MetaMask
Best for open-source verification
How it rates
- Source published in a public repository
- Dedicated security page published
- Documentation open without an account
- Several indicators could not be verified from public sources at this check
Each indicator scores 2, 1 or 0. A pillar is the points earned over the points available; the overall score is the weighted sum. Every source below is public — check any of them yourself.
- MetSource code published in a public repository
Repository reachable at this check.
github.com/MetaMask/metamask-extension - MetSecurity documentation or disclosure page published
Security or support documentation reachable.
metamask.io/security - MetUser documentation reachable without an account
Documentation open at this check.
support.metamask.io/ - MetPublisher identifiable from its own repository organisation
Repository published under Consensys.
github.com/MetaMask/metamask-extension - Met
- Met
- Met
- MetDocumentation states how the product is funded or priced
Documentation available to check.
support.metamask.io/ - Met
- Met
- Met
- Met
- MetRelease history publicly visible
Repository carries public history.
github.com/MetaMask/metamask-extension - Met
- Met
- Met
- Met
- Met
- Met
- Met
- Met
- Met
- Met
- Met
- Met
The default wallet for Ethereum and EVM chains, with published source, security disclosure, documentation and legal terms all reachable without an account.
Our assessment
MetaMask is the wallet most people mean when they say "crypto wallet", and it is one of only two here that passed every indicator we checked. Source code, security disclosure, user documentation and legal terms are all published and reachable without an account.
Ubiquity is a security property
Being the default has a real, unglamorous benefit: almost every dapp is tested against MetaMask first, so connection failures and signature edge cases get found by someone else before they reach you. Wallets with smaller user bases regularly hit integration bugs that MetaMask users never see.
Its weakness is the same as everyone's
MetaMask is a hot wallet in a browser extension. The keys sit on a machine that also runs everything else you do, which no amount of open source changes. Signature phishing rose sharply through early 2026 and the extension has added pre-execution checks and clearer warnings in response — but the structural answer is to pair it with a hardware wallet for anything you would mind losing.
Cost is where to read the small print
The wallet itself is free; the in-app swap carries a service fee on top of the underlying route, and the built-in fiat on-ramps price separately again. None of that is hidden, and our cost pillar is 5% of the score in this category precisely because a wallet's real cost is what it charges when you transact rather than what it charges to install.
Who it suits
MetaMask fits anyone using Ethereum and EVM chains who wants the widest dapp compatibility and fully auditable code. DeFi users who want transaction simulation before signing should look at Rabby; Solana users at Phantom; Cosmos users at Keplr.
How rivals compare
| Service | Score | Best for | |
|---|---|---|---|
| Trust Wallet | 9.9 | open-source verification | Read → |
Frequently asked
Does this score mean MetaMask is safe?
No. It measures what a user can verify before installing: published source, documented security posture, open documentation and an identifiable publisher. Runtime key handling is not tested by us.
Why does open source matter for a wallet?
It is the one substantive property an outsider can check without reverse-engineering the app. Everything else requires trusting the publisher or a third-party audit.
What would raise this score?
Publishing source, a dedicated security page, open documentation and terms at stable public addresses — all checkable by anyone.