PrivacyPick

BitBox02 vs MetaMask Comparison

Feature
Overview
Rating
7.6
6.1
TypeHardware walletSoftware wallet
PriceBitBox02 Multi edition: $139 one-time; BitBox02 Bitcoin-only edition: $139 one-timeTransaction Shield monthly: $9.99 per month; Transaction Shield yearly: $99 per year
Free to useNoYes
Established20152016
Platforms
WindowsmacOSLinuxAndroid
Browser extensionAndroidiOS
Networks
BitcoinLitecoinEthereumCardano (through a third party)Polygon (through a third party)BNB Chain (through a third party)Arbitrum (through a third party)Optimism (through a third party)
EthereumBitcoinSolanaTronBNB ChainBaseArbitrumOptimismPolygonAvalanche
Rating by category
Key Custody & Recovery
9.0
6.5
Network & Metadata Privacy
6.5
4.5
Security & Transparency
7.0
5.5
Usability & Chain Support
7.5
8.0
Price & Value
7.0
7.0
Keys & recovery
Who holds the keysYou hold the keys
Show details

A new wallet gets 24 BIP39 recovery words; the device can also restore 12-word phrases. The default backup is a file with the wallet secret on the included microSD card, which is not encrypted; the 24 words can be shown on the device screen at any time after you re-enter the device password.

You hold the keys
Show details

New wallets get a 12-word phrase; 12- and 24-word phrases from other wallets can be imported. One phrase gives each account an Ethereum-style address, a Solana address and a Bitcoin address; Bitcoin uses only the Native SegWit address type.

Seed formatStandard phrase (BIP39)Standard phrase (BIP39)
Seed portabilityRestores in other walletsRestores in other wallets
PassphraseYesNo
RecoverySeed phraseSeed phrase
MultisigBuilt inNot supported
Network & metadata
Default serverThe vendor's serversThe vendor's servers
Own nodeLimitedLimited
TorThrough a proxy you set upNot supported
Coin controlFullNone
ID for in-app buyingYesYes
Device purchaseTied to your identity
Show details

The BitBox shop ships only to a name and postal address and asks for an email address. You can pay with Bitcoin or Lightning through BitBox's own BTCPay Server instead of a card. BitBox says order data is anonymised after 30 days, but invoices are kept for ten years under Swiss law.

Not applicable
Device
Secure elementIn some modelsNot applicable
Air-gappedNoNot applicable
Firmware codeFully open source
Show details

BitBox says each device receives an attestation key at the factory, which the BitBoxApp checks every time you connect, and that the chips are covered in epoxy and the case halves are glued so that opening them breaks plastic pins. The device ships in a vacuum-sealed bag with a patterned seal. BitBox itself says these checks cannot rule out every physical modification of a genuine device.

Not applicable
Trust & transparency
App codeFully open sourcePartly open source
Server codePartly open sourceClosed source
Reproducible buildsYesNo
Security auditNone on recordLeast Authority (2022, paid for by the company)
Show details

Seed phrase handling in the browser extension and its key libraries, ordered by MetaMask after users reported that one phrase restored different accounts. No flaw in the phrase standard was found; three of eleven suggestions were left unresolved. The phone app was last audited in 2019.

Bug bountyYesNo
JurisdictionSwitzerland
Show details

Shift Crypto AG is registered in the Canton of Zurich, with its address in Adliswil. Its privacy policy follows the Swiss data protection act and the GDPR, and says personal data is stored in the EU.

United States (Texas)
Show details

The privacy notice and terms of use name Consensys Software Inc., doing business as MetaMask, at 5049 Edwards Ranch Rd, Fort Worth, Texas. Data is stored in the United States. US users fall under Texas law with arbitration; UK users under English law with arbitration in London; others under Irish law with arbitration in Dublin unless they choose otherwise. The App Store lists ConsenSys AG as the seller.

OwnerShift Crypto AG
Show details

A privately held Swiss company that sells under the BitBox brand. Its founders started the BitBox line in 2015; the BitBox02 came out in 2019.

Consensys Software Inc.
Show details

MetaMask has been built since 2016 by Consensys Software Inc., which also runs Infura, the default blockchain server. On 9 September 2026 the company announced it will rename itself MetaMask under Joe Lubin as chairman and CEO, and move its protocols and institutional business into a new company that keeps the Consensys name; the separation is expected by the end of 2026.

TelemetryNo telemetryOn unless you opt out
Past incidentYesYes
ReviewRead more →Read more →

Where each one is ahead

BitBox02

  • Key Custody & Recovery: rated 9.0 vs 6.5
  • Network & Metadata Privacy: rated 6.5 vs 4.5
  • Passphrase: Yes
  • Multisig: Built in
  • Coin control: Full

MetaMask

  • Free to use: Yes
  • Security audit: Least Authority (2022, paid for by the company)

Read also

Missing an app?

Tell us what you could not find. Every suggestion goes onto our list of products to review.

This opens a message in your email app, addressed to hello@privacypick.com. Nothing is sent until you press send there.