Creating a new wallet
When you install a new instance of MetaMask, you’ll be asked if you want to create a new wallet, or if you have an existing wallet. For information on using an existing wallet, read here.
To create a new wallet, select ‘Create a new wallet’.
You’ll then be asked whether you want to access and secure your wallet using a Secret Recovery Phrase (SRP), or by a social account like Google or Apple (Extension only). If you choose to secure your wallet using Google or Apple, these credentials AND your password will both be used to unlock your wallet and you need to have access to both in order to access your wallet.
So what’s the difference?
- SRP: The traditional self-custody method of getting set up with a 12-word phrase you store securely offline that only you have access to.
- Social login: Linking a social profile like Google or Apple to your MetaMask, and setting a password to create new wallets quickly and conveniently.
Accessing via Secret Recovery Phrase
A Secret Recovery Phrase is a unique phrase that proves you are the owner of a wallet. Whoever has the SRP has full control over the assets in a given wallet. If you choose to secure your wallet using an SRP, you will be the only one with access to this SRP, and it is your sole responsibility to secure it (read more about this principle, self-custody, here).
If you lose your SRP, or someone else gains access to it, MetaMask cannot recover your wallet, and you will lose control of all of those assets. This is why it is extremely important to deliberately store your SRP in a secure location.
Quick tips on securing an SRP:
- Store your SRP in a secure, offline location that only you have access to.
- Do NOT use online services, such as cloud services or password managers, to store your SRP. Any location connected to the internet can be (and if we’re being appropriately paranoid, will be) hacked.
- Get creative. Nobody can tell you where the best place to store your SRP is: that depends on your individual circumstances.
With a secure SRP, you’ll be able to access or recover your wallet on any instance of MetaMask.
Accessing via Google or Apple
Creating a wallet with your Google or Apple account is only available in MetaMask Extension v13.0.0 and above. MetaMask Mobile coming soon.
You can also create a new wallet by linking your login to a social account, such as Google or Apple.
If you choose this option, you will select a Google or Apple account to connect, and set a secure password for MetaMask. You don't need to custody a Secret Recovery Phrase (SRP) with this option. Once you have set up your login, you will be able to log into or reset your wallet on any device, by logging in with your linked social account and the password.
If you lose your password or someone else gains access to it, you will not be able to access your wallet through this method and MetaMask cannot restore your wallet. Keep your password safe, it cannot be recovered for you like other social login methods.
Quick tips for choosing a password:
- We strongly recommend using a password manager or other computer system to generate a password. Passwords generated by computers are much more secure than any you think of yourself.
- Do NOT repeat any passwords. Choose a brand new password that you’ve never used before, and won’t use again.
- Do NOT store your password on any unencrypted document, note, or in any sort of cloud account or storage.
While password managers are super convenient and great for generating strong passwords, there is a risk of your password manager being hacked. If your password manager is compromised, all of your passwords will be compromised, and you could lose your funds. It's up to you to decide your risk tolerance.
For more information, check out this article on the LastPass hack.
Once you have created your password, you can start using MetaMask. This password is synced across devices that you have logged into with the same Google/Apple account.
Remember: your account will still have an SRP, and we strongly recommend you secure it. See here to show how to reveal your SRP. This is the only way to access your wallet if you lose your password or get locked out of your Google/Apple account.
Any new wallets you create or import from this instance of MetaMask will also be connected to the social account and password. They will sync across devices and be restored when you login to a new instance of MetaMask. Don't import additional wallets after you've set up your social login if you don't want them linked.
Behind the scenes
When you connect a Google or Apple account to MetaMask, your wallet still has an SRP that gives you access to your accounts. That’s the nature of a standard crypto wallet like MetaMask. To let you access your wallet without your SRP, MetaMask uses a cryptographic technique called key sharding to safely track your wallet ownership.
To do this, your SRP is securely encrypted and split into five “shards” or parts. These shards are stored across five different nodes, where no one, including MetaMask, can access all of them. Your Google/Apple account AND password are used together to decrypt your SRP.
Which should I choose?
Choosing between these options depends on your individual circumstances, tolerance for risk, and privacy needs.
If you choose to access and secure your wallet via SRP, you will need to secure the phrase in a physical, secret location. This will be your account’s single point of failure, one that cannot be recovered for you, and you need to treat securing it as the most critically important part of your web3 experience.
If you choose to access and secure your wallet via a social login, you will need to choose and remember a secure password, and keep your social account secure. Your password and social account should be treated as securely as an SRP; if you lose access to your social login, or your password, nobody can recover your MetaMask for you. Hackers may attempt to impersonate your social account’s security to gain access to your account, so you’ll need to stay vigilant.
FAQs
Can I change my method of wallet login and recovery later?
Users with an existing wallet secured by a social login can always reveal their SRP and save that, but they cannot disconnect their linked social accounts and password. At this time, existing users cannot add a social login to their existing MetaMask.
If I lose my password, can I still access my wallet?
No. You need both your social login and your password to log into your wallet. However, there are a few unique situations to keep in mind:
- If you lose your password, but have your SRP saved, you can access your wallet. However, accessing your wallet this way will not connect to your Google or Apple account and password. You won’t be able to reset your password or login through your Apple or Google account anymore.
- If you have MetaMask mobile installed, biometrics turned on (i.e., Face ID), and the wallet you want imported, you will be able to log into your wallet and reset your password through biometric authentication.
I unlocked MetaMask or created a new wallet using Google or Apple. Should I receive a confirmation email?
No, you will not receive a confirmation email from unlocking MetaMask or creating a new MetaMask. Any emails you receive claiming to be from MetaMask are a scam. Read here for more information about legit MetaMask emails.
Can I change the Google or Apple account I signed up with?
No, it is not possible to change this account.
What data does MetaMask store for the social login feature?
To make this feature work as intended, MetaMask stores your social authentication identifier from Google or Apple, your hashed email, and login attempt metadata such as browser, operating system, and platform used.
Can I reset my password?
You can reset your password if you are currently logged into MetaMask. If you are logged out, you cannot reset your password. Learn more here
I’ve been locked out of MetaMask after entering an incorrect password too many times. What can I do?
If you’ve entered an incorrect password too many times, you will have to wait a certain amount of time to try again. Make sure to enter your password carefully to avoid longer time delays.