Verify a Firefox Wallet Extension Before Installing

Installing a wallet extension in Firefox puts your funds and private keys one click away from a malicious script. This guide shows you how to verify a Firefox wallet extension before you install it, so you can avoid fake add-ons that steal your crypto. You’ll check the developer, the source code, the review process, and the permissions the extension requests.

What You’ll Need

A Firefox browser (current version, updated).
The exact name of the wallet extension you intend to install (e.g., MetaMask, Phantom, Rabby).
Access to the official website of the wallet provider.
Optionally, a code editor or a plain text viewer to inspect source code.

Step-by-Step

Identify the official source. Go to the wallet provider’s official website (type the URL directly, don’t click a search ad). Look for a “Download” or “Browser Extension” link. It should point to addons.mozilla.org (AMO) or to a GitHub repository you can verify. If the site redirects you to a random URL, stop.
Search AMO directly. In Firefox, go to addons.mozilla.org and search for the wallet name. The official extension will usually have a verified checkmark (a blue badge) next to the developer name. Click the listing to open its detail page.
Check the developer and email. On the AMO detail page, scroll to the “Developer” section. The name should match the official company (e.g., “MetaMask” not “MetaMask Support”). Click the developer’s name to see their profile and other extensions. A wallet provider with only one extension is normal; a developer with hundreds of random extensions is a red flag.
Read the reviews and ratings. Look at the star rating and read a few recent 1-star and 5-star reviews. Fake extensions often have many 5-star reviews with generic text. Real user complaints about missing funds or phishing are a strong warning.
Verify the version and update history. On the AMO page, scroll to “Version History.” A legitimate wallet updates frequently (every few weeks). If the last update was years ago, it’s likely abandoned or a copy. Also, the version number should match the one on the official website.
Inspect the source code (if open source). Most reputable wallets are open source. Find the GitHub repository link from the official website (not from the AMO page, which could be spoofed). Compare the repository’s latest release tag with the AMO version. If you know how, download the source and look for suspicious functions like `sendTo`, `exfiltrate`, or hardcoded URLs that aren’t related to the wallet’s API.
Review the permissions. On the AMO page, click “Permissions” (or “See all permissions”). A wallet extension typically asks for: storage, access to browser tabs (to read the current page URL), and possibly clipboard read/write. It should NOT ask for: access to all website data (though some do for dApp interaction), browsing history, or downloads. If it asks for “Access to browser tabs” and “Read browsing history,” that’s excessive.
Check the extension ID. In the AMO URL, there’s a long ID (e.g., `webextension@metamask.io`). Copy that ID and search for it. The official wallet’s documentation should list this ID. If the ID doesn’t match, it’s not the official one.
Look for a “Recommended” badge. Firefox has a “Recommended” program for extensions that meet security and privacy standards. While not all good wallets are recommended (some are too new), a wallet with this badge has passed additional review. If it’s not recommended, that’s not an automatic fail, but it means you should do more checks.
Install and test with a small amount. After all checks pass, install the extension. Create a new wallet (or import a test seed phrase) and send a tiny amount (like $1) to it. Then try sending it back out. If anything behaves oddly, uninstall immediately.

Common Mistakes

Clicking the first search result. Search engines often show ads that look like the official site. Always type the URL manually.
Trusting the AMO listing alone. A listing on AMO doesn’t guarantee it’s official. Anyone can submit an extension with a similar name. Always cross-reference with the official website.
Skipping the permissions check. Many users click “Add to Firefox” without reading permissions. A wallet that asks for “Read and change all data on all websites” might be legitimate (for dApps), but it’s also a huge security risk if the extension is malicious.
Ignoring the developer email. A free email (like @gmail.com) is a red flag for a wallet. Official companies use their own domain.
Assuming open source is safe. Open source code can still be malicious if you don’t review it. At minimum, check the GitHub stars and recent commits.

Tips

Use a dedicated browser profile. Create a separate Firefox profile for crypto transactions. This isolates your wallet from your everyday browsing.
Bookmark the official AMO page. Once you find the correct listing, bookmark it. Use that bookmark every time you need to reinstall or update.
Check the wallet’s official blog. Reputable wallets often announce extension updates on their blog. If a new version appears on AMO but the blog hasn’t mentioned it, wait.
Look for a “Source Code” link on AMO. Some developers link directly to the source code from the AMO page. If that link is missing, that’s a minor red flag.
Use a hardware wallet. For large amounts, consider a hardware wallet that interacts with the extension. Even if the extension is compromised, the hardware wallet may require physical confirmation for transactions.

Troubleshooting

You can’t find the extension on AMO. The wallet might not have a Firefox version. Check the official website. If it does, but it’s not on AMO, do not install from a third-party site. Wait for official support.
The AMO page says “Not Recommended” but the wallet is popular. This can happen for new extensions or those with a history of minor issues. Do extra checks: read the reviews, check the source, and test with a small amount first.
The extension asks for more permissions than expected. Uninstall immediately and contact the official wallet support. Do not ignore the permissions.
The extension won’t install. Firefox might block it due to a security policy. If the extension is legitimate, the provider will usually have instructions on their site. If not, don’t force it.
You already installed a suspicious extension. Remove it from about:addons, then run a malware scan. Change your wallet passwords and move funds to a new wallet created on a clean device.
The source code on GitHub doesn’t match the AMO version. This could mean the AMO version is modified. Do not install it. Report the AMO listing to Mozilla.

Frequently Asked Questions

Can I trust any extension with a “Recommended” badge?

Not blindly, but it’s a strong positive signal. Mozilla’s Recommended program does a manual review, but it’s not a guarantee against future malicious updates. Always do your own checks.

What if the wallet is not open source?

That’s a major red flag. Closed-source wallets for browsers are rare. If a wallet claims to be secure but hides its code, you cannot verify what it does with your keys.

How do I check the extension ID?

On the AMO page, the URL contains the ID. For example, in `https://addons.mozilla.org/en-US/firefox/addon/webextension@metamask.io/`, the ID is `webextension@metamask.io`. Compare it with the official documentation.

Is it safe to install a wallet from a direct download link on the official site?

If the official site links to AMO, use that. If it links to a direct .xpi file, you can install it, but verify the hash if provided. Direct downloads are riskier because they bypass AMO’s review.

Why does the wallet need access to all websites?

Most wallets need to read the current tab’s URL to know which dApp you’re using. Some also inject scripts into pages for Web3 integration. That’s normal, but it’s also a huge power. Ensure the extension is reputable.

What should I do if I see a permission for “Downloads”?

Uninstall. A wallet has no legitimate reason to download files. This is a common sign of a malicious extension.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →