Password Management After Death: A Practical Guide to Digital Inheritance

Tech companies do not give families a dead person's passwords, and a death certificate alone rarely unlocks an account. Families get in through something the person set up in advance, such as Apple's Legacy Contact, Google's Inactive Account Manager or a password manager's emergency access. Otherwise they need legal authority from a will or a court order. This guide covers both sides: what to set up now, and what to do if someone has already died and left no plan.

Why can't my family just get my passwords?

Two things stand in the way: privacy law and the company's own rules.

Federal law generally stops providers from disclosing the contents of someone's communications without lawful consent from the sender, the recipient or the account holder (18 U.S.C. § 2702). Separately, providers write their terms so that accounts belong to one person. Microsoft's agreement says you cannot transfer your account credentials to another user, and Yahoo's terms say accounts are non-transferable and any rights end when the account holder dies.

Most states have adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which gives executors a legal route in. Florida's version shows the usual order of priority:

1. A direction the person gave through a provider's online tool, such as Google's Inactive Account Manager, comes first.
2. If there is no tool setting, directions in a will, trust or power of attorney apply.
3. If there is neither, the provider's terms of service decide.

Even with legal authority, an executor usually gets a list of who the person contacted and when. The actual content of messages generally requires the person's earlier consent or a court order. The details differ by state, so ask a probate attorney about your state's rules.

What should I set up now?

If you are planning ahead, these steps take an afternoon and solve most problems.

1. Make an account inventory. List each account name, the email address it uses and what it holds (banking, photos, subscriptions, crypto). Leave the passwords off this list. Our estate inventory checklist gives you a place to start.
2. Use a password manager. The Cybersecurity and Infrastructure Security Agency (CISA) recommends one, so you only remember a single strong password, and suggests passwords of at least 16 characters, different for every account.
3. Turn on the built-in legacy tools for the big platforms (see the next section).
4. Store the keys to the vault. Write your password manager's master password, any recovery or emergency kit and your phone passcode on paper. Keep them with your important papers, in a safe or safe deposit box, and tell your executor where they are.
5. Name who may access your digital assets. Ask whoever drafts your will to include wording on digital assets and electronic communications. Our digital will guide explains the options.
6. Review once a year, and after any change of phone or password manager.

How do legacy tools and emergency access work?

A few details that matter:

• Apple. You need a device on iOS 15.2, iPadOS 15.2 or macOS Monterey 12.1 or later, two-factor authentication (Apple recommends turning it on), and a Legacy Contact over 13. Set it up under Settings, then your name, Sign-In & Security, Legacy Contact. After your death, the contact has access for a limited time: three years from when Apple approves the first request, after which the account is permanently deleted. Our Apple Legacy Contact guide has the steps.
• Google. You choose how long Google waits, which data types to share (for example Drive, Mail, YouTube) and up to 10 people to receive it. Google checks the contact's phone number before they can download anything. Our Google Inactive Account Manager guide walks through it.
• Bitwarden. Only a premium user can set it up, but the trusted contact can have a free account. If you do not reject the request before the waiting period ends, access is granted automatically.
• 1Password. The Emergency Kit is a PDF with your sign-in address, Secret Key and a space to write your account password. 1Password suggests printing it for a safe deposit box or with your passport, and giving a copy to someone you trust.

Other password managers have their own emergency features. Check your provider's help pages for what yours offers and how long its waiting period is.

What if someone has died and left no plan?

Work through the options in this order.

1. Look for what exists. Check for a printed list, a password manager, a notebook beside the computer, and the phone's passcode. Apple cannot remove a passcode lock without erasing the device, so the passcode matters.
2. Check for a Legacy Contact or Inactive Account Manager. The person may have named someone, and that person may already have an access key or an email from Google.
3. Use the provider's death process. Google says it can work with immediate family and representatives to close an account where appropriate, and in some cases may provide content. It says it cannot provide passwords or login details. If you choose closure, Google says it cannot turn over the contents later, so decide about saving data first.
4. Get legal authority. An executor with court-issued letters can make a written request to the provider under your state's RUFADAA version. In Florida, for example, the request needs a certified death certificate, the court papers naming the representative, and information identifying the account. Without a Legacy Contact, Apple asks for a court order naming the account and the requester and directing Apple to help.
5. Don't rush to delete or cancel. Leave email accounts and the phone number alone until you know which accounts rely on them. Our guide to closing email accounts explains why.

Ask a probate attorney if a provider refuses, or if the estate is contested. A request to a company is not a substitute for legal advice in a dispute.

What trips families up

• Two-factor codes. Even with the right password, a code sent to the person's phone or authenticator app can block you. Before cancelling a phone line, check which accounts send codes to that number. Our guide to cancelling a phone contract after a death covers the order to do things in.
• Passkeys and biometrics. Passkeys are tied to a device or a keychain. Apple's Legacy Contact cannot reach saved passkeys, so a locked phone can put them out of reach.
• Power of attorney. A power of attorney generally ends at death, so it does not cover the estate. See our guide to power of attorney and funerals.
• Subscriptions. Charges can keep coming until the card or bank account is closed. Our subscription cancellation guide lists how to stop them.
• Cryptocurrency. With a self-custody wallet, whoever holds the recovery phrase controls the funds. Read our cryptocurrency after death guide for how to record it safely.

What to do next

1. Write a one-page list of your accounts and where your master password and phone passcode are kept. Put it with your will.
2. Turn on Legacy Contact (Apple) and Inactive Account Manager (Google) if you use them.
3. Set up emergency access or an Emergency Kit for your password manager, and tell your executor.
4. Ask your attorney to add digital-asset wording to your will or power of attorney.