Short answer: Without planning, your accounts become permanently inaccessible — and the better your security, the more certain that outcome. Two-factor authentication that nobody can pass, encrypted vaults nobody can open, and providers who are legally unable to help. The fix takes an afternoon: use the legacy tools the major platforms already provide, set up emergency access in your password manager, and leave a written index of what exists and where the keys are.
The uncomfortable arithmetic
Everything that makes an account hard for a stranger to reach makes it hard for your family to reach.
A passkey on a device with your fingerprint. Backup codes in a drawer nobody knows about. A password manager with a master password only you know. An Apple recovery key that deliberately disables support-assisted recovery.
Each of those is good security. Together, with no plan, they mean photographs, documents, business accounts, domains, subscriptions and money become unreachable — while the direct debits keep running.
Providers cannot simply hand over accounts. Privacy law, terms of service and, in the case of end-to-end encrypted services, actual cryptographic impossibility all get in the way. Proton genuinely cannot decrypt your mail for anyone.
The tools that already exist
Most people do not know these are there. All are free and take minutes.
Apple: Legacy Contact
Settings → [your name] → Sign-In & Security → Legacy Contact. Nominate someone and give them the access key Apple generates. On presentation of a death certificate, they can access your iCloud data — photos, notes, documents, backups. Do it now; it cannot be arranged afterwards. See our Apple Account guide.
Google: Inactive Account Manager
myaccount.google.com → Data & privacy → Inactive Account Manager. Set a period of inactivity — three to eighteen months — then nominate up to ten people to be notified and optionally given access to selected data. You can also have the account deleted automatically. See our Google guide.
Meta: Legacy Contact
Facebook lets you nominate someone to manage a memorialised profile, or set the account to be deleted on death.
Password managers: Emergency Access
1Password’s Emergency Kit, Bitwarden’s emergency access, and similar features in other managers let a trusted contact request access, with a waiting period during which you can decline. This is the single most useful item on the list, because the vault contains everything else.
Microsoft and others
Microsoft handles this through next-of-kin processes rather than a self-service tool. Most other services have a bereavement process requiring documentation — slow, but it exists.
The afternoon plan
- Consolidate into a password manager. If your credentials are scattered across a notebook, your browser and your memory, nothing else here works.
- Set up emergency access in that manager, with a trusted person and a waiting period you are comfortable with.
- Configure the platform tools above — Apple Legacy Contact, Google Inactive Account Manager, Facebook legacy contact.
- Write an index. Not passwords — a list of what exists: which email is primary, which password manager you use, whether there is a business, domains, crypto, subscriptions, and where the physical recovery materials are kept. One page.
- Store the physical materials together — recovery keys, backup codes, a spare security key — somewhere a trusted person can reach: a home safe, a solicitor, a bank box.
- Tell someone it exists. The most elaborate plan fails if nobody knows to look.
- Mention it in your will, referring to the location of the index rather than including credentials in the will itself (wills can become public documents).
- Review annually. Accounts change, people change, providers change their tools.
Special cases
Crypto. The hardest problem here, because there is no provider and no recovery process. A seed phrase is the asset. Options include a metal backup in a safe with instructions, or splitting the phrase across trusted parties or locations. Whatever you choose, someone must know it exists and how to use it — a great deal of crypto has been permanently lost this way. See 2FA for crypto.
Business accounts. Domains, hosting, payment processors and cloud infrastructure should never sit in a single person’s personal account. Use role-based addresses, document who has access, and keep a break-glass credential in a safe. See securing your domain name and 2FA for small teams.
Photos and irreplaceable files. Consider a local backup drive that family can simply plug in. The most reliable digital legacy is often a copy that requires no credentials at all.
Subscriptions. List the recurring payments. Families frequently spend months cancelling services they cannot identify.
What not to do
- Do not put passwords in your will. Wills can be read by more people than you expect, and become outdated immediately.
- Do not share your master password now “just in case”. Emergency access with a delay exists precisely so you do not have to.
- Do not rely on a family member guessing. They will not.
- Do not assume providers will help. Many cannot, legally or technically.
- Do not skip the index because the password manager covers it. Someone still needs to know which manager, and that the plan exists.
Frequently asked questions
Can my family just use my fingerprint?
No. Biometrics fail after death, and devices fall back to passcodes. Legal and practical routes matter far more — see is biometrics really 2FA?
Will a death certificate get access to accounts?
Sometimes — most large providers have a bereavement process. It is slow, varies by jurisdiction, and often results in memorialisation or deletion rather than full access. Self-service legacy tools are far better.
Is it safe to write things down?
Yes, if stored appropriately. Paper in a safe is protected from every remote attacker on earth. The threat model for legacy planning is different from daily security.
What about a shared family password manager?
A good option for couples and households. Family plans include shared vaults and emergency access, which handles both daily convenience and eventual need.
How much detail should the index include?
Enough to find things, not enough to be a credential list: which email is primary, which password manager, whether there is crypto or a business, and where the physical materials are. One page.
Should I write down my 2FA backup codes for this?
You should have them written down anyway — see where to store backup codes and backup codes vs recovery keys. Keeping them with your legacy materials serves both purposes.
The bottom line
Good security and good legacy planning pull in opposite directions, and the resolution is not weaker security — it is delegated, delayed access set up in advance. Apple Legacy Contact, Google Inactive Account Manager, password manager emergency access, and a one-page index someone knows about. An afternoon now, against a family locked out of your photographs indefinitely.
While you are in those settings, it is a good moment for a wider check: the 9 most common 2FA mistakes.