There are two ways this goes wrong. Either you hand over a device with your data still on it, or you hand over a device the recipient can't use because it's still locked to your account.
Both are common, and both are avoidable with the same twenty-minute process.
Step 1: Get everything off it first
Before any wiping, extract what's on there. This is where people lose things — a device gets wiped in a tidy-up mood and a folder nobody thought about goes with it.
Take a full backup of the device as it currently is, and keep it for six months even after the device is gone.
Then check specifically for:
- Files outside the obvious folders — a second drive, a custom location, an application's data folder
- Application data for anything without cloud sync — journals, fitness apps, offline notes, games with local progress
- Browser bookmarks, saved passwords, and extensions
- Software licence keys and activation details
- Email, if it was stored locally rather than on a server
- Photos, especially on phones and especially if "optimize storage" was on
- Authenticator codes — see below, this is the critical one
- Anything on a memory card
Verify by opening files, not by looking at a folder listing.
Step 2: Move your authenticator codes
This deserves its own step because it's the one that causes real trouble.
If your two-factor authentication codes live on the device you're about to wipe, and you haven't moved them, you'll lose access to the accounts that need them — potentially including the account holding your backup.
- Transfer codes to the new device using your authenticator's export or sync function
- Generate a code on the new device and use it to sign in somewhere, before wiping
- Confirm your recovery codes exist somewhere off the device
Do this before anything else irreversible.
Step 3: Deauthorize and unlink
This is what makes the device usable for the next person.
Deauthorize licensed software. Applications that limit the number of activations need releasing, or you'll be unable to install them on your new machine.
Sign out of every application and service — email, cloud storage, messaging, streaming, everything.
Sign out of your platform account. This is the essential one. Apple, Google, and Microsoft accounts create activation locks that render a device unusable for anyone else until it's released.
Remove the device from your account's device list, and from find-my-device services. Check the account website afterwards to confirm it's gone.
Unpair accessories — watches, headphones, keyboards.
Turn off any device-locking feature specific to the platform.
Failing to do this is why secondhand devices turn up locked and worthless. It's also why some recyclers refuse devices that are still linked.
Step 4: Remove the physical bits
- SIM card — and if you use eSIM, transfer or remove it via your carrier
- Memory cards — check the slot, they're easy to forget
- Any external drives that came with the device
- Stickers or labels with your name, address, or asset tags
Step 5: Wipe it properly
Phones and tablets: these are encrypted by default when a passcode is set, so a factory reset is generally sufficient. Do it from the settings, and let it complete fully.
Computers: the right approach depends on whether the drive was encrypted.
If the drive was encrypted (FileVault, BitLocker, or hardware encryption on a modern machine), erasing it discards the key and makes the remaining data cryptographically meaningless. Use the built-in erase-and-reinstall process, choosing the option that removes all content rather than a quick reset.
If it wasn't encrypted, either encrypt it first and then erase, or run a full-drive overwrite. Both operating systems' disk utilities offer a secure erase option. On a spinning drive, a single pass is sufficient; on an SSD, use the drive's own secure erase function via the manufacturer's utility, since ordinary overwriting doesn't work reliably on solid state storage.
On any machine: check the firmware or BIOS for saved passwords, and reset them.
If the drive has failed and can't be wiped, remove it and physically destroy it. Don't donate a machine with an unwiped failed drive in it.
Step 6: Leave it ready for the next person
Reinstall the operating system and set it up as far as the initial welcome screen, then stop. The recipient gets a clean first-run experience rather than a blank drive they can't do anything with.
Include the charger and cables. A donated laptop with no charger is often unusable, and proprietary chargers are expensive.
Note the specifications — model, year, memory, storage, battery condition. Charities and recipients need this to know whether it's useful.
Be honest about condition. A machine with a failing battery or a dead port is still useful to someone who knows.
Where to donate
Local charities and community organizations often accept devices directly, sometimes with a refurbishment programme.
Schools and community centres — worth asking, though many have restrictions on age and specification.
Refurbishment charities exist in most countries specifically to take, wipe, refurbish, and redistribute devices. They usually handle data destruction properly and provide documentation.
Manufacturer trade-in and recycling programmes take devices for credit or responsible recycling.
Certified e-waste recyclers, for anything genuinely dead.
Two things to check before donating anywhere:
Do they wipe devices themselves? Reputable organizations do. Don't rely on it — wipe it yourself regardless — but it's a signal of how seriously they take it.
Will they take it? Very old devices are often refused because they can't run current software. There's no point transporting something that ends up in the same recycling bin.
What not to do
Don't just delete files and hand it over. Deletion removes the pointer, not the data. Recovery software reads it back trivially.
Don't put a device in the bin. Electronics in household waste is illegal in many places and environmentally serious regardless. Batteries in particular are a fire risk in waste facilities.
Don't leave the drive in a device you're recycling unless you've wiped it. Remove and destroy it if you can't wipe it.
Don't donate to a "free collection" service you can't verify. Some collection schemes are legitimate; some are data harvesting.
Don't forget the peripherals. Old routers store wifi passwords and network configuration. Printers with internal drives store what was printed and scanned. Factory reset these before disposal too.
Devices people forget entirely
- Routers and modems — hold wifi passwords and configuration
- Printers and scanners — many have internal storage
- Smart home devices — cameras, speakers, doorbells, all linked to your accounts
- Games consoles — accounts, payment details, saved data
- Old external drives and USB sticks — each a complete snapshot of something
- E-readers — account-linked, with purchase history
- Cars — infotainment systems store paired phone contacts, call logs, and location history. Factory reset before selling.
That last one catches almost everyone.
The checklist
- Full backup taken and verified, kept for six months
- Authenticator codes moved and tested on the new device
- Files checked beyond the obvious folders
- Licensed software deauthorized
- Signed out of all services and the platform account
- Device removed from account device lists and find-my-device
- SIM and memory cards removed
- Drive wiped, with encryption confirmed or secure erase run
- Operating system reinstalled to first-run screen
- Charger and cables included
- Recipient confirmed as able to use it
Twenty minutes, and the device does someone else good instead of sitting in a drawer.
Next in this series: Mac vs Windows File Systems: What You Need to Know