Metamask is a wallet used in the browser as a plugin, with support for several ERC-20 and ETH tokens. I particularly have doubts about its security, as many sites need verification with Metamask to complete direct transactions, and I think this can cause many failures along the way. I've had bad experiences using Metamask even though I never divulged my private key to anyone or my password. But it has a practical and fast system, there is no secret for using the wallet, just install it in the browser, create a wallet and save your private key or JSON file. But I am not a big fan of Metamask, if I have the option I use another wallet to store my ERC-20 tokens or even my ETH.