What happens to your passwords when you die?
Most of us have dozens of accounts, from email and banking to photos and subscriptions, and nobody else knows the passwords. When someone dies, those passwords don't pass to their family automatically. Here's what actually happens, and how to plan for it while you can.
The short answer: nothing happens automatically
Accounts stay locked. Each company has its own process, usually requiring a death certificate and proof that you're the executor or next of kin. Some accounts can be memorialized or closed, a few can be handed over, and many can't be opened at all. Two-factor authentication makes it harder still: if the codes go to the phone of the person who died, and nobody can unlock that phone, the family can be locked out even with the right password.
What the big platforms offer
Apple: Legacy Contact
You can name one or more Legacy Contacts. After your death, a Legacy Contact can use the access key you gave them, together with a death certificate, to request access to your iCloud data: photos, messages, notes, files, contacts, calendars and device backups. Apple is clear about the gap: passwords saved in iCloud Keychain, payment information and purchased media are not included, and access is time-limited.
Google: Inactive Account Manager
You choose when your account counts as inactive (after 3, 6, 12 or 18 months without use). Google warns you first, then notifies up to 10 trusted contacts and can share the data you selected with them, such as photos, emails or documents. It covers your Google data, not the passwords to everything else.
Password managers: emergency access
Some password managers let you name an emergency contact. With Bitwarden, for example, a trusted contact can request access to your vault; if you don't reject the request within the waiting period you set, they're granted access. It works well, but only if you already keep your passwords in that password manager and have set it up in advance.
Social media
Facebook lets you choose a legacy contact to look after a memorialized profile, but that person can't log in as you or read your messages. Other networks offer memorialization or deletion on request.
The gap: the passwords themselves
Put together, these tools leave a hole. Apple's Legacy Contact doesn't pass on passwords. Google's tool only covers Google. A password manager only helps if you use one, and many people, especially older relatives, don't. The result is the familiar paper list in a drawer: easy to lose, easy for the wrong person to find, and usually out of date.
How to leave access safely, in five steps
- Make an inventory. List your accounts, what each one is for, and what should happen to it: keep, transfer, download or close. Start with email, because it's the key to resetting everything else.
- Choose where the information lives. A password manager with emergency access, a sealed letter held by a lawyer or notary, or an encrypted vault designed to be handed over. Avoid unencrypted files on your computer.
- Name the people. Decide who should get access to what. It doesn't have to be the same person for everything.
- Deal with two-factor authentication. Save backup codes for important accounts alongside the passwords, and make sure someone can unlock your phone or knows where the codes are.
- Keep it up to date. Set a yearly reminder. An out-of-date list causes almost as much trouble as no list.
What not to do
- Don't put passwords in your will. In many countries, a will becomes a public document after probate, and passwords change long before a will does.
- Don't keep a plain-text list on your phone or computer. Anyone who gets hold of the device gets everything.
- Don't ask your family to log into bank accounts as you. Banks and other financial institutions have their own bereavement processes, and the executor should use them. What your family needs is the list of accounts and the right contacts.