Windows Recall: What It Actually Screenshots, Where It Lives, and How to Kill It

What Recall actually does

On a Copilot+ PC — the ones with a 40+ TOPS neural processing unit — Recall periodically grabs a snapshot of your screen, extracts the text via OCR and drops everything into a local database you can search in plain language. The processing happens on the device; the NPU exists precisely so this history can be searched without shipping pixels to a cloud. On an ordinary laptop or desktop the feature simply does not exist: no NPU, no Recall, nothing to worry about.

It also arrived humbler than announced. After the 2024 backlash Microsoft rebuilt Recall before launch: snapshots are strictly opt-in, saving can be paused, individual snapshots or the whole history can be deleted, and the database is encrypted, tied to BitLocker or device encryption, and only decrypted while you are actively authenticated. Recall requires Windows Hello Enhanced Sign-in Security, which is why it is bound to hardware most machines do not have.

What the snapshots really expose

Here is the honest part: a screenshot does not editorialize. If it was on your screen at snapshot time, it is in the database — which makes the real risk profile different from keyloggers and telemetry.

• Passwords you typed in plain view — the reveal-password toggle, not the masked field
• Private messages and email content shown on screen, in any app, in any browser
• Banking, tax and medical results, captured as faithfully as any document you opened
• Browsing in normal windows — though supported browsers can filter InPrivate and incognito modes
• Anything a housemate, partner or colleague could scroll back to if they can authenticate as you
• Gigabytes on disk over months: snapshots are small but not free, and the database grows

How to check whether you have it — and turn it off

Open Settings, then Privacy & security, then Recall & snapshots. If the page exists on your machine, saving is off unless you switched it on yourself; if you never bought a Copilot+ PC, the page is not there at all. From that page you can pause saving, set a time or disk limit for stored history, delete individual snapshots or wipe everything.

The two settings worth changing on a shared machine: keep saving paused unless you genuinely need the search, and never enable Recall on a PC other people can log into with their own accounts. Recall's security model defends against other users and thieves, not against someone who can pass your Windows Hello check. That line is worth knowing, because it is the one thing the fear pieces get right.

Questions and Answers

Read next