How to set up auto-lock timeout on MetaMask for security?

MetaMask Auto-Lock Timeout Configuration

1. Open the MetaMask browser extension or mobile application and ensure you are logged into your wallet.

2. Navigate to the account menu by clicking the circle icon in the top-right corner of the extension interface or tapping your account name in the mobile app.

3. Select Settings from the dropdown or sidebar menu to access security and privacy options.

4. Scroll down and tap or click Security & Privacy to reveal advanced wallet protection parameters.

5. Locate the Auto-Lock Time section, which displays a slider or dropdown with time intervals ranging from 1 minute to 30 minutes — or “Never” for disabled auto-lock.

Default Auto-Lock Behavior Across Platforms

1. Desktop extensions default to 10 minutes of inactivity before locking the wallet interface and requiring password re-entry.

2. iOS and Android versions initialize with a 5-minute timeout, reflecting stricter mobile security expectations due to device portability and shared usage contexts.

3. The lock mechanism triggers only after complete UI inactivity — no transaction signing, no address copying, no tab switching within the extension popup counts as activity.

4. Background processes such as token balance polling or network status checks do not reset the timer; user interaction is mandatory for timeout reset.

5. When locked, all private key operations are suspended, and the seed phrase remains inaccessible until successful password authentication.

Impact of Auto-Lock on Transaction Signing

1. Any pending signature request in progress is immediately canceled when the auto-lock activates — no partial approvals are retained.

2. Users must reinitiate dApp connection requests after unlocking, as session keys bound to the previous unlocked state become invalid.

3. Gas estimation and transaction preview data are discarded upon lock; resubmission requires fresh network queries.

4. Hardware wallet integrations (e.g., Ledger, Trezor) remain physically connected but require re-approval through the hardware device after each unlock cycle.

5. Multisig wallets managed via MetaMask Snaps inherit the same timeout behavior unless explicitly overridden by the Snap’s own security policy.

Recovery and Session Management After Lock

1. Password entry post-lock restores full wallet access without triggering seed phrase backup prompts — no new recovery event is generated.

2. Connected dApps retain their domain permissions but lose active session context; reconnection is required for subsequent interactions.

3. Custom RPC endpoints and network configurations persist unchanged across lock/unlock cycles.

4. Imported tokens and hidden assets remain visible in the asset list but cannot be transferred or swapped until the wallet is unlocked.

5. Activity history, including past transactions and NFT ownership records, remains fully accessible in read-only mode while locked.

Frequently Asked Questions

Q: Does enabling biometric unlock override the auto-lock timeout?A: No. Biometric authentication replaces password input during unlock but does not extend or disable the auto-lock timer. The timeout interval remains fully active.

Q: Can I configure different auto-lock durations per network (Ethereum vs. Polygon)?A: Not natively. MetaMask applies a single global timeout setting across all networks and accounts within the same vault.

Q: Will changing the auto-lock time affect existing connected sites?A: No. Site permissions and connection states remain intact. Only future inactivity periods are governed by the updated value.

Q: Is the auto-lock timer affected by system sleep or browser tab suspension?A: Yes. If the browser tab is frozen or the operating system enters sleep mode, MetaMask treats it as inactivity and advances the timer accordingly.