How to pass on your passwords to your family

Because today, almost everything goes through an account: your bank, your taxes, your health insurance, your bills, your family photos. When someone dies or can no longer act for themselves (an accident, a long stay in hospital), their loved ones very quickly run into three obstacles:

• •The phone passcode. A locked smartphone is designed to be inaccessible, even to its manufacturer. Yet it is the phone that receives login codes by text message.
• •Two factor authentication. Even with the right password, you often need a code sent to the phone or to an app.
• •Not knowing what exists. Relatives do not know which accounts and subscriptions exist, or where to look.

Online services never hand over a deceased person's password: at best they offer to close the account or give partial access (see What Happens to Online Accounts After Death?). What you prepare yourself is therefore the only complete solution.

The most common methods are also the riskiest:

• •A "passwords" file on your computer or in the cloud: if it is stolen or hacked, everything is exposed at once.
• •A note on your phone: inaccessible if the phone is locked, readable by anyone if it is not.
• •An email to yourself or to a relative: your inbox becomes a target, and the email can sit for years in a poorly protected mailbox.
• •Giving someone all your codes today: this exposes that person, and you, to a mistake or a temptation, and the codes will be out of date within a few months anyway.
• •An unprotected notebook: useful for people who are not comfortable with technology, as long as it is kept somewhere safe and someone knows where it is.

The right principle: a single secret to pass on, well protected, which unlocks everything else at the right moment.

Yes, for most people. A password manager (Bitwarden, 1Password, or the one built into your phone or browser) keeps all your passwords encrypted behind a single master password. You then only need to pass on access to that vault, rather than dozens of codes. Several password managers offer a feature designed for exactly this:

• •Bitwarden offers Emergency Access (on its paid plans): you choose a trusted contact and a waiting period. If that contact requests access and you do not refuse before the waiting period ends, they get read access to your vault or can take it over.
• •1Password provides an Emergency Kit: a document to print out that contains the sign in address and the account's Secret Key, with a space to write down the master password. Kept in a sealed envelope somewhere safe, it lets a loved one open the vault.
• •Apple's Keychain is not passed on to Apple Legacy Contacts, so you need another way to hand over those passwords.

Whichever tool you use, test the procedure with the person concerned, and write down somewhere which password manager you use: your loved ones need to know it exists.

These are the keys that open all the others. Remember to pass on, using the same method as for your password manager:

• •The unlock code for your phone and the password for your computer;
• •The recovery codes for two factor authentication (most services provide a list you can print);
• •The location of a physical security key, if you use one;
• •Your main phone number: if the line is cancelled too soon after a death, codes sent by text message will no longer arrive. Advise your loved ones not to cancel the line until they have closed or recovered the important accounts.

One word of caution: when it comes to the bank, your loved ones must not use your login details to carry out transactions after your death. Bank accounts are settled with the bank and the notary. Access details are mainly useful for finding information, photos and contracts.

It is possible, in a sealed envelope, and some people do this for the master password of their password manager. It is a good solution for a single secret that rarely changes. It works much less well for a list of codes, which will quickly go out of date and which the notary is not there to keep updated.

The most robust combination is often:

• •an up to date password manager;
• •its recovery kit or master password in a sealed envelope, either at home in a known place or with the notary;
• •emergency access enabled for a trusted person, if your password manager offers it;
• •clear directions, for your loved ones, about where all this can be found.

A five step method:

• •1. List your important accounts: bank, taxes, health, insurance, phone provider, email, photos, social networks, subscriptions.
• •2. Store their login details in a password manager and turn on two factor authentication with recovery codes.
• •3. Set up a single backup way in: the manager's emergency access, or its recovery kit in a sealed envelope.
• •4. Configure the platforms' own tools: Facebook and Apple legacy contacts, Google Inactive Account Manager.
• •5. Tell your loved ones where to look, without giving them the codes today.

The fifth step is the one people forget. The practical file in Laterly is made for it: you note which password manager you use, where the envelope is, who has emergency access, as well as your papers, your notary and the contracts to cancel. It is encrypted and only passed on if you stop responding. However, never write a password or a bank PIN in it: Laterly explicitly asks you not to, because a backup way in should never depend on a single service. The practical file is included in the free plan (see pricing), together with a trusted person who confirms the situation before anything is sent.