How to use the "Lock" feature on MetaMask Extension? (Privacy)

Understanding the Lock Feature

1. The Lock feature in MetaMask Extension serves as a session timeout mechanism that secures wallet access after a period of inactivity.

2. When enabled, it requires re-authentication via password or biometric verification before interacting with accounts or signing transactions.

3. This functionality does not encrypt private keys or alter on-chain data—it only controls local browser extension interface access.

4. Lock status is independent of network connection; it operates solely within the extension’s UI layer in Chromium-based browsers.

5. Users cannot disable the Lock feature entirely but may adjust its timeout duration through settings.

Configuring Auto-Lock Duration

1. Open the MetaMask Extension by clicking its fox icon in the browser toolbar.

2. Click the account avatar in the top-right corner and select Settings.

3. Navigate to the Security & Privacy tab and locate the Auto-lock time dropdown menu.

4. Options range from 1 minute to 60 minutes, with “Never” disabled by default for security compliance.

5. Changes apply immediately without requiring a browser restart or extension reload.

Manual Locking Behavior

1. A user can trigger immediate locking by selecting Lock Wallet from the main account view dropdown.

2. Once locked, all transaction request modals, token approvals, and address exports are blocked until unlock.

3. The extension displays a simplified interface showing only the lock icon and “Unlock Wallet” button—no balances or account details appear.

4. Attempting to switch networks or change accounts while locked results in an authentication prompt instead of action execution.

5. Locked state persists across browser tabs but does not affect mobile MetaMask app sessions.

Interaction with Hardware Wallets

1. When a Ledger or Trezor device is connected, the Lock feature still enforces UI-level access control.

2. Signing requests routed to hardware wallets require both extension unlock and physical device confirmation.

3. Disconnecting the hardware wallet does not auto-lock the extension—only inactivity or manual lock triggers it.

4. Recovery phrase viewing remains inaccessible during locked state, even if hardware wallet is attached.

5. Network-specific permissions granted to dApps remain active post-lock but cannot be modified until unlock.

Frequently Asked Questions

Q: Does locking MetaMask prevent malicious scripts from accessing my accounts?Locking only restricts UI interaction. Active browser tabs running compromised dApps may still exploit pre-approved permissions unless revoked manually.

Q: Can I bypass the lock using browser developer tools?No. MetaMask isolates sensitive operations inside a content script sandbox; DOM manipulation cannot restore unlocked state or expose private keys.

Q: Why does MetaMask lock automatically after switching browser tabs?This occurs only if the configured auto-lock timer expires during tab inactivity—not due to tab switching itself.

Q: Is the lock password stored locally or synced with MetaMask servers?The password is never transmitted or stored externally. It exists only as a client-side hash used to decrypt locally cached session tokens.