How to Securely Wipe an Old Laptop or Phone Before Selling or Recycling It

Last updated: 8 October 2026

Short answer: back up, sign out of your accounts (so the next owner is not blocked by activation locks), then use the device's built-in full reset: on Windows, Reset this PC → Remove everything → clean the drive; on a modern Mac or iPhone, Erase All Content and Settings; on Android, a factory reset after removing your Google account. On encrypted devices, which most modern ones are, these resets make old data unreadable. Do not rely on deleting files or formatting a drive, and do not use old multi-pass "overwrite" tools on SSDs.

Why is deleting files not enough?

Deleting a file, or even formatting a drive, usually removes only the pointer to the data, not the data itself. Recovery tools can often bring it back. Studies of second-hand devices keep finding this: when the data-erasure company Blancco bought 159 used drives on eBay, 42% still held sensitive data, even though sellers said they had been wiped. And a 2024 survey for the UK Information Commissioner's Office found that 29% of people do not know how to wipe a device.

What do "clear", "purge" and "destroy" mean?

The US standard on media sanitisation, NIST SP 800-88 Revision 2, published in September 2025, defines three levels:

• Clear: logical techniques, such as overwriting or a factory reset, that protect against simple recovery tools. Enough for most personal devices being sold.
• Purge: techniques that make recovery infeasible even with laboratory equipment. Cryptographic erase, which destroys the encryption key so the encrypted data becomes unreadable, is a purge method and is much faster than overwriting.
• Destroy: physically destroying the media so it cannot be used again. NIST notes that drilling, bending or cutting may only partly damage it.

Why SSDs are different: solid-state drives spread writes across spare memory cells for wear levelling, so NIST says overwriting cannot reliably reach all previous data, and multi-pass overwriting of SSDs "should be avoided". The right method for SSDs is the drive's own secure-erase or sanitise command, or cryptographic erase, which is what modern phone and Mac resets effectively do.

Before you wipe anything

1. Back up what you want to keep. My 30-minute backup setup covers a reliable routine.
2. Check your password manager has every login, especially if you have been relying on the browser on this device. See how to move your whole family onto a password manager.
3. Deauthorise software licences tied to the device. For example, Apple Music and iTunes allow five authorised computers, and Adobe apps should be signed out via Help → Sign Out; uninstalling alone does not free the activation.
4. Sign out of messaging apps and remove the device from two-factor authentication apps if it holds codes.
5. Unpair Bluetooth devices, an Apple Watch and other accessories.
6. Remove the SIM card and any memory card, and decide what to do with an eSIM.

How to wipe a Windows laptop

1. Check encryption first: Settings → Privacy & security → Device encryption (or BitLocker on Pro editions). Windows turns on device encryption automatically on supported hardware when you sign in with a Microsoft or work account.
2. Go to Settings → System → Recovery → Reset PC.
3. Choose Remove everything, then turn on the option to clean the drive. Microsoft recommends it if you plan to donate, recycle or sell the PC. It can take several hours.
4. After the reset, remove the laptop from your Microsoft account at account.microsoft.com/devices.

Microsoft notes that this option does not meet government and industry data erasure standards. For a personal laptop with an encrypted SSD, it is normally enough. For stricter needs, use the SSD maker's tool, such as Samsung Magician's secure erase for Samsung drives or Crucial Storage Executive's sanitise function, or a certified erasure service.

Old hard drives (HDDs) can be wiped by a single overwrite pass. The many-pass methods you may read about date from decades-old drive technology; NIST notes the old US Department of Defense overwrite specification was dropped in 2006. The free tool DBAN still circulates but has not been updated since 2015 and does not support SSDs.

How to wipe a Mac

Macs with Apple silicon or a T2 chip, on macOS Monterey or later:

1. Go to System Settings → General → Transfer or Reset → Erase All Content and Settings.
2. Enter your Mac password and Apple Account password when asked. This signs you out of iCloud and turns off Activation Lock. Apple's instructions also cover removing Boot Camp first, if installed.

Because these Macs encrypt their storage, erasing removes the keys and makes the old data cryptographically inaccessible, in seconds rather than hours.

Older Intel Macs: sign out of iCloud, Messages and Music first, then erase the drive with Disk Utility in macOS Recovery and reinstall macOS, following Apple's guide for older Macs.

How to wipe an iPhone or iPad

1. Back up to iCloud or a computer.
2. Unpair any Apple Watch.
3. Go to Settings → General → Transfer or Reset iPhone → Erase All Content and Settings. This automatically turns off Find My and Activation Lock. If the phone has an eSIM, choose to erase the eSIM as well, unless you are moving it to a new phone.
4. Remove the device from your Apple Account's device list.

How to wipe an Android phone

1. Remove your Google account first: Settings → Passwords & accounts (wording varies). Otherwise Factory Reset Protection will block the next owner. On Samsung phones, also remove your Samsung account, which needs an internet connection.
2. Back up, and charge the phone to at least 70%, as Google recommends.
3. Go to Settings → System → Reset options → Erase all data (factory reset). On Samsung: Settings → General management → Reset → Factory data reset.

Phones that launched with Android 10 or later must use file-based encryption, so a factory reset leaves old data unreadable. On very old Android phones, encrypt the phone first in settings, if the option exists, then reset. The ICO's own guidance is that a factory reset adequately erases most mobile phones.

What about memory cards and USB sticks?

Treat them separately. In a study for Comparitech, University of Hertfordshire researchers found that most second-hand memory cards they bought still held recoverable data. Use the card or drive maker's erase tool, or a full (not "quick") format followed by filling the card with dummy files, or simply keep or destroy small, cheap cards.

What should a business do differently?

Personal resets are a start, but organisations have legal duties for the personal data on their devices. The UK ICO's guidance on disposal says that failing to destroy data securely may breach UK GDPR's security requirements, and recommends:

• keeping a log of devices awaiting disposal and storing them securely;
• using a disposal provider under a contract that includes a right to audit;
• checking that certificates of destruction match the devices you sent.

Encrypting every company laptop from day one makes retirement much simpler, because a reset then works as a cryptographic erase. The same thinking appears in what cyber insurers ask small businesses for.

Recycle, do not bin

Electronics contain recoverable metals: the US EPA notes that recycling one million phones recovers about 35,000 pounds of copper, 772 pounds of silver and 75 pounds of gold. In the EU and UK, the WEEE rules require separate collection, and many retailers take old devices back. Before you give a still-working device away, consider whether it could serve longer; my guide to speeding up an old Windows PC may keep it useful for someone else.

FAQ

Is a factory reset enough before selling a phone?
For modern iPhones and Android phones, yes, provided you remove your accounts first. Their storage is encrypted, so the reset makes old data unreadable.

Should I physically destroy my old hard drive?
Only if it holds highly sensitive data or no longer works. A working drive can be wiped and reused; for a failed drive, a certified destruction service is the safe option.

Does reinstalling Windows wipe the drive?
Not necessarily. Use Reset PC → Remove everything with the drive-cleaning option, or a secure-erase tool, rather than a quick reinstall.

What is Activation Lock and why does it matter?
It ties an Apple device to your Apple Account so a thief cannot use it. If you do not sign out before selling, the buyer cannot set the device up. Android's Factory Reset Protection works the same way with your Google account.