Sign in safely on a shared computer: decide, act, and clean up fast

You need access to an account on a computer someone else controls. First decide: is the machine trustworthy enough for a full sign‑in, or should you use a limited option (private browsing, temporary password, or a remote device)? That choice determines everything that follows. Below are concise, actionable steps for both choices, the correct exit sequence, and what to do if something goes wrong.

Quick decision: full sign‑in vs limited access

Choose one path before you type your username or password.

• Full sign‑in — only on a personal or explicitly trusted machine when you need persistent access (long session, saved settings). If you use this path, avoid leaving recovery options on the device and enable strong two‑factor authentication (2FA).
• Limited access — use on public, kiosk, or unfamiliar machines. Open a private/incognito window, do not save passwords or form data, and avoid sensitive actions. Limited access reduces stored traces but cannot stop malware or hardware keyloggers.

Before you sign in: quick checks and setup

1. Scan for obvious risks. If you see unexpected popups, unknown desktop applications, unusually slow behavior, or multiple logged‑in users, treat the machine as untrusted.
2. Use a private window. Open an Incognito/Private window—this generally prevents the browser from saving cookies, history, and form data after you close it. It does not protect against keyloggers, screen capture, or other malware.
3. Disable save prompts. When the browser asks to save a password or add an autofill entry, decline. If prompted to store credentials in a local password manager, choose No or Never for that site.
4. Prefer strong second factors. Use a hardware security key or an authenticator app on your phone when available. SMS-based codes are weaker because they can be intercepted if someone controls the phone number or carrier account.
5. Plan for temporary credentials if appropriate. If you can change the password later, consider using a strong, randomly generated temporary password (from a trusted password generator) and replace it from a device you control afterward.

During the session: what to do and what to avoid

• Type credentials directly. Do not paste passwords from files on the shared machine and do not connect personal USB drives to unknown computers.
• Decline installs and prompts. Refuse any request to install extensions, certificates, or software. These often persist and can capture future logins.
• Avoid downloading or leaving files. Do not save attachments or export data to the machine. If you must, upload files to your own cloud storage from within the browser and then delete any local copies immediately.
• Use your phone for 2FA. Enter codes from your authenticator app or use a hardware key. If you must use SMS, keep the session short and monitor account alerts afterward.
• Skip high‑risk changes. Do not change recovery email/phone, authorize new devices, or make large financial moves unless the computer is fully trusted.

Sign out and clean up: the correct exit sequence

Follow these steps in order before leaving the computer.

1. Sign out from the service. Use the account’s Sign Out or Log Out button. Closing the browser alone may not end a server session or remove cookies on some sites.
2. Close the private window. Private windows usually clear session cookies and local storage when closed. If you used the regular browser, clear recent browsing data for the current session (history, cookies, cache, and form data) before leaving.
3. Confirm no passwords were saved. If prompted to save a password, explicitly choose No. If you accidentally saved credentials, remove them from the browser’s saved passwords right away.
4. Log off the computer account. If you signed into the operating system, sign out of that user account. Do not leave any user profile open.
5. Restart only if safe and permitted. Restarting can clear some temporary files and memory, but only do this if you have permission and it will not disrupt others or unsaved work.

After you leave and if something went wrong

From a device you control, perform these followups if you have any doubt the shared machine captured data or was untrusted.

• Change your password immediately. If you used a temporary password, replace it with a long, unique password and store it in your password manager.
• Revoke sessions and remove devices. Visit the account’s security or device activity page to end active sessions and remove unknown devices or app passwords.
• Reset or reconfigure 2FA if you suspect recovery options were added or new security keys registered while signed in.
• Check account activity and connected apps. Look for unfamiliar logins, email forwards, third‑party app authorizations, or changes to recovery contacts and remove anything suspicious.
• Contact service providers (bank, email host) if sensitive information or financial access was exposed and follow their recommended steps.

If you believe your account was compromised

• Change the password from a secure device immediately.
• Revoke active sessions and app passwords and remove unauthorized devices.
• Enable or reconfigure 2FA and confirm recovery contact details.
• Follow account‑specific recovery processes and notify any affected services.

Tradeoffs and common failure points

• Private window vs full sign‑in. Private browsing removes local traces when it works, but cannot stop keyloggers, screen capture, or system‑level monitoring. Avoid very sensitive accounts on public machines.
• Changing passwords later. Resetting a password after the fact mitigates exposure but can be inconvenient. Using a temporary password at sign‑in reduces immediate risk.
• 2FA choice matters. SMS is better than no second factor but weaker than an authenticator app or hardware key; prefer stronger options when possible.
• Assuming a machine is clean is risky. Even friend or workplace computers can have software or misconfiguration that captures logins—treat unfamiliar machines conservatively.

If you only need to view non‑sensitive information, use your phone or a remote desktop you control. When you must use a shared computer, pick the appropriate path above, follow the ordered steps, and run the after‑session checks—those actions cover the most likely mistakes and greatly reduce the chance of account compromise.