Safe sign-in habits for shared or mobile PCs

If you sign in on a coworking desk, a family laptop, or any other shared or mobile PC, treat the session as temporary from the start. Before you type a password, check the lock screen, the user profile, and the browser state to make sure no one else is already signed in. When you finish, sign out of every account, close the browser and apps, and clear anything that could keep the session alive.

Prerequisites

• A device you are allowed to use.
• Your own account credentials.
• Access to the accounts you may need to review later from a trusted device, such as sessions, trusted devices, or recent activity pages.
• If you plan to use two-factor authentication, the phone or authenticator you control.

What to do before you type a password on a shared or mobile PC

1. Wake the device and check the lock screen before you touch anything.

Look for the signed-in user name, profile picture, or any sign that another person left the session open. If the machine wakes to another person’s account, a work profile you do not recognize, or a browser already open to mail, cloud storage, chat, or banking, stop there and do not continue until it is clearly signed out.

2. Check the browser state as well as the screen.

A browser can carry an old session even when the desktop looks clean. Watch for these signs:

• Pages already open to inboxes, documents, calendars, or admin consoles.
• Saved tabs visible in the browser.
• Autofill suggestions with another person’s name, email, or address.
• A browser profile icon that does not belong to you.

3. If the PC is shared with people you know, confirm the last user signed out.

Ask who last used it and whether they signed out of everything. If you cannot tell, assume the safest answer is no. A few seconds of checking is better than inheriting someone else’s account or leaving yours behind.

4. Start from your own profile or a fresh browser session.

Use your own profile rather than typing a password into a screen that still belongs to someone else. If the browser opens with a previous profile, switch to your own or open a new window before you sign in.

Use the lock screen like a stop sign

The lock screen tells you whether the last session was left open, and it should make you pause before you enter any password. Wake the device, look at the account shown, and wait for the correct profile or login screen before you do anything else. If you see another person’s unlocked desktop, do not start using it and do not click around to check whether it is safe.

If the machine is already unlocked, ask the current user to finish their session first. On a shared PC, unlocking someone else’s session or switching into it can expose their data and can also put your own activity inside the wrong account. On a mobile PC that moves between people or locations, the rule is the same: one visible account means one active owner. Until that session is closed, you should not sign in.

Once you reach the sign-in screen, confirm that the account name or profile picture is yours before entering credentials.

Sign in only after you know whose browser and apps you’re in

A clean browser session matters as much as the operating system account. Start from a new browser window or a fresh app sign-in, not from whatever tab or app was left open. That keeps you from landing inside someone else’s synced tabs, saved logins, or open documents.

Private browsing can reduce local traces, but it does not make a shared device safe by itself. It still leaves you exposed to an existing browser profile, extensions, or signed-in cloud services.

Before you enter credentials, check for:

• Saved passwords already filled in.
• Autofill names, addresses, or payment data that are not yours.
• Tabs already signed into mail, storage, chat, or company dashboards.
• A browser profile that belongs to someone else.

If you need to use a work app, open it from a clean start rather than from a tab somebody else left on the screen. That simple habit keeps you from acting inside the wrong account by accident.

While you work, avoid leaving a trail behind

On a shared or mobile PC, the safest move is to avoid creating anything the next person can reuse. Do not save passwords in the browser, and do not agree to prompts that say things like “remember this device,” “keep me signed in,” or “stay signed in.” Those options are handy on your own machine, but they are a problem on someone else’s.

Keep sensitive work in only the tabs and apps you need right now. If you step away for coffee, close pages with mail, files, tickets, payroll, or other private data before leaving the keyboard. If you must leave something open briefly, lock the screen, not just the browser tab.

Be careful with notifications too. Mail or chat pop-ups can expose message previews on the lock screen, so reduce them if the device is going to sit in a public or semi-public space. And if a site offers to trust the device for future logins, decline unless you fully control the PC and know it will not be used by anyone else.

Finish by signing out, not just closing the lid

When you are done, leave in the same order every time: sign out of your accounts, close the browser, close any desktop apps, then lock the PC. Closing the lid or stepping away is not the same as ending the session. Many services stay active until you explicitly sign out, and some browsers keep cookies, sessions, and history available after you leave.

Use the logout link inside each important site, especially email, storage, HR, finance, and company tools. Then close the browser window, not just the tab. If you used a desktop app with its own sign-in, sign out there too.

After that, check that you are back at the login screen or at least a locked screen. If you are on a family machine or office-shared PC, this final check matters because the next person may sit down immediately after you. You want them to start from a neutral state, not from your open session.

When you’re on a borrowed laptop or kiosk, do a little extra

Borrowed laptops and kiosks deserve stricter habits because you usually know less about how they are set up. Use them only for the work you truly need to finish. Avoid downloading files, installing extensions, or letting the browser create a permanent profile if you can help it.

Private browsing is a good starting point on these devices because it limits local history and some saved data, but it does not hide your activity from the site itself or from the network owner. That means you still need to sign out of every account before you leave.

After you finish, check that nothing synced into the browser or app under your name. If the site offers account history, recent devices, or active sessions, review them later from a trusted device and remove anything you do not recognize. On a kiosk or borrowed laptop, also avoid leaving files in downloads, desktop folders, or cloud app caches where the next user might find them.

If you used your password manager or two-factor code, clean up the session

Password managers and two-factor prompts deserve extra care on shared devices because they can turn a short session into a longer one. If you opened your password manager vault, sign out of it before you leave. Do not leave the vault unlocked in a browser tab or desktop app, even if the computer itself is locked.

If you approved a two-factor prompt on a device that asks to remember it, think carefully before accepting. On a shared PC, “trust this device” can quietly extend access beyond the moment you need it. If you already approved a push prompt or entered a one-time code, sign out of the site when you finish and review the trusted devices list later from a machine you control.

For browser-based password managers, close the browser completely after sign-out. For app-based managers, exit the app, not just the vault screen. If the password manager stayed logged in because of a saved session, clear that session as soon as you can on your own device.

What to do if you forgot to sign out or think someone else used the device after you

Act quickly, but keep it simple. First, open the account from a trusted device and look for a sessions, devices, or recent activity page. Sign out of all other sessions if the service offers that option. That often removes the shared PC from the list right away.

Next, change the password if you think someone else may have reached the account. If the service supports it, also revoke trusted devices, app passwords, or active sessions tied to that machine. Then check for forwarded mail rules, shared links, and recent file access if the account is used for email or cloud storage.

If the shared PC may have been used after you left, review your inbox, sent items, files, and security alerts for anything unfamiliar. If you see signs of misuse, change the password again from a trusted device and remove any recovery methods you do not recognize. The goal is to cut off the session before it turns into broader access.

A simple end-of-use checklist you can reuse every time

Use this same routine on coworking computers, library PCs, hotel business center machines, and family laptops:

• Confirm the lock screen or login screen shows a fresh session.
• Use only your own profile or a clearly new browser session.
• Decline “remember me,” “trust this device,” and saved-password prompts.
• Keep only the tabs and apps you need open.
• Lock the screen if you step away, even for a minute.
• Sign out of every account before you leave.
• Close the browser and any desktop apps.
• Check that the device is back at the login or lock screen.

If you can do those steps without thinking, you are much less likely to leave a work account open for the next person.

Common questions about shared and mobile PC sign-ins

Private browsing helps, but it is not enough by itself. It mainly limits local history and some cookies in that window. It does not protect you from another person’s open account on the device, and it does not replace signing out.

Locking is not the same as signing out. Locking keeps the current session alive for the same user, which is fine if you are only stepping away for a moment. Signing out ends the session so the next person cannot keep using your account.

It is usually safest to let a browser remember you only on a PC you control and keep to yourself. On shared or mobile machines, saved logins can expose your accounts to the next person who uses the device. If you ever do allow a browser to remember you, make sure you can remove that saved session later from a trusted device.

Completion

You know the routine worked if you end at a locked screen or login screen, your accounts are signed out, and the browser no longer shows your session. On a later check from a trusted device, you should see only the sessions and trusted devices you expect, with nothing unfamiliar tied to the shared or mobile PC.

Conclusion

The safest habit is to treat every shared or mobile PC as temporary from start to finish. Check the screen before you sign in, keep the session clean while you work, and end every account yourself instead of assuming the device will do it for you. If you use the same routine every time, it becomes much easier to protect your email, cloud files, and work tools without slowing yourself down.

Frequently Asked Questions

Is private browsing enough on a shared PC?

No. Private browsing helps reduce local traces, but it does not protect you from an already signed-in browser profile, active site session, or another person’s account on the machine. You still need to sign out and close the browser when you finish.

Is locking the screen the same as signing out?

No. Locking keeps the current session open and just hides it behind the lock screen. Signing out ends the session so the next person cannot keep using your account.

Can I let the browser remember me on a borrowed laptop if I am in a hurry?

It is better not to. Remembered logins can persist after you leave, and you may not control when the next person uses the device. If you must use the laptop again later, sign in fresh rather than depending on a saved session.

What should I do if I approved a two-factor prompt on a shared machine?

Sign out of the account right away, then review trusted devices and active sessions from a device you control. If anything looks off, revoke the session and change the password.