Private key vs seed phrase: what does metamask actually store?

20 October 2026

MetaMask stores your encrypted seed phrase locally on your device, and from that seed phrase it derives the private keys for every account you create. The seed phrase is the master key; private keys are account-specific subkeys that MetaMask regenerates on demand.

What a seed phrase actually is

A seed phrase (also called a recovery phrase or mnemonic) is a list of 12 or 24 words from a fixed dictionary of 2048 words. MetaMask generates this phrase randomly when you create a new wallet. The phrase encodes a large number (the "seed") that serves as the root of a mathematical tree. Every private key in your MetaMask wallet - for Ethereum mainnet, Arbitrum, Polygon, or any other EVM chain - is derived deterministically from that single seed.

This means: if you lose your device but have the seed phrase, you can restore all accounts. If you lose the seed phrase but still have MetaMask running, you can still use the wallet - but you cannot recover it onto a new device.

What private keys are

A private key is a 64-character hexadecimal string (256 bits) that directly controls a single Ethereum address. MetaMask generates a unique private key for each account you add: Account 1, Account 2, and so on. These keys are derived from the seed phrase using a standard path known as BIP-44 (specifically m/44'/60'/0'/0/0 for the first account, m/44'/60'/0'/0/1 for the second, etc.).

You can export the private key for any individual account from MetaMask's account details menu. However, that exported key only controls that one address - not the entire wallet.

What metamask stores locally

MetaMask stores the following encrypted data in your browser's local storage (or on your phone's internal storage):

• Your encrypted seed phrase (vault). This is unlocked when you enter your MetaMask password.
• A list of derived private keys for accounts you have created, stored in memory while the wallet is unlocked.
• Account metadata: nicknames, token lists, transaction history, network configurations, and pending transactions.
• Your password hash (used to verify the password you enter to unlock the vault).

The seed phrase is never sent to MetaMask's servers. It is encrypted with your password and stored only locally. The private keys are derived from the seed phrase at runtime; they are not stored permanently in most cases.

Common confusion: seed phrase vs private key

Many users think the seed phrase and private key are interchangeable. They are not.

A common mistake: exporting a private key from one account and thinking that gives you access to the whole wallet. It does not. Conversely, storing only the private key for each account means you lose the ability to recover the wallet structure - including custom networks, token lists, and transaction history.

What happens when you "export private key"

When you export a private key from MetaMask, you are pulling the specific derived key for that account. This is useful for importing that single account into another wallet that accepts raw private keys (like MyEtherWallet or a hardware wallet via the "import private key" option). However, it is not a backup strategy for the entire wallet.

What happens when you "reveal seed phrase"

The seed phrase is the master backup. If you reveal it, anyone who sees it can:

1. Import the entire wallet into any compatible software (MetaMask, Trust Wallet, Rainbow, etc.)
2. Derive all private keys for all accounts
3. Access all funds across all chains

This is why the seed phrase must be stored offline - written on paper or stamped into metal - and never entered into any website, browser extension, or screenshot.

How metamask handles hardware wallets

When you connect a Ledger or Trezor to MetaMask, MetaMask does not store the seed phrase or private keys. The hardware wallet keeps the seed phrase on its secure element. MetaMask only stores the public addresses and a reference to the hardware wallet. When you sign a transaction, MetaMask sends the request to the hardware device, which signs it internally and returns the signature. (This was covered in detail in the "MetaMask not connecting to Ledger or Trezor" page.)

Security Implications

• Losing your device without a seed phrase backup means permanent loss of funds. No company, including ConsenSys (MetaMask's developer), can recover a wallet from a lost seed phrase.
• Storing the seed phrase digitally (in a text file, screenshot, cloud storage, or email) is the most common cause of theft. Malware, phishing, and sync services can access these files.
• Exporting a private key exposes only one account. If you must import an account into another wallet, consider using a temporary or hot wallet for small amounts.
• The MetaMask vault password protects the encrypted seed phrase on your device. A weak password can be brute-forced if someone gains access to the local storage file.

Practical Advice

• Back up your seed phrase on paper or metal, stored in a safe place. Test the backup by restoring it on a separate device before depositing significant funds.
• Do not share your seed phrase with anyone claiming to be MetaMask support, a validator, or a scammer. MetaMask will never ask for it.
• Export private keys only when necessary - for example, to import a single account into a hardware wallet's "private key" import feature. After that, delete the exported key.
• If you need to move a single account to another wallet, exporting the private key works. If you need to move the entire wallet, use the seed phrase.

The core takeaway: MetaMask stores the seed phrase encrypted on your device. Private keys are transient derivations from that seed. Protect the seed phrase above all else - it is the single point of failure for your entire wallet.

Back to metamask