Short answer: Ticking “remember this device” is reasonable on hardware only you use, and a genuine risk everywhere else. It creates a long-lived exception stored as a cookie in that specific browser — so your account can be entered with the password alone, from that machine, until the exception expires. Use it on your own laptop and phone. Never on a shared, work, borrowed or public computer.
What the tick box actually does
It does not remember you. It remembers a browser.
When you tick it, the service stores a token in that browser’s cookies marking it as trusted for a period — typically 30 days, sometimes 60, occasionally indefinitely. On subsequent logins the site sees that token, skips the code prompt, and lets you in with just the password.
Three consequences that follow directly from that mechanism, and which surprise most people:
- It is per browser, not per device. Chrome and Firefox on the same laptop are two separate trusts.
- Clearing cookies removes it. If you use a privacy cleaner or “clear on exit”, you will be asked for codes constantly and wonder why.
- Anyone using that browser inherits it. The trust belongs to the browser profile, not to the person sitting at it.
When it is fine
On a device that is genuinely yours and reasonably protected:
- Your personal laptop with a login password and disk encryption
- Your own phone with a lock screen
- A home desktop only you have an account on
On these, the exception mostly trades a small amount of security for a large amount of daily convenience. And convenience matters — friction is why people turn 2FA off entirely, which is a far worse outcome.
When it is not fine
- Shared family computers. Your account is now open to anyone who sits down and knows or can reset the password.
- Work machines, especially for personal accounts. IT has access, and so does whoever inherits the laptop.
- Public or hotel computers. Never tick it. Ideally do not log in at all.
- A borrowed device, even briefly.
- Any device you are about to sell, return or recycle.
- High-value accounts — email, banking, crypto, your domain registrar. Accept the friction on the accounts that matter most.
The scenario worth thinking about
Someone gets your password — from a breach, from reuse, from a phishing page. Normally your 2FA stops them, and the unexpected code arriving is your warning that something is wrong.
Now imagine your laptop is stolen, or a housemate uses it, or a colleague sits at your unlocked desk. The password is autofilled by the browser. The 2FA prompt is skipped because the device is trusted. There is no code, so there is no warning either.
That is the specific gap: remembered devices remove not just the barrier but the alarm.
How to manage it properly
Review your trusted devices
Most services list them. Worth checking a couple of times a year:
- Google — Security → Your devices, and 2-Step Verification → “Revoke all” for trusted devices.
- Microsoft — Security → Advanced security options → “Don’t ask again” devices.
- Facebook / Instagram — Accounts Centre → Password and security → Where you’re logged in and Authorised logins.
- Snapchat — Two-Factor Authentication → Forget Devices.
- Amazon — 2SV settings → “Require OTP on all devices”.
Revoke everything when you sell a device, after any suspected compromise, or when you simply do not recognise an entry.
Get the underlying device security right
A remembered device is only as safe as the device. Which means:
- A screen lock with a short timeout
- Full-disk encryption (BitLocker, FileVault, on by default on phones)
- A separate OS account for each person in a household
- Not staying signed into everything on a machine that leaves the house
Use browser profiles
Separate profiles for work, personal and anything sensitive gives you granular control. Trust your personal profile, leave the others prompting.
A better trade-off: passkeys
The reason people want to skip 2FA is friction — typing a six-digit code forty times a week is tedious.
Passkeys largely remove the reason to make that trade. A passkey login is one tap of a fingerprint, no code to read, and it is genuinely multi-factor every single time. There is no “remember me” exception to leave lying around because there is nothing worth skipping.
Where a service offers them, this is the better answer than a permanently trusted browser. See passkeys vs 2FA and phishing-resistant MFA.
Frequently asked questions
How long does “remember this device” last?
Usually 30 days, though it varies by service and some renew the period on each use. A few keep the trust until you explicitly revoke it.
Why does my device keep forgetting?
Cookies are being cleared — by a privacy setting, a cleaner tool, private browsing, or an extension. The trust token is a cookie, so anything that removes cookies removes it.
Does it work in incognito mode?
No. Private windows discard cookies when closed, so you will be prompted every time.
Is a remembered device the same as a stolen session?
Related but different. A remembered device still requires the password; a stolen session requires nothing at all. See what is session hijacking.
Should I ever tick it on a phone?
Yes, on your own phone with a lock screen. The phone is generally the safest place to trust, because it is with you and protected by biometrics.
Does skipping the prompt mean I do not have 2FA any more?
Not exactly — 2FA still applies on every other device and browser. But on that one machine, the account is protected by a password alone. Judge it by asking who else can reach that machine.
The bottom line
Trust your own hardware, refuse everywhere else, and revoke the list once or twice a year. The convenience is real and worth taking on a personal laptop — just not on the accounts you would be devastated to lose, and never on a machine someone else can sit down at.
Tired of typing codes? The better fix is moving to passkeys where they are offered. And if codes keep getting rejected, that is usually clock drift: why 2FA codes get rejected.
One Response