Never put passwords in your will. Do this instead.

It feels like the obvious move. You just signed your will, the one document your family is guaranteed to read, so why not write your passwords in it? Your Gmail login, your bank PIN, the code to the safe, all in the place your executor will open first. Done, and your family will never be locked out.

Do not do it. A will is the worst place in your whole estate plan to put a password. Not the second worst. The worst. And the fix is not complicated: there is a four-part setup that takes about thirty minutes and keeps the passwords out of the public record while still making sure the right person can get in.

This is the third piece in our digital legacy series. The first explained what happens to your passwords when you die: mostly, your family gets locked out, and logging in as you can create legal trouble for them. The second walked through setting up Google Inactive Account Manager, Apple Legacy Contact, and Facebook Legacy Contact in 20 minutes. This one is about the mistake people make when they try to solve the problem with the will itself.

Reason 1: your will becomes a public document

Here is the fact most people never hear from anyone, including the lawyer who drafted the will. Once a will is admitted to probate, it becomes part of the court file, and probate court files are generally open to public inspection. In Ohio, for example, a will admitted under the state probate code goes into a case file that anyone can look at, and many county courts put their dockets online where anyone with an internet connection can search them. In England and Wales, once probate is granted, anyone can order a copy of the will from the government. The exact rules vary by place, but the direction is the same everywhere: a will is a legal instrument meant to be filed with a court, not a private note.

So a password written in your will is a password filed with a court. Your Gmail password, your bank login, your crypto exchange credentials, sitting in a file a stranger can request. Estate lawyers say the same thing in almost identical words: never put Social Security numbers, bank account numbers, or passwords in a will, because the document becomes public and the details inside it become public with it.

There is a second-order problem too. Identity theft does not stop when you die. Thieves target deceased people specifically, using their details to collect benefits or open credit lines in their name, because nobody is watching the accounts anymore. A will full of credentials is a head start for exactly that kind of fraud, delivered through a courthouse.

If your will is sitting in a drawer right now with a password written in it, that is worth fixing this week. The rest of this article is the fix.

Reason 2: copies of your will multiply

Even before probate, your will is not as private as it feels. Think about how many copies of it exist. The original is with your lawyer or in your safe. Your executor has a copy, or knows where to find one. The witnesses who signed it saw it. A family member may have a copy "just in case." Every copy is another place the passwords live, held by another person, in another drawer or inbox, with no way for you to track them or take them back.

A password in a will is a password you have handed to everyone who ever touches that document, for the rest of its life. And unlike a password in a password manager, you cannot rotate it, revoke it, or see who opened it. The will is a photocopier for secrets.

Reason 3: passwords change, wills do not

Your passwords should change. Your bank makes you change them. A breach forces a reset. You switch password managers. A will, on the other hand, is a document you update rarely, at some cost, with a signing ceremony and witnesses. Nobody re-signs their will because they changed their email password in March.

So a password in a will goes stale fast. Six months later it is wrong, and wrong is worse than absent: your executor tries it, gets locked out, trips the account's fraud alerts, and now the account is frozen while they try to prove who they are through the provider's process anyway. The will did not save them a step. It added a failed login attempt to the file.

This is the same reason the location of the will matters more than people think, which is why we wrote a whole guide to where to store your will. The principle is identical: the will should point at the answer, not be the answer. It should say where things are, not contain the things themselves.

Reason 4: having the password is not the same as having permission

This is the subtle one, and it is the reason the whole "just write it down" approach fails even if the will stayed private forever.

Logging into someone else's account is not automatically legal just because you have their password. Most providers' terms of service say accounts are non-transferable and passwords may not be shared. In the United States, logging in as a deceased person can raise issues under computer-access laws, and in the UK the Computer Misuse Act makes unauthorised access an offence, with real uncertainty about how it applies to a grieving family member. Possession of a password is not legal authority to use an account.

The law that governs this in most of the United States is the Revised Uniform Fiduciary Access to Digital Assets Act, known as RUFADAA, adopted in about 45 states. It sets a clear order of priority for who gets to decide what happens to a digital account:

1. A choice you made through the provider's own online tool, like

Google Inactive Account Manager or Apple Legacy Contact. That choice beats everything else.

1. A direction in your will, trust, or power of attorney. This is the

tier where your will actually matters for digital assets.

1. The provider's terms of service, if you did neither of the above.

This is the weakest position, and it usually leaves your family with little more than memorialization or deletion.

Notice what tier 2 does. Your will can grant your executor authority over your digital accounts. It can say "my executor may access my digital assets." That direction is powerful, and it is exactly what your will should contain. What it should not contain is the password itself. Authority and credentials are two different layers, and the will is the right home for one of them and the wrong home for the other.

There is one more RUFADAA detail worth knowing. The law splits the catalogue of your communications (who you emailed, and when) from the content of your communications (what the emails actually said). Your executor can usually get the catalogue. The content needs your affirmative consent in advance, or a court order. A password in the will does not fix that, because the password is not consent under the law. The online tools are the way to give consent properly, which is why the setup guide in our legacy contacts article matters more than any password list.

What your will should say instead

Keep the will focused on what wills are good at: naming who is in charge, and granting them authority. For digital assets, two lines are enough, and your estate lawyer can word them for your jurisdiction:

• A clause granting your executor authority over your digital assets

and accounts, so providers have a legal basis to deal with them.

• A sentence stating that a separate, private letter of instruction

exists, and where it is kept, without listing any credentials inside the will itself.

That second line is the hinge of the whole system. The will points at the access plan. It does not contain it. If you want to understand what belongs in a will and what does not, our guide to what a will covers, and what it doesn't walks through the full list, including the beneficiary designations and joint ownership that override the will entirely.

The fix: a four-part setup that takes about 30 minutes

Here is the arrangement that actually works. None of the four parts is hard. The point is that they cover each other: if one fails, another one catches your family.

Part 1: a password manager with emergency access

Put every password in a reputable password manager, and turn on its emergency access feature. This is the single highest-leverage step in the whole article.

Bitwarden's Emergency Access lets you name a trusted person who can request access to your vault. You set a waiting period, anywhere from one day to ninety days. If they request access and you do not decline it in time, they get in. 1Password has an Emergency Kit, a document you print and store securely that lets a trusted person recover your account, plus family recovery options. Either way, the mechanism is the same: the passwords live in one encrypted place, and one named person can get to them after a delay you control, without you ever writing a password on paper that circulates.

Do not put the master password in your will. Put it in the emergency access setup, where it belongs. And do not share one master password across everything else: if the will, the passwords, and the recovery codes all sit behind a single secret that only you know, your estate plan fails the moment that secret is lost.

Part 2: the platform legacy tools

Set up Google Inactive Account Manager, Apple Legacy Contact, and Facebook Legacy Contact. These sit at the top of the RUFADAA priority order, they are free, and they take about seven minutes each. Our step-by-step guide covers all three, including what each contact can and cannot get, and the gaps they leave behind (your bank, your phone PIN, and your password manager are not covered by any of them, which is why parts 1, 3, and 4 exist).

Part 3: a separate letter of instruction

Write a letter of instruction. This is a private, informal document, kept separate from the will, that lists your accounts by institution and general description, where the access details live, and who should get what. It is not filed with any court. It is not public. You can update it whenever you like without a lawyer, a witness, or a fee, which means it can actually stay current, unlike a will.

A good letter of instruction says things like: "My passwords are in Bitwarden, and my sister has emergency access. My crypto is on the hardware wallet in the safe; the recovery phrase is in the sealed envelope in the filing cabinet, second drawer. The Gmail account is covered by Inactive Account Manager, and my spouse is the contact." Notice what it does not do: it does not list a single password. It points at the vault, and names the person who can open it.

Store the letter where your executor can find it, and tell your executor it exists. A letter nobody can find is as useless as a will nobody can find. Keep it with the will's location note, or with the executor's copy of the key facts.

Part 4: a delivery mechanism for the instructions

Parts 1 through 3 solve access. Part 4 solves timing. Your family needs the instructions at the moment you go silent, not months later when someone thinks to check the filing cabinet. That is what Farwell is built for: you store the letter of instruction, the location notes, and any final messages in your account, and if you stop checking in, Farwell verifies first, then delivers them to the people you chose. The instructions arrive because the system noticed you were gone, not because someone happened to look in the right drawer.

You can set up a free Farwell account and store your letter of instruction as a scheduled delivery today. It takes a few minutes, and it is the piece that turns a good access plan into one that actually reaches your family on time.

What about crypto seed phrases?

Same rule, more so. A seed phrase is a password that controls money directly, with no customer support line and no password reset. It should never be in a will, never in a letter of instruction that circulates, and never photographed or stored in plain text on a phone.

The standard approach is split storage: the hardware wallet in one secure place, the recovery phrase in another, and the instructions for finding both in the letter of instruction, which names who is allowed to put the pieces together. If you hold crypto, say so in the will's digital assets clause, keep the phrase out of every document a court might see, and make sure exactly one trusted person knows the system exists.

The 30-minute checklist

1. Move every password into a password manager. Turn on emergency

access and name your person. (15 minutes, and you only do it once.)

1. Set up the three legacy contacts: Google, Apple, Facebook.

(20 minutes, covered in our step-by-step guide.)

1. Write the letter of instruction: accounts by name, where access

lives, who can open it, no passwords inside. (10 minutes.)

1. Add a digital assets clause to your will at your next lawyer visit,

and a line noting that the letter of instruction exists. (Ask your lawyer; do not paste passwords into the draft.)

1. Store the letter and the location notes in Farwell as a scheduled

delivery, so they arrive when your family needs them, not when someone stumbles on them.

That is it. Thirty minutes, no lawyer required for the first four steps, and your family gets access without your passwords ever appearing in a public court file.

The short version

Your will is a legal document that becomes public. Passwords are secrets that must stay private. Those two facts do not mix, and no amount of careful handwriting fixes it. Give your executor authority in the will, keep the credentials in a password manager with emergency access, name your legacy contacts, write a separate letter of instruction, and make sure the instructions actually reach your family when they need them.

Your will should say who is in charge. It should never say how to log in as you.

David Yang is the founder of Farwell, which delivers wills, messages, files, and passwords to the people you choose if you ever go silent. This article is general information, not legal advice. Rules about wills, probate, and digital assets vary by province, state, and country, and they change over time. If you have a blended family, a business, property in more than one country, or a complicated estate, have a lawyer review your plan.

Sources checked for this article: estate planning guidance on wills becoming public record at probate (Ohio probate practice; UK probate registry); RUFADAA three-tier priority, adopted in about 45 US states (North Carolina G.S. 36F-4/36F-5; California Probate Code s. 873; Pennsylvania 20 Pa.C.S. ch. 39); password manager emergency access features (Bitwarden, 1Password).