How to Securely Erase Your Old Phone Before You Sell, Trade In, or Recycle It
Before a phone changes hands — sold on a marketplace, handed over for a trade-in credit, or dropped in a recycling bin — most owners tap "Erase All Content and Settings" or its Android equivalent and assume the job is done. For the vast majority of everyday risks that is a reasonable assumption, but it is worth understanding what a factory reset actually does at a technical level, because the honest answer is more nuanced than "your data is gone."
What a factory reset actually erases
On a modern phone, nearly every device sold in the last several years encrypts its storage by default. That changes what a factory reset technically does: rather than overwriting every bit of stored data — which would take a long time and drain a battery doing it — a reset on an encrypted device typically deletes or discards the encryption key itself. Without that key, the encrypted data left on the storage chip is unreadable, which functions as what security standards refer to as a cryptographic erase. Under the widely referenced NIST Special Publication 800-88 media-sanitization framework, that kind of key-deletion reset on an encrypted device qualifies as a valid "Purge"-level sanitization method — a meaningfully strong result, not a token gesture. The important caveat is that this protection depends entirely on the phone having encryption enabled in the first place, which has been the default on iOS for well over a decade and on Android since Android 10, but it is worth confirming rather than assuming on an older or unusual device.
Where a plain factory reset falls short
A standard consumer-level factory reset, run through the phone's own settings menu, does not meet the higher "Clear" or "Purge" bar that NIST 800-88 defines for organizations handling regulated or highly sensitive data — a hospital or a bank disposing of company-owned devices, for example, generally needs certified erasure software that generates a per-device certificate of destruction, not just a settings-menu reset. For an individual selling a personal phone, that distinction matters less in practice, since the realistic threat model is a stranger with off-the-shelf tools rather than a forensics lab with unlimited resources. But it is worth knowing that a factory reset alone is a security control with real, documented limits, not an absolute guarantee, and treating it as one step in a checklist rather than the only step is the more defensible approach.
The steps that matter more than the reset itself
Before wiping anything, back up what you want to keep — photos, messages, app data — to a cloud account or a computer, since a completed reset is not reversible through any normal means. Then, critically, sign out of your account before or immediately after backing up: on an iPhone, that means removing the device from your Apple ID in Settings, and on Android, removing your Google account. This step matters more than most people realize because of Factory Reset Protection, an anti-theft feature Android has included since Android 5.1 Lollipop that locks a reset device to the previous owner's Google account until that account's credentials are re-entered — a safeguard against theft, but one that will lock out a legitimate buyer, or you yourself, if the account was not properly removed beforehand. Apple's Activation Lock functions the same way tied to Find My. Remove any SIM card and, if the phone supports expandable storage, any external memory card, since a factory reset generally does not touch removable storage at all. Finally, unpair the phone from any linked accessories — smartwatches, wireless earbuds, a car's Bluetooth system — since a factory reset on the phone does not automatically clear pairing records stored on those other devices.
Selling versus trading in versus recycling
The destination changes which of these steps carries the most weight. If you are selling directly to a stranger through a marketplace, verifying Activation Lock or Factory Reset Protection is fully cleared is the single most important step, since a phone still locked to a previous account is effectively worthless to a buyer and a common source of marketplace disputes. If you are trading a phone in through a carrier or manufacturer program, most of these programs will not issue trade-in credit at all until their own diagnostic check confirms the device has been properly wiped and unlinked, so skipping this step simply delays your payout rather than avoiding it. Our related guide on which phone brands hold their resale value best is a useful companion read if you are weighing trade-in timing, since resale value erodes with each new flagship launch and a properly wiped, quickly listed phone consistently sells for more than one sitting unlisted while a new model's release chips away at its value. If the phone's final stop is recycling rather than resale, the stakes for perfect data sanitization are lower in one sense — no buyer will ever access the device — but responsible e-waste recyclers still recommend a full wipe before drop-off, since recycled devices sometimes get refurbished and resold rather than broken down for materials.
Buying a used phone: the same checklist in reverse
If you are on the buying side of a secondhand transaction rather than the selling side, the same concepts apply from the opposite direction — verifying that a device is free of Activation Lock or FRP before you hand over payment is the difference between a working phone and an expensive paperweight. Our detailed walkthrough of buying a used phone safely, including IMEI checks and blacklist status covers exactly this from a buyer's perspective, and pairs directly with the seller-side steps here — a properly wiped, unlocked, IMEI-clean phone is the goal both sides of a used-phone transaction should be verifying independently rather than taking the other party's word for it.
The bottom line
For nearly everyone selling, trading in, or recycling a personal phone, a proper factory reset on an encrypted device — combined with signing out of your account and confirming Activation Lock or Factory Reset Protection is cleared — is genuinely sufficient. The encryption-based cryptographic erase that modern phones perform during a reset is a stronger sanitization method than it sounds like from the phone's simple settings-menu wording, and remains valid even under formal frameworks like NIST 800-88 when the device was encrypted to begin with. The far more common failure mode is not an inadequate reset — it is skipping the account sign-out and lock-removal steps that leave a perfectly wiped phone still tethered to its previous owner, which is what actually causes the transaction headaches and stalled trade-in credits people run into. Getting the account removal and lock status right matters more than worrying about forensic-grade data recovery that, for a typical consumer resale, is simply not the realistic threat.