You can connect MT5 to a third-party app safely as long as the app only uses your investor password. That credential is read-only: the app can see your trades and balance, but the MetaTrader server rejects any attempt to place, close, or modify a trade or move money.
Everything else on this page is about the second layer: how the app handles that password, what it stores, and how quickly you can cut it off.
Hesitating at the connect screen is the right instinct. You are being asked for access to an account with real money in it. The goal is not to talk you out of that caution, but to give you a fast way to tell a well-built tool from a careless one.
What an MT5 app actually needs from you
A read-only MT5 connection needs exactly three pieces of information:
- Your server name, exactly as MetaTrader shows it (for example a broker name followed by Live or Demo and a number).
- Your account number, the login you see in the Navigator panel.
- Your investor password. If you do not have one yet, the step-by-step guide shows how to create it on desktop or mobile.
If an app asks for more than this to read your trades, ask why. There is no technical reason a journal or discipline tool needs your broker portal login, your identity documents, or your card details.
The seven-point checklist
Run every app through these checks before you connect. A good tool passes all seven.
| Check | Why it matters |
|---|---|
| It asks for the investor password by name | Read-only is enforced by MetaTrader itself, not by a promise from the app. |
| It never asks for the master password | A read-only tool has no reason to request trading access. |
| It explains where the password goes | Look for a named connectivity provider and a clear statement of what is stored. |
| It stores as little as possible | Server name and account number are enough. Your password should not sit in the app vendor database. |
| It asks for nothing beyond server, login, and password | Broker portal logins, ID documents, or card details are not needed to read trades. |
| You can disconnect inside the app | Leaving should take one tap, not an email to support. |
| You can revoke it without the app | Changing the investor password in MetaTrader cuts every old connection instantly. |
Why the investor password is the line that matters
The other six checks reduce risk. The first one removes the biggest risk entirely. With the investor password, the worst realistic outcome of a breach is that someone can see your trade history. With the master password, the worst outcome is that someone can trade your account. That difference is enforced by the MetaTrader protocol, so it holds even if the app itself is badly built. The full breakdown is in is it safe to share your investor password.
Where the password should go
Most apps do not connect to MetaTrader directly. They use a specialised connectivity provider, such as MetaAPI, that runs MT5 terminals in the cloud. The safer pattern is that the app passes your password to that provider and keeps only your server name and account number itself. A good app tells you this in plain words on a security page, before you connect.
Red flags: when to close the app
- The password field just says "MT5 password" and the app will not say which one.
- It asks for the master password while claiming to be read-only.
- It promises returns, signals, or account management alongside the connection.
- There is no security page, no named provider, and no way to contact a real person.
- Disconnecting requires emailing support.
Any one of these is enough reason to stop. Several together usually means the app is not what it claims to be.
Your two exits
A safe connection is one you can leave at any time. You should always have two ways out:
- Disconnect inside the app. This stops the app from reading your account.
- Change your investor password in MetaTrader. This invalidates every connection that uses the old password, instantly, without touching your own trading login. It works even if the app is offline or the company has disappeared.
The second exit is the one to remember. It puts the final decision in your hands, not the app developer's.
Worked example: how EmotionLock connects
EmotionLock is a discipline app. It needs to know one thing about your account: how many trades you have closed today. When you reach the daily limit you set, it blocks the trading apps you selected on your iPhone through Screen Time until midnight.
Here is how it scores on the checklist:
- It asks for the investor password by name and never for the master password.
- The password is forwarded to MetaAPI, which is SOC2 Type 2 certified. EmotionLock stores your server name and account number, not the password.
- It asks for nothing beyond server, account number, and investor password.
- You can disconnect in the app, and changing your investor password in MetaTrader cuts the connection regardless.
Because the connection is read-only, EmotionLock cannot trade your account under any circumstance. It can only count. The full flow is on the security page.
Sources
- MetaQuotes. MetaTrader 5 Help: Connect to an Account (master and investor passwords).
- Apple Support. Set Screen Time schedules and time allowances on iPhone.
Frequently asked questions
Is it safe to connect MT5 to a third-party app?
It can be, if the app only asks for your investor password. That credential is read-only at the MetaTrader protocol level, so the app can see your trades and balance but cannot place, close, or modify a trade and cannot withdraw funds. The risk rises sharply if an app asks for the master password.
Which password should I give an MT5 app?
The investor password, also called the read-only password. Only give the master password to a tool that genuinely has to execute trades for you, such as a trade copier, and only if you accept that it can trade your account.
What details does an app need to connect to MT5?
Three things: your MT5 server name exactly as it appears in MetaTrader, your account number (login), and the investor password. A read-only app should not need anything else, such as your email login at the broker or identity documents.
How do I disconnect an app from my MT5 account?
Use the disconnect option inside the app first. Then, if you want to be certain, change your investor password in MetaTrader 5. Changing it immediately invalidates every connection that uses the old password, even if the app or its provider is unreachable.
Can an MT5 app see my trades on a prop firm account?
Yes, if the prop firm gives you an investor password for that account. Most MT5-based prop firms do. The connection works the same way as with a retail broker account and stays read-only.
The summary
Connecting MT5 to an app is safe when the app uses only the investor password, explains where that password goes, stores as little as possible, and lets you leave in one tap. Keep the master password to yourself, and remember that changing the investor password in MetaTrader is your universal off switch. If you want a tool that uses that read-only access to stop you at your daily trade limit, EmotionLock is built for exactly that.