaMask. You can use both on the same seed phrase.
- Can I use MetaMask for Bitcoin?
- MetaMask is Ethereum/EVM-only. It works on Ethereum, Arbitrum, Optimism, Base, Polygon, BSC, and any EVM chain. For Bitcoin, use a dedicated Bitcoin wallet (BlueWallet, Sparrow) or a multi-chain wallet (Exodus, Trust Wallet). You cannot send or receive BTC in MetaMask.