What Happens to Your Passwords When You Die?

Imagine your family a week after your funeral. They have the will. They have the lawyer's number. They have the key to the house. And they are locked out of nearly everything that matters.

The bank wants a login. The email account that receives the bills needs a password. The phone that holds the two-factor codes is locked, and nobody knows the PIN. The photos are in a cloud account nobody can open. Your spouse knows you had a password manager, but not the master password, and the reset email goes to an inbox they cannot reach.

This is the most common way a well-planned estate still fails. The will is signed, the executor is named, the assets are divided on paper, and the family cannot get in. A will distributes assets. It does not distribute access. Our guide to what a will covers, and what it doesn't explains the full gap. This article is about the password half of it: what actually happens to your accounts when you die, what the big platforms already offer, and the twenty minutes of setup that fixes most of it.

The default: your accounts lock, and nobody has the key

When you die, your accounts do not transfer to your family the way a house does. Each one is governed by its own terms of service, and most terms of service say the account belongs to you alone and cannot be transferred. The company is not being difficult. It is protecting itself from fraud, and from giving a stranger access to your private messages.

In the United States, the law that governs this is called RUFADAA, the Revised Uniform Fiduciary Access to Digital Assets Act, adopted in some form by nearly every state. It sets a clear priority order, and it is worth knowing because it decides who wins when the rules conflict.

First, the tools the platform itself offers. If you set up Google's Inactive Account Manager, Apple's Legacy Contact, or Facebook's Legacy Contact, your choice there overrides everything else, including your will. Second, explicit instructions in your estate documents, but only if the language specifically covers digital assets. A general grant of authority to your executor is usually not enough. Third, the platform's terms of service, which in many cases prohibit access by anyone but the account holder, even after death.

There is also a trap inside the trap. If your family does know your password and logs in as you anyway, that can violate the platform's terms of service and, in the US, can even raise issues under the federal Computer Fraud and Abuse Act. Good intentions do not make an unauthorized login authorized. Your family needs lawful access through official channels, not a sticky note with a password.

The practical point is simple. The platforms built the doors. You have to walk through them while you are alive, because after you die, nobody else can open them for you.

The three tools that already exist

Google: Inactive Account Manager

Google's Inactive Account Manager is the closest thing to a dead man's switch that a major platform offers. You choose a waiting period of 3, 6, 12, or 18 months of total silence across your Google services. If your account stays quiet for the full period, Google first tries to reach you, more than once, through your recovery email and phone, so a long trip or a hospital stay does not trigger it by accident. If you never respond, Google contacts up to 10 trusted people you named in advance. For each one, you decide whether they only get a notification or also get a download link for the data you chose to share, Gmail, Photos, Drive, or a subset. They then have about three months to collect it.

Two details matter. First, your contacts receive a download of data, not the keys to the living account. They cannot sign in as you. Second, you can also switch on an auto-reply for incoming email and, if you choose, have Google delete the account after the handover. Twelve months is the safer default for most people. Three months is short enough that a long illness with no logins can trip it.

This is one account, though. It does nothing for your bank, your Apple ID, or your social media. It is one piece of the puzzle.

Apple: Legacy Contact

Since iOS 15.2, Apple lets you name a Legacy Contact in Settings, under your name, then Sign-In and Security. Apple generates an access key for that person. After you die, the contact submits the key plus a death certificate through Apple's Digital Legacy page or their own device. Once Apple approves the request, the contact can access your photos, messages, notes, files, device backups, calendars, contacts, and call history through a special Legacy Contact account. It also releases Activation Lock, so an erased device can be set up again.

What it does not do is just as important. A Legacy Contact gets none of your passwords. iCloud Keychain is entirely excluded: no saved logins, no passkeys, no stored cards, no Wi-Fi passwords. Purchased movies, music, and books do not transfer either, because you never owned them. And the access lasts three years from the date the request is approved, not three years from the death, after which Apple permanently deletes the account. So the contact has to download what matters promptly.

The access key is the whole system. If your contact loses it, Apple cannot replace it, and the request becomes much harder, usually requiring a court order. Send the key through Messages, which stores a copy on the contact's own device, or print it and store it with your estate documents. A Legacy Contact without the key is useless.

Facebook: Legacy Contact

Facebook works differently, because a profile is a shared, public space. When Facebook learns someone has died, the account can be memorialized: the profile stays up, marked "Remembering" next to the person's name, as a place where friends and family can share memories. If you chose a Legacy Contact while alive, that person can look after the memorialized profile. They can write a pinned post, change the profile and cover photos, respond to new friend requests, manage tributes, download an archive of what you shared if you allowed it in advance, and request that the account be deleted instead. Or you can choose in advance to have the account deleted after your death.

What a Facebook Legacy Contact cannot do is log in as you, read your private messages, remove your friends, or edit or remove your past posts. If your family's real goal is access to messages or deeper account content, a Facebook Legacy Contact will not provide it. It is a stewardship role for a public profile, not a key to the account.

Notice the pattern. Google hands over a copy of your data. Apple hands over your personal archive, but never your passwords. Facebook hands over the care of a public memorial, and nothing private at all. None of the three gives your family your passwords. That job belongs to a different layer.

The password manager is the master key

Most of your accounts live behind one master password: the password manager. If your family cannot open the vault, nothing else matters, because every individual password is inside it. If they can open it, nearly everything else becomes a solvable problem.

The two mainstream options handle this differently, and both are worth knowing about.

Bitwarden has the most complete version, called Emergency Access, on its paid Premium and Families plans. You invite a trusted contact and grant them either view access or full takeover of your vault. You also set a waiting period, anywhere from one day to 90 days. If your contact ever requests access, you get a notification. If you do not decline within the wait period, access is granted. Your contact needs their own Bitwarden account, and ideally some comfort with the app, before the hard week arrives. The catch is the obvious one: it covers exactly what is in the vault. The account you never added, or the note that lives elsewhere, is out of reach.

1Password takes a different route. There is no built-in emergency contact feature. Instead, every account comes with an Emergency Kit, a PDF holding your sign-in address, your email, and your Secret Key, with a space to write your account password. The advice is to print it and store it somewhere genuinely safe, such as with your important papers. On a 1Password Families plan there is also account recovery: a family organizer can help another member who is locked out regain access. The trade-off is that the Emergency Kit is only as safe as the paper it is printed on, and only as findable as the place you chose. It grants access immediately to whoever holds it, with no waiting period, so where you keep it matters a great deal.

Whichever manager you use, the rule is the same: the emergency path has to be set up and tested while you are alive. A password manager with no emergency access configured is a vault with one key, and the key dies with you.

Two-factor authentication: the phone problem

There is one more lock, and it is the one that surprises families most. Even with the right password, many accounts now ask for a second factor: a code from an authenticator app, a text to your phone, or a tap on a device you own. If your phone is locked and nobody knows the PIN, the correct password is not enough.

The fixes are unglamorous and they all happen in advance. Store your authenticator's backup or recovery codes somewhere your executor can reach them, not inside the authenticator app itself. Keep a printed list of recovery codes for your most important accounts with your estate documents. If your authenticator supports cloud backup or a second device, turn it on. And make sure at least one trusted person knows your phone's PIN or passcode, in writing, in a place they can find. A phone nobody can unlock is a brick with your second factor inside it.

The four mistakes families keep making

Putting passwords in the will. A will becomes a public document during probate. Anything written in one stops being private. Passwords do not belong in a will. They belong in a password manager, with the access path written down separately.

Sharing passwords while alive. Emailing your spouse your bank password, or writing it on a card in a drawer, feels like planning. It is not. It is an unauthorized login waiting to happen, and it does not survive the terms of service problem. Use the official channels: the legacy tools, the emergency access feature, a named digital executor.

Logging in as the deceased. It is the natural instinct, and it is the one that can create legal trouble. Use the platform's own process, even when it is slower. The slowness is the price of doing it lawfully.

Having no inventory. Your family cannot protect what they do not know exists. A list of accounts, where each one lives, and who should have access to it is the single most useful document after the will itself. Keep the list in your password manager or with your estate documents. Never put the passwords on the list.

The twenty-minute setup

This is the whole plan, and it fits in one sitting:

1. Set up the three platform tools. Google Inactive Account Manager (12 months, up to 10 contacts), Apple Legacy Contact (send the access key, do not just generate it), Facebook Legacy Contact (or choose deletion). Our step-by-step guide to setting up all three in 20 minutes walks through each screen.
2. Turn on emergency access in your password manager. Bitwarden Emergency Access, or a printed 1Password Emergency Kit stored with your estate papers. Pick a waiting period you are comfortable with, and tell the person you named.
3. Write a digital directive. One page, stored with your will, that names your digital executor and explicitly grants authority over digital accounts. Keep the account list in the password manager, not in the will.
4. Write down the physical map. Phone PIN, safe combination, where the will is, who the lawyer is. Our post-signing checklist covers the first week after signing, and our guide to where to store your will covers the storage decision.
5. Tell one person. The best plan in the world fails if nobody knows it exists. Tell your executor, or the person you named as your emergency contact, where everything is and what to do first.

Then repeat once a year. Contacts change, accounts change, and a plan that names an ex-spouse as your emergency contact is a failure of maintenance, not of planning.

The short version

Your passwords will outlive you. The accounts will not open themselves. Twenty minutes now is the difference between a family that can act and a family that spends the hardest month of their lives locked out of your life.

If you want your will, your messages, and your files to reach the people you chose even if you go quiet, set up a free Farwell check-in. You choose who receives what, Farwell verifies first, and nothing is delivered until it is actually needed. Couples can also make free mirror wills so both partners' instructions travel together.

This is general information, not legal advice. Rules about digital assets, passwords, and probate vary by state and province, and some of them change. Platform features change too, so confirm the details on each company's own help pages before relying on them. For questions about your specific situation, ask the lawyer or notary who prepared your documents.