MetaMask Extension for Chrome | MetaMask browser extension

Chapter 1: Understanding the Foundations

Before we install MetaMask, it's essential to grasp the core concepts that underpin its existence. Without this foundational knowledge, using a tool like MetaMask can feel abstract and even intimidating. This chapter demystifies the technology, providing you with the "why" before we get to the "how."

What is a Cryptocurrency Wallet?

At its simplest, a cryptocurrency wallet is a digital tool that allows you to interact with a blockchain network. It lets you send, receive, and store digital assets like cryptocurrencies and Non-Fungible Tokens (NFTs). However, the term "wallet" is slightly misleading. Your assets are never actually stored *in* the wallet itself. Instead, they exist on the blockchain, which is a globally distributed public ledger. Your wallet holds the keys that prove your ownership of those assets and allow you to make transactions with them.

Custodial vs. Non-Custodial Wallets

This is one of the most important distinctions in the crypto world.

• Custodial Wallets: A third party (like a centralized crypto exchange) holds your private keys for you. This is convenient, as you don't have to worry about losing your keys. However, it comes with a major trade-off: you are trusting that third party with your assets. If they get hacked or go out of business, your funds could be lost. The famous crypto mantra, "not your keys, not your crypto," applies here.
• Non-Custodial Wallets: You, and only you, hold and control your private keys. MetaMask is a non-custodial wallet. This grants you complete sovereignty over your funds. You are your own bank. While this is incredibly empowering, it also places the full responsibility for security on your shoulders. If you lose your keys, no one can help you recover your assets.

Hot Wallets vs. Cold Wallets

• Hot Wallets: These are wallets that are connected to the internet. Browser extensions like MetaMask, mobile apps, and desktop wallets are all hot wallets. Their constant internet connection makes them convenient for frequent transactions but also more vulnerable to online threats like hacking and malware.
• Cold Wallets: These are physical hardware devices (like a Ledger or Trezor) that store your private keys completely offline. Transactions are signed on the device itself, so the keys never touch your internet-connected computer. This makes them the most secure option for storing large amounts of crypto. A common best practice is to use a hot wallet like MetaMask for daily transactions and a cold wallet for long-term storage, often connecting the two for maximum security.

Public Keys vs. Private Keys

This is the cryptographic bedrock of all cryptocurrency wallets.

• Public Key: Think of this as your bank account number. It's an address that you can safely share with others to receive funds. It is derived from your private key, but it's mathematically impossible to reverse-engineer the private key from the public key. Your public address in MetaMask typically starts with 0x....
• Private Key: This is the master secret. It's a long, complex string of characters that gives you access to and control over the funds at your public address. Think of it as your bank account PIN, password, and signature all rolled into one. You must **NEVER** share your private key with anyone. Anyone who has it can steal your funds. MetaMask manages your private keys for you, but they are all derived from one single "master key," which we will discuss next.

Introduction to Ethereum and Blockchain

MetaMask was originally built for the Ethereum blockchain. While it now supports many other compatible networks, understanding Ethereum is key to understanding MetaMask.

A blockchain is a decentralized, immutable digital ledger. It's a chain of blocks, where each block contains a list of transactions. This chain is distributed across thousands of computers worldwide, meaning no single entity controls it, making it incredibly resistant to censorship and fraud.

Ethereum took this concept a step further. It's not just a ledger for financial transactions; it's a "world computer." It allows developers to write and deploy Smart Contracts—self-executing contracts with the terms of the agreement directly written into code. These smart contracts are the building blocks for Decentralized Applications (dApps). MetaMask is your tool for interacting with these dApps. When you buy an NFT, lend assets on a DeFi protocol, or vote in a DAO, you are using MetaMask to sign and send a transaction to a smart contract on the Ethereum blockchain.

To perform any action on the Ethereum network, you must pay a transaction fee, known as a gas fee. This fee is paid to the network validators who process your transaction and secure the network. Gas fees are denominated in a smaller unit of Ethereum called Gwei. The cost of gas fluctuates based on network demand—the busier the network, the higher the gas fees.

Chapter 2: Getting Started: Installation and Setup

Now that we have a solid theoretical foundation, it's time for the practical part: installing MetaMask on your Chrome browser and creating your first secure wallet. Follow these steps with extreme care and attention to detail, especially when handling your Secret Recovery Phrase.

Step-by-Step Installation on Chrome

1. Navigate to the Official Website: Open Google Chrome and go to the official MetaMask website: metamask.io. Do not search for "MetaMask" on Google and click the first link. Scammers often run ads that mimic the official site to trick you into downloading a malicious version. Always type the URL directly or use a trusted bookmark.
2. Go to the Download Page: On the homepage, click the "Download" button. You will be directed to a page where you can select your browser. It should auto-detect that you are using Chrome.
3. Go to the Chrome Web Store: Click the link that directs you to the Chrome Web Store. This is the safest way to ensure you are getting the legitimate extension.
4. Verify the Extension: This is a critical security check. Before you click "Add to Chrome," verify the following:
   • Publisher: It must say "Offered by: metamask.io".
   • Number of Users: The official extension has over 10 million users. If you see a low number, it's a fake.
   • Reviews: Check the reviews and ratings. The official version will have thousands of legitimate reviews.
5. Add to Chrome: Once you've verified its authenticity, click the "Add to Chrome" button. A popup will appear asking for permissions. Click "Add extension."
6. Welcome Screen: After a successful installation, a new tab will open with the MetaMask welcome screen. The little fox logo will also appear in your browser's extension toolbar. It's a good idea to "pin" the extension for easy access. Click the puzzle piece icon in Chrome's toolbar and then click the pin icon next to MetaMask.

Creating Your First Wallet

You will now be presented with two options: "Import Wallet" and "Create a Wallet." Since this is your first time, we will create a new one.

The Secret Recovery Phrase (SRP): The Most Critical Step

1. Start the Process: Click "Create a Wallet" on the welcome screen.
2. Create a Password: You'll first be asked to create a password. This password is a local security measure. It only encrypts your MetaMask extension on *this specific computer*. It does NOT protect your funds if someone gets your SRP. If you forget this password, you can always restore your wallet with your SRP. Create a strong, unique password that you don't use anywhere else.
3. Secure Your Wallet Video: MetaMask will show you a short, informative video about the Secret Recovery Phrase. Watch it carefully. It explains what it is and how to keep it safe.
4. Reveal Your SRP: Click to reveal your 12-word Secret Recovery Phrase.
5. STORE YOUR SRP OFFLINE: This is the moment of truth.
   • WRITE IT DOWN: Get a pen and paper. Write down the 12 words in the correct order (1 to 12). Double-check, and then triple-check that every word is spelled correctly and is in the right sequence.
   • DO NOT store it on your computer in a text file.
   • DO NOT take a screenshot of it.
   • DO NOT save it in your email, cloud storage, or a password manager.
   • DO NOT ever say it out loud or share it on a screen share.
   • The Best Practice: Write down at least two copies. Store them in separate, secure, physical locations (e.g., a home safe, a bank deposit box). Some users etch the words into a metal plate to protect against fire or water damage. This might sound extreme, but when dealing with potentially valuable assets, it's necessary.
6. Confirm Your SRP: On the next screen, MetaMask will ask you to confirm your phrase by clicking on the words in the correct order. This ensures you have written it down correctly.
7. Congratulations! Once confirmed, your wallet is set up. You will see a final confirmation screen. Your wallet is now ready to use.

Chapter 3: Navigating the MetaMask Interface

With your wallet created, let's familiarize ourselves with the user interface. It's designed to be intuitive, but understanding each component is key to using it effectively and safely.

The Main Dashboard

When you click the MetaMask fox icon in your toolbar, a small window will pop up. This is your main dashboard.

• Network Selector: At the very top, you'll see a dropdown menu that likely says "Ethereum Mainnet." This is where you can switch between different blockchain networks that MetaMask supports (e.g., test networks or other compatible chains like Polygon).
• Account Name and Address: Below the network, you'll see your account name (default is "Account 1") and your public address directly underneath it (e.g., 0x123...abc). Clicking on this address will automatically copy it to your clipboard. This is the address you share to receive funds.
• Balance Display: The main area shows your balance of the network's native currency (e.g., ETH on Ethereum) and its approximate value in your chosen fiat currency (e.g., USD).
• Main Action Buttons: Below the balance are prominent buttons:
  • Buy: This allows you to purchase crypto directly within MetaMask using third-party services (on-ramps).
  • Send: Used to transfer assets from your wallet to another address.
  • Swap: Allows you to trade one type of token for another directly within the wallet.
  • Bridge: A feature to move assets between different blockchain networks.

The Assets and Activity Tabs

Below the action buttons, you'll see two tabs: "Assets" and "Activity."

• Assets Tab: This is the default view. It lists all the different tokens you hold in your wallet. Initially, you will only see ETH. To see other tokens (known as ERC-20 tokens), you often need to import them manually. We'll cover this later. This tab is also where your NFTs (ERC-721 tokens) will appear once you acquire them.
• Activity Tab: This tab shows a complete history of your recent transactions for the selected account. You'll see sends, receives, smart contract interactions, and swaps. Each entry will show its status: "Confirmed," "Pending," or "Failed." Clicking on a transaction provides more details and a link to view it on a block explorer like Etherscan.

Account Management

MetaMask allows you to manage multiple accounts under the umbrella of your single Secret Recovery Phrase. This is useful for separating funds for different purposes (e.g., one account for trading, one for NFTs).

• Accessing Account Options: Click the colored circle icon at the top right of the MetaMask window. This opens the account menu.
• Creating a New Account: Click "Create account." You can give it a name, and a brand-new Ethereum address will be generated for you. You can switch between these accounts easily from this menu. Remember, all these accounts are still tied to your one 12-word SRP.
• Importing an Account: This option allows you to import an account using its individual private key. This is an advanced feature and should be used with caution. It's generally not recommended for beginners, as managing individual private keys can be risky.
• Connecting a Hardware Wallet: This is the most secure way to use MetaMask. This option will guide you through connecting a hardware wallet like a Ledger or Trezor. When connected, MetaMask acts as an interface, but all transactions must be physically confirmed on your hardware device. This means even if your computer is compromised with malware, your funds are safe because the private keys never leave the hardware wallet.

Chapter 4: Core Functionality in Detail

Now, let's perform some of the most common actions in MetaMask: receiving, sending, and swapping assets. We'll break down each process step-by-step.

Receiving Funds

To use your wallet, you first need to fund it. The process is simple:

1. Open MetaMask.
2. Ensure you are on the correct network (e.g., Ethereum Mainnet).
3. Click on your address (the 0x... string) at the top of the window to copy it.
4. Go to the exchange or other wallet where you currently have funds.
5. Initiate a withdrawal or "send" transaction.
6. Paste your copied MetaMask address into the recipient field.
7. Crucially, select the correct network for the transfer. If you are sending ETH from an exchange to your MetaMask wallet on Ethereum Mainnet, you must select the "ERC20" or "Ethereum" network on the exchange. Sending on the wrong network can result in a permanent loss of funds.
8. Confirm the transaction and wait for it to be processed on the blockchain. It should appear in your MetaMask wallet within a few minutes, depending on network congestion.

Sending a Transaction

Sending assets from your MetaMask wallet is just as straightforward.

1. Click the "Send" button on the main dashboard.
2. In the "To" field, paste the public address of the recipient. MetaMask has some security features and may warn you if the address looks suspicious or is from a known scam. Always double-check the address with the recipient.
3. Select the asset you wish to send from the dropdown menu.
4. Enter the amount you want to send.
5. You will be taken to the confirmation screen. This is where you review the most important part of the transaction: the gas fee.

Understanding Gas Fees in Depth

The gas fee screen in MetaMask is critical to understand. The total fee you pay is calculated as: (Gas Limit x (Base Fee + Priority Fee)).

• Gas Limit: This is the maximum amount of "gas" (computational effort) your transaction is allowed to consume. For a simple ETH transfer, it's typically fixed at 21,000. For more complex smart contract interactions, it's higher. MetaMask estimates this for you. You generally shouldn't change it unless you are an advanced user.
• Base Fee: This is a network-wide fee that is determined by block demand. It is burned (destroyed) rather than paid to validators. You must pay at least this amount for your transaction to be considered valid.
• Priority Fee (or "Tip"): This is an extra fee you add to incentivize validators to include your transaction in the next block. During times of high network congestion, a higher priority fee will get your transaction processed much faster.

MetaMask simplifies this by offering three presets: Low, Market, and Aggressive. It estimates the appropriate fees based on current network conditions. For most users, "Market" is a good balance of cost and speed. If you are in a hurry, choose "Aggressive." Choosing "Low" may result in your transaction being stuck for a long time if the network gets busy.

Once you are happy with the gas fee, click "Confirm." The transaction is broadcast to the network. You can track its progress in the "Activity" tab.

Using the Swap Feature

MetaMask's built-in Swap feature is a convenient way to trade tokens without having to connect to an external decentralized exchange (DEX). It acts as a DEX aggregator, meaning it searches multiple sources to find you the best price for your trade.

1. Click the "Swap" button on the main dashboard.
2. Select the token you want to swap *from* and the token you want to swap *to*.
3. Enter the amount. The interface will show you an estimated amount of the token you will receive.
4. Click "Get quotes." MetaMask will search for the best price.
5. Review the quote. It will show the exchange rate, the estimated gas fee, and the MetaMask fee (typically 0.875%).
6. Slippage Tolerance: In the settings, you can adjust slippage. This is the percentage of price change you are willing to accept between the time you submit the transaction and the time it is confirmed on the blockchain. A value of 1-3% is common.
7. Token Approval (First-time swaps): If this is the first time you are swapping a particular token, you will need to perform a one-time "Approve" transaction. This gives the MetaMask smart contract permission to spend that token on your behalf. This will cost a small gas fee.
8. Once approved, you can click "Swap" to execute the main trade. This will be a second transaction that also requires a gas fee.

Chapter 5: Connecting to dApps and the Web3 Ecosystem

The true power of MetaMask is unlocked when you use it to interact with the thousands of decentralized applications available. From finance to art to gaming, dApps are the heart of Web3.

How dApp Connections Work

When you visit a dApp website (like OpenSea, Uniswap, or Aave), you will almost always see a "Connect Wallet" button in the top right corner.

1. Click "Connect Wallet."
2. A list of wallet options will appear. Choose MetaMask.
3. The MetaMask extension will pop up with a connection request. This prompt is very important. It will show you which account you are connecting and ask for permission to view your address, account balance, and activity, and to suggest transactions to approve.
4. This initial connection is read-only. The dApp cannot perform any transactions on your behalf without you explicitly signing a request later.
5. Select the account(s) you wish to connect and click "Next," then "Connect." Your dApp interface should now update to show that your wallet is connected, often displaying a snippet of your address and your ETH balance.

Interacting with Smart Contracts and Signing Transactions

Once connected, any action you take on the dApp that requires a blockchain transaction will trigger a MetaMask pop-up. For example:

• Listing an NFT for sale on OpenSea.
• Swapping tokens on Uniswap.
• Depositing funds into a lending protocol like Aave.

The MetaMask pop-up will show you the details of the transaction you are about to sign. It is **absolutely critical** that you read this screen carefully before clicking "Confirm." It will show you:

• The estimated gas fee for the transaction.
• The total amount being spent (including gas).
• Sometimes, it will show the function being called on the smart contract (e.g., `mint`, `deposit`).

"Sign" Requests vs. "Send Transaction" Requests

You will encounter two main types of requests from dApps:

• Send Transaction: This is a standard on-chain transaction that changes the state of the blockchain. It always requires a gas fee. Examples include sending tokens, minting an NFT, or swapping tokens.
• Sign Message: This is an off-chain action where you use your private key to cryptographically sign a piece of data (a message). This proves you are the owner of your wallet without requiring a gas fee. This is often used for logging into a dApp or verifying ownership. While it doesn't cost gas, you should still be extremely cautious. Malicious "Sign" requests can be used to trick you into authorizing a scammer to drain your wallet. Only sign messages from dApps you trust completely.

Managing Connected Sites

It's good security hygiene to periodically review and disconnect your wallet from sites you no longer use.

1. Open MetaMask.
2. Click the three-dots menu on the right.
3. Select "Connected sites."
4. This will show you a list of every site that is currently connected to your wallet. You can manually disconnect from each one by clicking the trash can icon next to it.

Chapter 6: Advanced Features and Settings

MetaMask is powerful out of the box, but it also has a range of advanced settings that give you more control and access to the broader multi-chain ecosystem.

Adding Custom Networks (RPCs)

Ethereum can be expensive and slow. As a result, many alternative "Layer 2" and "Sidechain" networks have emerged, which are faster and cheaper. Examples include Polygon, Arbitrum, Optimism, and Avalanche. MetaMask can be used on all these networks, but you often have to add them manually.

The easiest way to do this is using a tool called Chainlist.

1. Go to chainlist.org.
2. Connect your MetaMask wallet to the site.
3. Search for the network you want to add (e.g., "Polygon").
4. Click "Add to MetaMask."
5. A MetaMask pop-up will appear with the network details already filled in. Click "Approve" to add the network and "Switch Network" to start using it immediately.

You can also add a network manually by going to MetaMask Settings > Networks > Add a network. You will need to find the correct Network Name, RPC URL, Chain ID, and Currency Symbol for the network you wish to add. This information is usually available in the official documentation for that blockchain.

Exploring the Settings Menu

Click the circle icon > Settings to explore more options:

• General: Set your primary currency (USD, EUR, etc.), your language, and your account avatar.
• Advanced: Here you can reset your account (this just clears your transaction history, it doesn't delete your account), sync with the mobile app via QR code, set an auto-lock timer, and enable advanced gas controls.
• Security & Privacy: This is a very important section. You can reveal your Secret Recovery Phrase here (only do this if absolutely necessary and you are 100% sure your device is secure). You can also enable phishing detection, which will warn you about known malicious sites.
• Networks: This is where you can view, edit, and add custom networks manually.

Chapter 7: Security Best Practices - The Fort Knox Guide

Using a non-custodial wallet means you are the sole guardian of your assets. This chapter is the most important in this entire guide. Read it, understand it, and live by it. A single mistake can lead to a total loss of funds with no recourse.

Common Scams and How to Avoid Them

• Phishing Scams: You receive an email, a direct message on Discord/Telegram/X, or see a link that looks like it's from MetaMask, OpenSea, or another popular service. The site will be a pixel-perfect clone of the real one, but it will ask you to enter your SRP to "fix an issue" or "claim an airdrop." This is a scam to steal your phrase and your funds. Always bookmark official sites and use those bookmarks.
• Fake Support Staff: If you ask for help in a public Discord server or on social media, you will instantly receive DMs from people claiming to be "support" or "admins." They will be very helpful and will eventually guide you to a website where you need to "validate your wallet" by entering your SRP. They are scammers. Block them immediately. Real support will never DM you first.
• Malicious Signature Requests: You connect to a malicious dApp, and it pops up a MetaMask "Sign" request. The message you are signing may look harmless, but it's actually a cleverly disguised transaction that gives the scammer permission to spend all your tokens (e.g., `setApprovalForAll`). Read every signature request carefully. If you don't understand what you are signing, reject it.
• Airdrop / Free NFT Scams: You find a random NFT or token in your wallet that you didn't buy. The name of the NFT directs you to a website to "claim" your prize. When you connect to the site and try to claim, it will trigger a malicious transaction that drains your wallet. If you receive an unsolicited asset, the safest thing to do is ignore it and hide it in your wallet interface.

Hardware Wallets: The Ultimate Security Upgrade

As mentioned earlier, connecting a hardware wallet (like a Ledger or Trezor) to MetaMask provides the best of both worlds: the smooth user interface of MetaMask and the offline security of a cold wallet. When you use this setup, your private keys never leave the physical device. Every single transaction must be confirmed by pressing a button on the hardware wallet itself. This means that even if a hacker gains full control of your computer and can see your screen, they cannot steal your funds because they cannot physically press the button on your device. If you plan to store any significant value in crypto, investing in a hardware wallet is not optional; it is essential.

Token Approval Hygiene

When you use dApps, you often grant them "approvals" to spend your tokens. Sometimes, these approvals are for an unlimited amount. A malicious or exploited dApp could potentially use this approval to drain your funds. It is good practice to periodically review and revoke these approvals.

You can use a trusted tool like the "Token Approval Checker" on a block explorer like Etherscan. Connect your wallet, and it will show you all the contracts you've given approvals to. You can then submit transactions to revoke any approvals you no longer need, especially for dApps you rarely use.

Chapter 8: Troubleshooting Common Issues

Even with a great user interface, things can sometimes go wrong. Here's how to solve some of the most common MetaMask problems.

"My transaction is stuck pending"

This usually happens when you set a gas fee that was too low, and the network got busy before your transaction could be confirmed. Validators prioritize transactions with higher fees, so yours gets pushed to the back of the line.

• Solution 1: Speed Up. Open MetaMask, go to the "Activity" tab, and find the pending transaction. You should see a "Speed up" button. Clicking this will let you re-submit the same transaction but with a higher gas fee. This new transaction will hopefully be picked up by validators quickly.
• Solution 2: Cancel. You will also see a "Cancel" button. This works by sending a new transaction *to yourself* with a value of 0 ETH, using the same "nonce" (a transaction counter) as the stuck transaction but with a higher gas fee. When this cancellation transaction is confirmed, it invalidates the original stuck one. Both speeding up and canceling require you to pay a gas fee.

"I don't see my tokens"

You just received some tokens from a friend or an airdrop, but they aren't showing up under the "Assets" tab. Don't panic. As long as you can see the tokens at your address on a block explorer, they are safe. MetaMask just doesn't know about the token yet.

• Solution: Import Token. At the bottom of the "Assets" tab, click "Import tokens." Go to a site like Etherscan or CoinGecko and find the token you're missing. Copy its "Contract Address." Paste this address into the "Token Contract Address" field in MetaMask. The Token Symbol and Decimals should auto-populate. Click "Add Custom Token," and it will now appear in your asset list.

"I forgot my password"

If you forget the password for your MetaMask extension, you cannot recover it. However, the password only protects that local installation. Your funds are secured by your Secret Recovery Phrase.

• Solution: Restore from SRP. You will need to uninstall the MetaMask extension from Chrome, then reinstall it. During the setup process, instead of "Create a Wallet," choose "Import Wallet." You will then be prompted to enter your 12-word Secret Recovery Phrase and create a new password. Once you do this, your entire wallet, with all its accounts and assets, will be restored. This process highlights why your SRP is infinitely more important than your password.

"I lost my Secret Recovery Phrase"

Conclusion and The Future of MetaMask

You have now completed an exhaustive journey through the world of MetaMask. You've learned about the fundamental principles of blockchain, the critical nature of private keys, and the responsibilities of self-custody. You have walked through the entire process of installation, setup, and daily use, from simple transfers to complex dApp interactions. Most importantly, you are now armed with the security knowledge required to navigate the Web3 world safely and confidently.

MetaMask is more than just a piece of software; it's a foundational pillar of the decentralized internet. It continues to evolve with new features like MetaMask Snaps, which allow for community-built features to extend its functionality even further. As the gateway for millions, its role in onboarding the next billion users to Web3 cannot be overstated.

Continue to be curious, but always remain vigilant. Double-check every transaction, question every DM, and above all, protect that Secret Recovery Phrase. Welcome to the future of the internet.

Frequently Asked Questions (FAQ)

1. Is MetaMask free to use?

Yes, the MetaMask extension itself is free to download and use. However, you will have to pay blockchain network fees (gas fees) for every transaction you make. MetaMask also charges a small service fee (0.875%) on its built-in Swap feature.

2. Does MetaMask hold or control my cryptocurrency?

No. MetaMask is a non-custodial wallet. It is simply a tool that allows you to access and manage your assets on the blockchain. You, and only you, have control over your funds via your Secret Recovery Phrase. The MetaMask team cannot access your wallet or reverse any transactions.

3. Can I use Bitcoin (BTC) with MetaMask?

Not directly. MetaMask is designed for Ethereum and EVM-compatible (Ethereum Virtual Machine) chains. Standard Bitcoin operates on its own separate blockchain. However, you can hold "wrapped" versions of Bitcoin, like Wrapped BTC (WBTC), which is an ERC-20 token on the Ethereum network that is pegged 1:1 to the price of Bitcoin.

4. How do I cash out my crypto from MetaMask to my bank account?

MetaMask does not directly connect to the traditional banking system. To cash out, you need to send your cryptocurrency from your MetaMask wallet to a centralized exchange (like Coinbase, Kraken, or Binance). Once the funds are on the exchange, you can sell them for your local fiat currency (e.g., USD, EUR) and then withdraw that money to your linked bank account.

5. Is MetaMask safe?

The MetaMask software itself is very secure and has been audited extensively. The biggest security risk is not the software, but the user. If you keep your Secret Recovery Phrase safe and offline, avoid phishing scams, and practice good digital hygiene, using MetaMask is very safe. Connecting it to a hardware wallet makes it even safer.

6. What is the difference between my password and my Secret Recovery Phrase?

Your password is a local security measure that encrypts the MetaMask data on a single device. If you forget it, you can restore your wallet. Your Secret Recovery Phrase is the master key to your funds. It can be used to restore your wallet on any device in the world. If you lose it, your funds are lost. If someone else gets it, they can steal your funds.