Checking email on a public computer means signing in on a machine shared by strangers in a library, hotel, internet cafe or school. For sensitive mail, the answer is no: keyloggers record typed passwords, saved sessions pass the mailbox to the next user, and onlookers can read the screen.
Shared computers and sensitive accounts
Many people use the same public machine in turn, and the account holder cannot inspect its software, hardware or cleanup between sessions. The National Cybersecurity Alliance guidance on public computers describes computers in libraries, schools, hotels and business centres as shared devices, to be treated as less secure than a personal laptop or phone, and places banking, medical records, shopping with saved payment details and confidential work systems outside the tasks suited to such a machine.
The United Nations guidance for shared computers sets the same boundary for a work mailbox, a bank account and other services holding sensitive information. A mailbox also functions as a recovery point for other services, so access to it can lead to further accounts. Reading without signing in sits at a different level of risk.
Saved sessions and the next user
A session left signed in gives the next person entry with no password at all. Websites hold that state in browser cookies and session data. Closing a window alone does not end that state on many sites, because sign-out requires an active step.
The tipsheet on public computers and wireless networks warns that ticking "remember me" on a shared computer makes later access easy for the next user. In February 2025, Microsoft changed browser sign-in so that a user remains signed in automatically unless sign-out happens or a private window is used. A report on the Microsoft sign-in change and its effect on shared computers and an Office Watch report on the Microsoft login change both describe remote sign-out, which can take up to 24 hours to take effect, so it is recovery, not a replacement for signing out at the machine.
Google Account help on devices with account access describes a list of devices and sessions with account access, with sign-out available for a device that does not belong to the account holder.
Keystroke recording
Keystroke recording captures input at the keyboard. The Data Protection Education guide to password attacks defines a keylogger as malicious software, or a small hardware device plugged into a computer, recording every key pressed, including passwords, and sending the record to an attacker, and advises checking a shared computer for an unfamiliar device between keyboard and computer.
The two forms differ under inspection. A keylogger definition and protection guide notes that a hardware device needs no software installation, making detection through digital tools difficult. A guide to keystroke logger detection and protection draws the same line between hardware inserted between keyboard and computer and software installed on the machine, and a software scan cannot find a device outside the software being scanned. No figure for how often such recording appears on public computers is claimed here, because the sources read give no such figure.
Password length does not alter this mechanism, since a long password is still entered on the machine. An on-screen keyboard is sometimes reported as a mitigation against a hardware keyboard device, but that report does not cover software recording and is not a guarantee.
Observation in public places
A nearby person presents a risk even on a clean machine. Shoulder surfing is observation of a screen or keyboard from close by during login or reading. The National Cybersecurity Alliance guidance notes that a person nearby may read sensitive material on a screen, watch passwords being entered, or view personal messages, and suggests lower screen brightness, a privacy screen, or sitting with a wall behind the user; the United Nations guidance warns of deliberate observation of keystrokes during login. No browser setting removes physical exposure.
Private browsing
Private browsing changes what the browser retains after a session, and nothing else. The mode is Incognito in Chrome, InPrivate in Edge, and Private Browsing in Firefox and Safari. A Chrome Incognito explainer states that Incognito stops Chrome saving history, cookies and form entries, and that the session ends only when every Incognito window is closed.
Private browsing does not hide activity from the internet service provider, the network operator, or the sites visited. It does nothing about software already present on the machine, since recording precedes the browser. The network risk on a shared connection, as distinct from the machine risk, is covered in Is Public Wi-Fi Safe for Checking Email?. A private window therefore reduces the local trace, while the machine stays unverified, and whether a managed machine resets itself between users is not standardised, so no such reset can be assumed.
Passwords and second factors
Strong, unique passwords and a second factor reduce the damage from a captured password. The Federal Trade Commission guidance on protecting accounts online advises long passwords, no reuse across accounts, and multi-factor authentication where available. A second factor matters because a stolen password alone is then not enough.
Password-manager guidance pairs the same measures: a Specops blog on National Cyber Security Centre guidance for password managers reports that the guidance recommends multi-factor authentication on the password-manager account and a strong master password, preferably a passphrase of three random words. A guide to password and multi-factor authentication practice reports the same three-random-words recommendation, alongside long, unique passwords and multi-factor authentication wherever available. Credential reuse weakens the arrangement, since one captured password then opens several accounts.
Closing a session and checking afterwards
When a public computer has to be used, the closing sequence limits the trace left behind: signing out of every account accessed, because closing a tab alone does not end a session; closing every browser window, because a private session ends only when every private window is closed; clearing history, cookies, cached files and saved form data; and deleting downloaded files, because downloads remain on the machine.
On a trusted device, recovery means reviewing active sessions, signing out unfamiliar ones, and changing shared passwords. A password change does not remove a session kept alive through a separate mechanism, or an earlier app authorisation. Checking whether the address appears in a known breach is separate, provided by Have I Been Pwned from its breach database. Cleanup limits later access; it does not undo exposure that already happened.
Aliases and their limit
Email aliases change what a website learns, not what a compromised computer captures. An alias is a forwarding address given to a website instead of the real inbox address, which the website never sees. AliasFleet provides aliases on that model, with one alias per website, forwarding to a real inbox, and an option to disable an alias when its site leaks or misuses the address.
The limit is direct. An alias does not protect a password typed on a compromised computer: recording captures the password regardless of which address was given to the website, a saved session gives the next user the mailbox regardless of how many aliases point into it, and an alias does not hide mailbox contents from a person standing behind the chair. The alias mechanism operates between the website and the inbox; the public computer problem operates between the keyboard and the account. A control at one layer does not fix a failure at the other. Aliases reduce the value of a leaked website database, strong unique passwords and a second factor reduce the value of a captured password, and private browsing with sign-out reduces the trace left behind. None of those controls, alone or together, turns a public computer into a trusted device for sensitive mail.
Uses without sign-in and alternatives
Not every use of a public computer carries the same risk. Reading a public web page, checking a bus timetable, or looking up a shop address involves no sign-in and no personal data, while a personal mailbox, an account notice, or an attachment involves credentials and personal data, and belongs on a private device. Where a private device is unavailable, a personal phone on a mobile connection avoids the shared machine. A public computer is an untrusted machine in a public place, and sensitive email belongs on a private device.
Top comments (0)