Digital legacy checklist: everything to prepare before you die

How do you use this digital legacy checklist?

Print this page or copy it into a document. For each item, write where the thing lives and how to get in, not the password itself unless the document will be stored securely. A checklist that is 70% done is far more useful than one you never started.

Two rules keep this safe. First, never store the master list in a shared cloud folder or in an email draft. Second, keep the list of what exists separate from the keys that open it, so that one leaked page does not hand over everything. Section 9 explains how to deliver both halves to the right person at the right time.

1. Which accounts and logins should be on the list?

Your primary email is the master key, because almost every other account resets its password through it. Start there and work outwards.

• Primary email account(s)

  Provider, address, how you sign in, and which recovery email and phone number are attached.

• Online banking and current accounts

  Bank name, account type and the login method; your executor will mostly need to know the accounts exist, not log in.

• Savings, investment and pension portals

  Including any workplace pension or retirement platform you rarely open.

• Phone carrier account

  Your phone number receives most 2FA codes, so the carrier login and PIN matter more than people expect.

• Cloud storage

  iCloud, Google Drive, Dropbox, OneDrive: where the photos, scans and tax returns actually live.

• Password manager

  Which one, the master password hint or emergency access setup, and where the recovery kit is.

• Social media

  Facebook, Instagram, X, LinkedIn, TikTok and any forum or community you care about.

• Messaging apps

  WhatsApp, Telegram, Signal, iMessage: note whether chat history is backed up and where.

• Subscriptions and recurring payments

  Streaming, software, gym, news, domains, web hosting: anything that will keep charging a card.

• Shopping and payment accounts

  Amazon, PayPal, Apple Pay, Google Pay, buy-now-pay-later services with saved cards or balances.

• Government and tax portals

  Tax authority login, benefits, vehicle registration, passport or ID services.

• Work and professional accounts

  Note which belong to an employer (they will recover them) and which are yours, such as a freelance portfolio or client platform.

• Utilities and household

  Electricity, water, internet, insurance portals and the router admin login.

2. Which devices and passcodes matter?

A locked phone is the single biggest obstacle families face. Modern phones cannot be unlocked by the manufacturer without the passcode, and a wiped phone takes its authenticator apps with it.

• Phone passcode

  The six-digit code, not the fingerprint; biometrics stop working after a restart.

• Tablet and laptop logins

  User account passwords and any disk encryption password or recovery key (FileVault, BitLocker).

• Hardware security keys

  Where the YubiKey or similar is kept and which accounts it unlocks.

• External drives and NAS

  Location, encryption passphrase, and what is on them.

• SIM PIN and carrier PUK

  If the SIM is locked, the phone number cannot receive recovery codes.

• Physical safe or lockbox code

  If you keep paper backups in one, the combination belongs on this list too.

3. Where are your two-factor and recovery codes?

Two-factor authentication protects you while you are alive and locks your family out when you are not. Each account that uses 2FA should have a written answer to "how does someone get past this?" See our guide on backing up two-factor authentication for the detail.

• Authenticator app and its backup

  Which app, which device, and whether cloud sync or an export is enabled.

• Backup codes for each major account

  Email, bank, cloud, password manager and crypto exchanges all issue one-time backup codes; print them.

• Recovery phone and email for each account

  Confirm they are current and that someone else can reach them.

• Password manager emergency kit

  The printed sheet with the secret key or recovery code, stored with your documents.

• Security questions

  Record the exact answers you gave, not the true answers.

4. What money, assets, debts and insurance should be listed?

Your executor needs an inventory, not access. For each item, write the institution, roughly what it is, and where the paperwork is. This is general information, not legal advice; what passes to whom varies by country and state.

• Bank and savings accounts

  Institution, type and whether they are joint or sole.

• Investments and pensions

  Brokerage, retirement accounts, employer pensions and any named beneficiaries.

• Property and vehicles

  Addresses, registration details and where the deeds or titles are.

• Life insurance and death-in-service benefits

  Insurer, policy number, beneficiary and the contact to make a claim.

• Debts and obligations

  Mortgage, loans, credit cards, tax owed, money lent to or borrowed from friends; see what happens to debts after death.

• Crypto wallets and exchanges

  Exchange accounts, self-custody wallets, and where the seed phrase is; without the seed phrase the coins are gone. More in crypto after death.

• Business interests

  Company shares, partnership agreements, domain names and revenue-generating accounts.

• Money owed to you

  Deposits, refunds, invoices outstanding and unclaimed balances.

5. Which documents do you need, and where are they?

The point of this section is location. A will nobody can find is nearly as bad as no will. Record where the original is and where a copy or scan lives.

• Will and any codicils

  Original location, the solicitor or notary who holds it, and the date it was last updated.

• Digital will or letter of wishes for online accounts

  A separate document listing how you want accounts handled; see what a digital will is.

• Power of attorney and advance directive

  Who holds them and whether they are registered.

• Identity documents

  Passport, national ID, driving licence, birth and marriage certificates.

• Property deeds and vehicle titles

  Originals and whether a bank or registry holds them.

• Insurance policies

  Life, home, car, health: policy documents and renewal dates.

• Tax records

  The last few years of returns and the login to the tax portal.

• Funeral plan or pre-paid arrangements

  Provider and reference number, if any.

6. Who are the people in your digital legacy plan?

Names, roles and how to reach them. Tell each person they are on the list; a surprised executor is a slow executor.

• Executor of your estate

  The person named in your will, with their current phone and email.

• Digital executor

  Someone technical enough to handle accounts and devices; may be a different person from the legal executor.

• Recipients of specific things

  Who gets the photo library, who gets the family recipes folder, who gets the domain name.

• Platform legacy contacts

  The person you named inside Apple, Google or Facebook settings (Section 8).

• Professionals

  Solicitor, accountant, financial adviser, insurance broker.

• People to notify

  Employer, landlord or tenants, clients, close friends who are not family, online communities.

• Dependants and pets

  Who steps in immediately, and where their records and medications are.

7. What are your wishes for accounts and messages?

Decide now so nobody has to guess later.

• Accounts to delete

  List them explicitly; most people want dating, shopping and work-adjacent accounts closed.

• Accounts to memorialise or keep

  A memorialised profile stays visible but locked; decide per platform.

• Photos and files to pass on

  Where they are and who should receive them.

• Content to remove

  Anything you would rather not outlive you: drafts, private albums, specific chats.

• Messages to leave

  Letters, voice notes or videos for specific people; our guide to writing a legacy letter helps with the blank page.

• Online presence

  Whether you want a post made on your behalf, and what happens to your website, newsletter or creator channels.

8. Which platform tools should you set up now?

The big platforms each offer a built-in legacy feature. Each only covers that one company's services, so they complement rather than replace this checklist. Check the vendor's own help page for the current steps.

• Google: Inactive Account Manager

  Choose a period of inactivity, who is notified, and what data they can download; see Gmail after death.

• Apple: Legacy Contact

  Name someone who can request access to your iCloud data with an access key and a death certificate; see iCloud after death.

• Meta: legacy contact and memorialisation

  On Facebook you can name a legacy contact or choose deletion; Instagram accounts can be memorialised on request.

• Password manager emergency access

  Most paid plans let a trusted person request access after a waiting period you set.

• WhatsApp backups

  Chats live on the phone; make sure the backup is enabled and the backup password is recorded.

9. How should you store and deliver the checklist?

A finished checklist helps nobody if it is lost, found too late, or found by the wrong person. Use two layers.

• Printed copy in a sealed envelope

  Kept with your will or in a home safe; tell your executor it exists and where.

• Separate the inventory from the keys

  The list of accounts can be stored with your documents; passwords and recovery codes go in a password manager or a sealed, separately stored sheet.

• A digital dead man's switch

  A dead man's switch holds the sensitive half and releases it only if you stop checking in, so nobody holds live passwords while you are alive.

• Tell two people

  The executor and one backup should both know the checklist exists and how the delivery works.

• Do not use email drafts or shared folders

  They are searchable, synced to places you have forgotten about, and easy for the wrong person to find.

• Date every version

  When two copies disagree, the date decides.

10. How often should you review your digital legacy plan?

• Every six months

  Put a recurring calendar reminder in; check the people, the passcodes and the recovery codes.

• After a new phone or laptop

  Passcodes and authenticator apps change; this is the most common way plans go stale.

• After a move, marriage, divorce or birth

  Recipients, beneficiaries and addresses all shift.

• After changing bank, job or password manager

  Update the inventory and the emergency access setup.

How does PostMortem fit into a digital legacy checklist?

PostMortem is a free iOS and Android app that works as a digital dead man's switch. You put the sensitive half of this checklist into a message box: up to three text messages, login credentials, financial records such as debts and assets, and up to five files (images, PDFs, Office documents, text or audio, 20 MB each). You choose recipients and a check-in interval from one hour to twelve months; reminders arrive by email and push, and you check in with one tap in the app. If you stop, the box is released to your recipients by email.

Messages, passwords, file names, file contents and debt details are encrypted on your phone (AES-256) before upload and decrypted in the recipient's browser. Recipients open the box with the access key card you share with them in advance, so the card is a good thing to put in the sealed envelope from Section 9. Read how it works or the security overview for the full picture.

Frequently asked questions

• What is a digital legacy checklist?

  A written inventory of your online accounts, devices, recovery codes, finances, documents and wishes, together with the names of the people who should handle them. It gives your family a map instead of a locked phone and a guessing game.

• Should I write passwords on the printed checklist?

  Only if the printed copy will be stored as securely as the passwords deserve, such as a home safe or a solicitor's office. A safer pattern is to print the inventory and keep the actual passwords in a password manager with emergency access, or in a dead man's switch.

• Is a digital legacy checklist the same as a digital will?

  No. The checklist is a practical inventory; a digital will or letter of wishes states what you want done with those accounts. Whether such a document is legally binding varies by country and state. This is general information, not legal advice.

• How long does it take to complete?

  Most people get the important 80% done in an hour or two: email, phone passcode, bank inventory, password manager and the names of two people.

• What if my family cannot get into my phone?

  Without the passcode, manufacturers will not unlock a modern phone, and the authenticator app on it is lost with it. That is why the passcode and printed backup codes are on this checklist, and why platform tools like Apple's Legacy Contact and Google's Inactive Account Manager are worth setting up now.

• How do recipients open a box released from PostMortem?

  They receive an email with a link, open it in a browser, and scan or upload the access key card you shared with them in advance. The box decrypts in their browser, and they can download a PDF of the contents plus a ZIP of the files. They do not need the app or an account.