Summary
18 items · 30–90 minutes
Why Auditing Matters Before You Pass a Device Along
Pulling an old phone out of a drawer and handing it to a family member, or repurposing a laptop as a shared home machine, feels straightforward. In practice, old devices carry a surprising amount of personal information — saved passwords, signed-in accounts, cached messages, and granted permissions that were set up years ago and never revisited.
This isn't just a concern when selling a device to a stranger. Even handing a device to someone you trust can expose financial accounts, private messages, or cloud storage if the setup isn't properly reviewed first. The checklist below walks through the categories most worth your attention, in a logical sequence that mirrors how devices actually hold onto your data.
If you're preparing a device to leave your hands entirely, the complementary guide on preparing a device before it leaves your hands covers the final steps — including factory resets — in more depth. This checklist focuses on the audit itself.
Accounts & Sign-Ins
Stored Credentials & Payment Data
Local Data & Storage
App Permissions & Settings
Final Verification
What to Have Ready Before You Start
A few things will make this process smoother. Have your current device nearby so you can transfer or note down any credentials before removing them from the old device. Know your primary email and cloud account passwords — you'll need them to sign out of services cleanly.
Cloud storage account access
Needed to verify that photos, files, and app data have synced before you remove them from the device.
Password manager (separate from the device)
Lets you safely store any credentials you'll be clearing from the device during the audit.
USB cable or wireless transfer method
Useful for moving files that aren't covered by cloud backups, such as locally stored documents.
Pen and notepad or a notes app on your current device
Helpful for tracking which steps you've completed and noting any accounts requiring follow-up.
Work through the categories in order. Accounts and sign-ins should come first because many other steps — like disabling Find My or removing payment methods — require being logged in to complete them properly.
Don't Reset Before You've Verified Your Backup
A factory reset is irreversible, and cloud backup completion isn't always guaranteed just because the feature is turned on. Before wiping any device, open your backup destination — whether that's iCloud, Google Drive, OneDrive, or a local drive — and confirm recent files are actually there. Spot-check photos and a document or two, not just the backup timestamp.
Once you've completed this audit, if the device is going to a new user, the setup checklist for new devices is a useful handoff resource so they can configure it properly from the start.
Permissions, Security, and Ongoing Habits
App permissions are one of the most overlooked aspects of device audits. An app you installed three years ago may still hold access to your location, microphone, or contacts — and if that app is staying on a shared device, those permissions may now extend to whoever uses it. Our guide on evaluating app permissions thoughtfully explains how to think through what's reasonable to leave granted versus what should be revoked.
For ongoing security awareness, it's also worth reviewing the everyday habits that quietly make devices less secure — many of the vulnerabilities covered there are especially relevant on devices that have had multiple users or long periods of inactivity. And once the device is back in active use, the device maintenance checklist provides a routine you can follow to keep it running well going forward.
Activation Lock Can Render a Device Unusable
On iPhones and iPads, Apple's Activation Lock ties the device to the signed-in Apple ID. If you hand off a device without first signing out and disabling Find My, the next user may be permanently locked out — even after a factory reset. Always sign out of your Apple ID through Settings before the device changes hands. Android devices have a similar mechanism called Factory Reset Protection (FRP), which requires the associated Google account credentials after a reset.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.

