Wipe data on device completely
The recommended way is to go into Security -> Encryption. Encrypt your phone, which takes several hours. Then do a factory reset.

Others will have no way of recovering your personal data.

Additional Info:

It works much like BitLocker on Windows. When you start up the phone, you'll be required to enter a password before loading Android OS (or the Recovery Mode). Afterwards, none of the applications running on the OS will even notice the encryption.

What the encryption does is:
1) make it extremely difficult (i.e. for all practical purposes impossible) for other software to recover the /sdcard/ files (e.g. user data) after a factory reset.
2) prevent external applications and operating systems from reading those files without first decrypting it, which requires Android OS to load.