What happens to your passwords when you die?

What actually happens to your passwords when you die?

Online services are built to keep everyone but you out. When a family member can't sign in, most platforms will not simply hand over a password. Terms of service usually end your rights to an account at death, and in many countries signing in to someone else's account, even a late relative's, sits in legal grey territory.

Some providers offer a formal process: a death certificate, proof of authority, weeks or months of waiting, often ending with the account closed rather than opened. Add two-factor authentication and a locked phone, and even a cooperative provider may be unable to help.

In practice, your accounts fall into three groups. Some get memorialised or frozen on request. Some get deleted after a period of inactivity, taking their contents with them. Most just carry on: autopay keeps paying and renewals keep charging. None of these outcomes depends on whether anyone knows your password. They depend on whether anyone can act in time.

Why can't they just reset it?

"They can reset it" is the most common assumption, and it fails more often than people expect. Resetting a password needs one of three things: the email address on the account, the phone number on the account, or the answers to recovery questions. Each of those is usually locked behind something else.

• Email is the master key, and it's locked too

  Almost every reset link goes to your main email address. If your family can't open your inbox, they can't reset anything downstream of it, and your email provider will not reset your inbox password for them. One locked email account quietly locks fifty others. Our guide to Gmail after death covers what Google will and won't do.

• Two-factor authentication needs your device

  Even with the right password, a second factor is usually required: a code from an authenticator app on a locked phone, a text to a number the family may have cancelled, or a hardware key. Backup codes help, but only if someone knows where they are. See two-factor authentication backup for how to leave those behind.

• The phone lock is the final wall

  Modern phones are encrypted and tied to a passcode. Without it, the manufacturer cannot open the device, and after too many wrong guesses some phones wipe themselves. A locked phone means no authenticator codes, no text messages, no password manager and no photos that were never backed up.

What do the law and platform terms say about passwords after death?

This is general information, not legal advice. The rules vary by country and, in the US, by state, so check what applies where you live.

Many terms of service say the account is personal, non-transferable and ends at death, while what is inside it, such as photos, documents or money, may still be part of your estate. So an executor can have a legal right to the contents while having no practical way to reach them, and sharing a password in a will does not automatically make it lawful for someone else to log in.

The big platforms all take the same basic position: they will not provide passwords or login details to anyone, including next of kin. What they offer instead is advance-planning tools and a slower, document-heavy process for the bereaved.

Google lets you set up a plan in advance that contacts people you choose and can share selected data with them after a period of inactivity you set; without it, family can ask Google to close the account or release some data, reviewed case by case. Apple lets you name a Legacy Contact who, with an access key you shared and a death certificate, can request your iCloud data, though Keychain passwords, payment details and purchased media are excluded. Facebook lets you name a legacy contact who can manage a memorialised profile but cannot log in or read messages. We cover each in our iCloud after death and Facebook after death guides.

Platforms will help your family tidy up, and sometimes retrieve data, but none of them will hand over the keys. That part you have to arrange yourself.

How do you leave passwords to family? The four ways

There are really only four ways to share passwords after death. Most people end up combining two of them.

• 1. A written list

  A sheet in a safe, a sealed envelope with your solicitor, or a USB stick in a drawer. Pros: free, works without any technology. Cons: it goes stale the first time you change a password, and anyone who finds it can use it immediately. A list is fine for a handful of near-permanent secrets, such as a phone passcode or a master password, as long as it is kept somewhere genuinely secure.

• 2. A password manager's emergency access

  Some password managers (often on paid plans) let you name a trusted contact who can request access to your vault; you get a waiting period to refuse, after which they are let in. Pros: the passwords are always current and the vault includes everything. Cons: your contact needs their own account with the same manager, the request can be made while you are alive and well, and your family still needs to know the manager exists. Other managers offer only a printable recovery kit that you have to store and share yourself.

• 3. Platform legacy tools

  Google's inactive-account plan, Apple's Legacy Contact and Facebook's legacy contact. Official, free and the only route to some data, but each covers one company and none of them shares passwords. Set them up anyway, because they are the right answer for the data they do cover.

• 4. A dead man's switch

  You store the credentials in an encrypted message, confirm you are fine with regular check-ins, and the message is delivered only if you stop responding. Nothing is shared while you are alive, the recipient needs no special software or account, and you can include instructions and context alongside the passwords. It asks something of you in return: keep checking in, pick an interval longer than your longest stretch away from your phone, and update the contents when a password changes. See our comparison of a dead man's switch vs a password manager for which suits which situation.

Which passwords matter most after death?

Your family doesn't need every password you have. A few accounts unlock nearly everything else, so start there. In rough order of importance:

• Your phone passcode

  Verification codes, authenticator apps, saved passwords and un-backed-up photos all live behind it. If you leave only one secret, leave this one.

• Your main email account

  Password resets for almost every other service arrive here. With the inbox and the phone, your family can recover most of what you forgot to list.

• Your password manager's master password

  If you use one, this single secret stands in for hundreds of others. Include the recovery or secret key if your manager issues one.

• Two-factor backup codes

  The printed backup codes for your email, banking and cloud accounts. Without them the passwords above may not be enough.

• Banking, payment and investment logins

  Not so your family can move money without authority, but so they can see what exists, stop autopayments and give the executor a complete picture.

• Crypto wallets and seed phrases

  If you hold any, this is the one category where losing the secret means losing the money outright. See crypto after death.

How PostMortem helps with passwords after death

PostMortem is a free iOS and Android app built around a digital dead man's switch. You create a message box, add login credentials (account plus password), up to three text messages, financial records and up to five file attachments, and choose at least one recipient. Each box has a check-in interval, from one hour to twelve months. You check in with one tap in the app; reminders arrive by email and push as the deadline approaches. If the interval runs out without a check-in, the box is released and your recipients receive an email with a link to open it.

For passwords specifically, a sensible setup is one box for the handful of credentials above, a text message explaining what each one is for, and a PDF of two-factor backup codes attached. If different people should receive different things, use separate boxes with separate recipients.

Credentials, messages, file names and file contents are encrypted on your phone with AES-256 before upload and decrypted only in the recipient's browser; the box name, recipient addresses and check-in schedule stay readable so reminders and delivery work. Your recipient decrypts the box with your access key card, a QR-style image you generate in the app and give them in advance. You hold the only key, which is also what keeps PostMortem out of your data, so give the card to the recipient and keep a copy somewhere safe. You can read the detail on our security page.

Release happens exactly when you set it, after the reminders, so pick an interval that fits how you use your phone. Weekly or monthly suits most people. The app's test box lets you see a release end to end before you trust it with anything real.

Whatever method you pick, the handover is only as good as the day you last updated it. Whenever you change your phone passcode, email password or master password, update the message box the same day, and keep the list short: the fewer secrets it holds, the more likely each one is still correct.

What mistakes do people make with passwords after death?

• Putting passwords in the will

  A will is the wrong place for secrets: in many places it becomes a public document during probate, and it is slow to change. Mention where the passwords are, not what they are.

• Leaving no instructions

  A password without context still leaves your family guessing: which accounts to close, which bills are on autopay, and what should simply be deleted unread. A short note next to each credential is often worth more than the credential itself.

• Never telling the recipient

  A careful handover fails if the person receiving it does not know to expect it or has lost the access key.

Frequently asked questions

• Do passwords expire when someone dies?

  No. Passwords keep working until the account is closed, memorialised or deleted for inactivity. The problem is that nobody else can use them, and the second factor and phone lock usually stand in the way even when the password is known.

• Is it legal to use a dead relative's password?

  It depends on where you live and on the platform's terms, and this is general information rather than legal advice. Many terms say accounts are non-transferable, and unauthorised access laws can apply even to family. When in doubt, use the platform's formal process or ask a lawyer.

• Can my family get my passwords from Google, Apple or Facebook?

  No. All three say they will not provide passwords or login details. Google can close an account or release some data after review, and lets you set up an inactive-account plan in advance. Apple's Legacy Contact can request iCloud data but not Keychain passwords. Facebook's legacy contact can manage a memorialised profile but cannot log in.

• Is a password manager's emergency access enough on its own?

  For many people it is a good core. Its limits are that the contact usually needs an account with the same manager, the feature may be on a paid plan, it only covers what is in the vault, and it does not open your phone. Pair it with a written phone passcode or a dead man's switch that carries the few secrets outside the vault.

• Should I write my passwords in my will?

  Generally no. Wills can become public during probate and are slow to update. Instead, say in the will where your passwords are kept and who should receive them, and keep the secrets themselves in a secure, updatable place.

• What if I forget to check in to a dead man's switch?

  In PostMortem you get email and push reminders at roughly 60%, 70%, 80% and 90% of the interval, and one tap resets every active box. If you ignore all of them and the interval runs out, the box is released exactly as designed, so choose an interval that fits your habits and read our guide on a missed check-in.