Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
I have created my private key using myetherwallet using offline option.
Now Metamask allows us to import account by providing private key or Json File that has private key.
Does metamask store that private key on its server? or somewhere else? How secure it is to upload my own private key to metamask?
Metamask stores your private keys using your browser's data store. The source code of Metamask is auditable, like Parity and MyEtherWallet, by downloading from a repository (which you can then be more assured that the program you are running has indeed been looked at by other people -- unless someone is man-in-the-middle attacking you) or by unpacking the Chromium extension you downloaded.
IMHO, software such as Parity and MyEtherWallet can be used in a much more secure manner than Metamask (that's not to say Metamask is insecure nor that Parity and MyEtherWallet are secure; just discussing relative security on the one metric of private key storage). It is relatively straight forward to use Parity and MyEtherWallet to sign transactions off-line (it's less obvious how you do this in Metamask). Metamask is designed to live in-browser in its default use which reduces frictions to using the software. On the other hand, this means that every website you browse to is a potential security threat if there is a bug in Metamask or the browser.
Parity can be turned on and off: you can disable Parity for your general Internet use and re-enable it when you are about to perform a privileged action; this allows you to minimize the time during which you are vulnerable to attack AND you can be more cautious during this vulnerable period. It's much harder to be vigilant all the time. Similarly, MyEtherWallet can be isolated.
It is also easier to manage key security in Parity and MyEtherWallet insofar as you can easily see and control where the keys live on disk. This makes it easier to physically remove keys and to reduce the likelihood of key leakage (e.g., by leaking onto an unencrypted SSD drive from which permanent deletion is harder). Desktop Chrome, AFAIK, does not have a secure storage mechanism like its mobile relative or Safari; however, I believe Metamask does allow you to encrypt your keys in-browser (with the attendant security hazards that entails). Then again, I've only used Metamask briefly while playing with contracts.
Further, both MyEtherWallet and, to a lesser extent, Parity support hardware wallets which means you don't have to provide private keys directly to the software (though, strictly speaking, this isn't what you asked about). AFAIK, Metamask does not yet support this.
Metamask is a Chrome extension (or is directly integrated with Brave), and it stores its private keys in the browser -- not on a remote server. It's as secure as running a wallet that you haven't yourself audited the source code of (so, as secure as Exodus, Parity, MyEtherWallet, or Mist).
Unless you truly read the source and install it yourself, you can never be 100% sure -- you're putting blind faith in the developers -- but it certainly doesn't use a server/client architecture where your keys are stored remotely.
