How to download MetaMask safely (and verify it's real)

The only official source, how to confirm the real extension, and a 30-second checksum check — so the wallet you install is the wallet the developers shipped.

Security Guides · 7 min · Updated Jun 2026

Roughly 90% of crypto thefts begin with phishing, and one of the simplest attacks is also one of the most effective: a fake MetaMask. Scammers buy "MetaMask download" search ads, clone the website at a misspelled domain, and publish look-alike extensions. The counterfeit behaves exactly like the real wallet — right up until you type your Secret Recovery Phrase, at which point your funds are gone.

The good news: avoiding this is mechanical. Get the download from the one official source, confirm the listing is genuine, and verify the file itself. Here's how to do all three.

The only official sources for MetaMask

The website

There is exactly one official website: metamask.io/download. Type it manually or open it from a saved bookmark. Do not reach it through a search-engine ad, a link in an email or DM, or a "MetaMask" result you haven't verified — those are the most common ways people land on a clone. Before downloading, check for the SSL padlock and read the domain character by character (watch for typosquats like metarnask.io or metamask-app.com).

The browser and app stores

From metamask.io, the Download button sends you to the legitimate Chrome Web Store, Firefox Add-ons, Brave, or Edge listing. On mobile, it redirects to the real App Store or Google Play page. The stores are moderated, which adds a layer of protection — but fakes still slip through, so the next step matters.

How to confirm the extension is the real MetaMask

Before you click "Add to browser," verify the listing:

  • Extension ID. The official MetaMask Chrome extension ID is nkbihfbeogaeaoehlefnkodbefgpgknn. It appears in the store URL right after /detail/. If the ID is anything else, it is not MetaMask.
  • Developer name. The publisher must be "MetaMask." Look for the store's verified-publisher badge.
  • User count. The genuine extension has 10M+ users and thousands of reviews. A listing with a few hundred users is a fake riding the name.
  • Icon. The fox icon should match exactly — counterfeits often use slightly altered colors or proportions.
Red flag: a "MetaMask" extension that was published recently, has a low user count, or sits at an extension ID other than nkbihfbeogaeaoehlefnkodbefgpgknn. Remove it and install from metamask.io/download.

How to verify the file you downloaded

For desktop builds and manual installs, you can prove the file wasn't tampered with — no trust required.

What a checksum proves

A SHA-256 checksum is a unique fingerprint of a file. Change a single byte — for example, inject malware — and the entire hash changes. So if the hash of your download matches the hash the developers published, you have the exact file they shipped.

Verify it in 30 seconds

  1. Download MetaMask from the official source above.
  2. Open WalletGuard's in-browser SHA-256 verifier and drag your file into the drop zone. The hash is computed locally in your browser — nothing is uploaded.
  3. Compare the result to MetaMask's published SHA-256 value, also listed on our MetaMask official download page.
  4. Hashes match → the file is authentic. They differ → delete it and re-download from the official source.
New to checksums? Our complete guide to verifying any wallet download walks through SHA-256 and GPG signatures on Windows, macOS, and Linux.

After install: protect your Secret Recovery Phrase

Downloading safely is half the job. The other half is never handing your keys to an attacker:

  • MetaMask never asks for your Secret Recovery Phrase during normal use — only when you deliberately restore a wallet on a new device. Any site, popup, or "support agent" that asks for it is stealing from you.
  • MetaMask has no phone support. Any phone number claiming to be "MetaMask support" is a scam.
  • Store your recovery phrase offline, never in a screenshot, cloud note, or email.

Frequently asked questions

What is the official MetaMask download URL?

The only official source is metamask.io/download, which links to the verified extension stores and the legitimate App Store and Google Play listings. Type it manually or use a bookmark — never download MetaMask from search ads or email links.

How do I know if a MetaMask extension is real?

Confirm the developer is "MetaMask," the listing has 10M+ users and thousands of reviews, the fox icon is correct, and the Chrome extension ID is nkbihfbeogaeaoehlefnkodbefgpgknn. A new or low-review listing is a fake.

What is the official MetaMask Chrome extension ID?

It is nkbihfbeogaeaoehlefnkodbefgpgknn, visible in the store-listing URL after /detail/. If the ID differs, do not install it.

Can I verify the MetaMask file with a checksum?

Yes — for desktop and manual installs, compute the file's SHA-256 hash and compare it to MetaMask's published value. WalletGuard's verifier does this locally in your browser.

Is the "Wallet Guard" extension the same as WalletGuard.cc?

No. WalletGuard (walletguard.cc) is an independent verified-download directory and in-browser checksum tool. It is not the former "Wallet Guard" browser extension at walletguard.app, which was acquired by Consensys and merged into MetaMask. They are different products from different parties.

The bottom line

Install from metamask.io/download, confirm the extension ID and user count, verify the SHA-256 checksum, and guard your recovery phrase. Four steps, a couple of minutes, and the difference between a real wallet and a drained one.

Verify your MetaMask download now

Read in other languages: Español · Português · Deutsch · Français · Türkçe · 日本語