BlockMyself
Recovery audit

Find every way you can undo the block.

Strong filtering fails when recovery is still in your pocket. Audit the recovery paths before calling a setup locked.

Passwords Recovery keys Admin paths

The real bypass is often recovery

Filters fail when the daily user can recover the parent account, reset the passcode, find a backup code, or regain admin. Use this audit before handing control to a trusted person.

  1. List every device, account, router, DNS provider, password manager, and blocker involved.
  2. For each item, ask: "How would I undo this if I wanted to bypass tonight?"
  3. Move that recovery path to the trusted person or remove it from your access.
  4. Do not keep screenshots, printed copies, exported vaults, or backup codes unless they are controlled by the trusted person.
  5. After handoff, run the account and reset sections of Test your setup.

Recovery inventory

Copy this into a note, spreadsheet, or the printable handoff worksheet.

CategoryLook forMove or clean up
AppleApple Account password, trusted phone numbers, recovery contact, Screen Time passcode recovery, iCloud Keychain, device passcode, Family Sharing organizer account.Trusted person controls Screen Time passcode and Apple recovery paths used to reset it.
GoogleFamily Link parent account, recovery email, recovery phone, backup codes, Google Password Manager, secondary Google accounts, Chrome profiles.Trusted person controls parent account credentials and recovery. Remove extra accounts from managed devices.
MicrosoftFamily Safety organizer account, Microsoft account recovery, Windows Hello PIN, local admin accounts, BitLocker recovery keys.Trusted person controls organizer and admin credentials. Recovery keys are stored off the daily account.
Router and DNSRouter admin password, ISP account, Wi-Fi mesh app, DNS dashboard, Pi-hole, AdGuard Home, NextDNS, OpenDNS, CleanBrowsing, Cloudflare account.Trusted person owns the admin login and recovery email. Daily user should not have dashboard access.
Password managers1Password emergency kit, Bitwarden recovery, iCloud Keychain, Chrome passwords, exported CSV files, shared vaults, browser autofill.Remove blocker/admin credentials from your vault or move them to a trusted-person vault.
Local filesNotes, screenshots, photos, downloads, email attachments, printed pages, old text messages, cloud-drive docs.Search and delete your copies after the trusted person has the required emergency information.
Device resetFactory reset, Powerwash, recovery mode, external boot, BIOS/UEFI, macOS recovery, installer USB, MDM removal.Use device management, account ownership, disk encryption, physical controls, and trusted-person recovery.
Third-party blockersAdmin dashboards, uninstall passwords, emergency bypass links, license account, support email, recovery codes.Trusted person owns the account and recovery email. Daily user should not hold the bypass code.

Apple audit

  1. Identify who knows the Screen Time passcode.
  2. Identify which Apple Account was entered at the Screen Time Passcode Recovery prompt when the passcode was set. That account, and only that account, can reset the passcode through Forgot Passcode?.
  3. If you cannot remember which account was used, or you know it was yours, assume the passcode is resettable by you. Have the trusted person set a new passcode and answer that prompt with their own account. There is no way to inspect the stored value.
  4. Check whether that Apple Account password is saved in iCloud Keychain, Safari, Chrome, Notes, or a password manager.
  5. Check trusted phone numbers and recovery contacts. Note what they actually protect: they are your route back into your own account, not a control you should hand away. See the caution on moving recovery contacts.
  6. Check whether the daily user can change account settings, passcode settings, cellular data settings, VPN profiles, or device-management profiles.
  7. For Mac, check whether the daily user is an administrator and whether they can access FileVault recovery keys, including in the Passwords app on recent macOS and in iCloud if the disk was set to unlock with the iCloud account instead of a recovery key.
  8. Accept what a factory reset does: it wipes Screen Time completely, and reactivation asks only for the Apple Account password you already know. Unless the device is supervised through Automated Device Enrollment, that path stays open to you.
  9. Move the relevant password, passcode, and recovery paths to the trusted person.

Google and Android audit

  1. Identify the Family Link parent account.
  2. Check whether the parent account password is saved on the managed device.
  3. Check recovery email, recovery phone, and backup codes.
  4. Remove secondary Google Accounts that can install apps or change settings.
  5. Check Chrome profiles on Windows, Mac, Linux, Android, and Chromebook.
  6. On Chromebook, confirm the owner account is not the daily user's uncontrolled account. Then accept the limit: on an unenrolled Chromebook, Ctrl + Alt + Shift + R at the sign-in screen powerwashes the device and hands ownership to whoever signs in next, with no password. Only enterprise or school enrollment survives that.
  7. Move parent-account and owner-account recovery to the trusted person.

Microsoft and Windows audit

  1. Identify the Microsoft Family Safety organizer account.
  2. Check whether the organizer password is saved in Edge, Chrome, Windows Credential Manager, or a password manager.
  3. Check recovery email, recovery phone, and backup codes.
  4. List every local administrator account.
  5. Confirm the daily user is a standard user.
  6. Find where BitLocker recovery keys are stored. Check aka.ms/myrecoverykey signed in as the daily user: Windows escrows the key to the Microsoft account on the PC automatically, so a copy is usually sitting there even if you never saved one.
  7. Remove or rotate any escrowed key copy the daily user can still reach. A printed key handed to the trusted person does nothing while the online copy remains.
  8. Move organizer, administrator, and recovery-key control to the trusted person if you need lockout, keeping a second copy per the redundancy rule.

Router, DNS, and network audit

  1. List the router, modem, mesh system, ISP account, and DNS/filtering provider.
  2. Find who controls the router admin login and recovery email.
  3. Find who controls the ISP account used to reset equipment or change network settings.
  4. Find who controls the DNS dashboard or local resolver admin page.
  5. Check whether the router has a physical reset button that is easy to access.
  6. Check whether guest networks, extra SSIDs, IPv6, or mobile hotspots bypass the filter.
  7. Move admin and recovery control to the trusted person.

Handoff decision

FindingAction
You know the passcode or password.Change it with the trusted person present; do not learn the new one.
You can recover the account by email or phone.For accounts the trusted person owns, put recovery on their contact details. For your own primary accounts, leave recovery where it is and add an Apple Recovery Contact instead. Moving your own 2FA phone number risks losing the account and blocks little, since your password already resets most settings.
You have backup codes.Regenerate or transfer them so the trusted person holds the current codes.
You have admin/root access.Create a standard daily account and let the trusted person hold admin/root credentials.
You can reset the device.Use device management, ownership controls, recovery-key handoff, or network-level enforcement.