MetaMask

MetaMask

Chrome
·
v13.8.0
·
Last updated on Jan 12, 2026

Also on

Android

iOS

Security Score

82.3

dApp Permissions

35.0 / 35

User confirmation before processing requests

8.7 / 8.7
Description
Requires user confirmation before processing requests from dApps for specific RPC methods.
- The wallet requires user confirmation for every request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
User consent for dApp access

7.7 / 7.7
Description
Requires user approval before granting dApp access to specific RPC methods.
- The wallet requires user connection for every request.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Wallet unlock before requests

5.6 / 5.6
Description
Requires users to unlock it before processing dApp requests when in a locked state.
- The wallet requires user unlock the wallet to process any request
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching EIP-712 chainId detection

3.5 / 3.5
Description
Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.
- The wallet refuses to sign an EIP712 object with a chainId that does not match the currently active chain.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
eth_sign method disabled

3.3 / 3.3
Description
Restricts the use of the deprecated and insecure eth_sign method by default.
- The wallet has the eth_sign method disabled by default.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Mismatching SIWE domain detection

1.8 / 1.8
Description
Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.
- Wallet successfully warns the user when signing a message with domain or scheme mismatch.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Connected dApp management

1.5 / 1.5
Description
Allows users to list and revoke connected dApps.
- Wallet displays the list of connected DApps and allows connection removal. The functionality is working properly.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Token approval management

1.5 / 1.5
Description
Allows users to view and revoke token approvals.
- The wallet includes the ability to revoke token approvals, which can be accessed through the portfolio page.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 3 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
User confirmation before switching chains

1.1 / 1.1
Description
Requires user confirmation before switching the active chain.
- The wallet asks for user confirmation before switching chains.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Nov 14, 2025
Report an issue with this check

Intent Verification

15.6 / 25

Transaction simulation

6.7 / 6.7
Description
Previews the expected outcome by simulating the request execution on the blockchain before signing.
- The wallet provides a detailed transaction simulation, clearly displaying all expected incomes and outcomes before execution.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear token approval dialog

0.0 / 6.7
Description
Clearly displays all the key details for ERC-20 Approve requests.
- The wallet clearly displays the spender's address. It identifies the token being approved as WPOL but does not show the contract address for custom tokens. The spending cap is clearly stated as "Unlimited WPOL." There is no warning about the risks of unlimited approvals.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clear message signing dialog

3.8 / 3.8
Description
Clearly displays all message signature request details without truncating or hiding information.
- The wallet does not truncate the message when performing a personal sign with a large message. It also displays the EIP-712 verifying contract.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 5 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
EIP-712 message parsing

2.4 / 2.4
Description
Displays human-readable details for EIP-712 signature requests from well-known protocols.
- The wallet correctly parses EIP-712 objects for well-known contracts and protocols such as Opensea Seaport listings, ERC-20 Permits, and Uniswap positions instead of displaying plain JSON. It provides a structured view that helps users understand what they are signing rather than just showing raw data.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 4 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Invalid address checksum detection

2.2 / 2.2
Description
Warns users when they input addresses with invalid EIP-55 checksums.
- Wallet successfully warns the user when trying to send a transaction with invalid checksum.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 3 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Mandatory message review

0.0 / 2.1
Description
Requires users to review all the details before signing a message.
- The confirm button is always enabled.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Links to blockchain explorers

0.6 / 1.2
Description
Consistently provides clickable links to block explorers for all key blockchain identifiers.
- The wallet includes clickable links in history and approves, but lacks them during transactions.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check

Physical Access

11.7 / 20

Seed phrase access control

5.4 / 5.4
Description
Requires authentication to access seed phrases or private keys.
- The wallet provides seed-phrase backup functionality and requires authentication to access mnemonics or private keys.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Manual wallet lock

3.9 / 3.9
Description
Allows users to lock it manually.
- The wallet features a lock button to lock it manually in the main menu.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Automatic wallet lock

0.0 / 3.4
Description
Verifies wallet auto-locks on inactivity.
- Automatic lock option is disabled by default.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Robust Authentication

0.0 / 3.3
Description
Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.
- The wallet requires passwords to be at least 8 characters long but does not prevent the use of easy-to-guess passwords such as 12345678.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Clipboard seed phrase leak prevention

0.0 / 1.8
Description
Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.
- The wallet allows users to copy mnemonics to the clipboard indefinitely and does not warn them about the risks of doing so.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Seed phrase access warning

1.8 / 1.8
Description
Warns users of the risk before allowing access to seed phrases or private keys.
- The wallet includes a short test with two questions to educate users about the risks of sharing mnemonics or private keys. It also provides a clear warning not to share them with anyone.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 7 screenshots

Last updated on Oct 21, 2025
Report an issue with this check

Threat Prevention

20.0 / 20

Phishing dApp detection

5.1 / 5.1
Description
Prevents or alerts users about interactions with a known malicious URL.
- MetaMask maintains a blacklist of DApps and warns users before they attempt to access them.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Malicious address detection

5.1 / 5.1
Description
Prevents or alerts users about interactions with a known malicious address.
- The wallet successfully warns the user about a deceptive address while trying to send funds to the Tornado Cash Attacker address.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Trusted dApp detection

3.3 / 3.3
Description
Informs users when interacting with a trusted dApp URL.
- Wallet inform the user when trying to connect to a well-known, verified url.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check
Unknown address detection

2.8 / 2.8
Description
Warns users when interacting with an unknown address.
- The wallet offers the chance to asign nicknames to unknown addresses.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Nov 17, 2025
Report an issue with this check
Full dApp URL display

1.5 / 1.5
Description
Clearly displays the full dApp URL in the connection prompt.
- The wallet truncates large URLs, but the window can be resized to view it in full.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
Malicious or spam token filtering

1.3 / 1.3
Description
Hides malicious tokens and NFTs by default.
- The wallet does not display either legitimate or scam NFT tokens.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 1 screenshot

Last updated on Oct 21, 2025
Report an issue with this check
dApp access disclosure dialog

1.0 / 1.0
Description
Informs dApp access to balances, history, and signing requests on connection.
- The wallet informs the user, within the connection dialog, that by connecting they are allowing the DApp to view their accounts, as well as to suggest transactions.
  — Verified by Alejo Sequeira at Coinspect
Evidence · 2 screenshots

Last updated on Oct 21, 2025
Report an issue with this check

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.