When someone dies, their family typically inherits their possessions and cannot reach their accounts. Photos, email, business systems, subscriptions, cryptocurrency — all technically theirs, all behind authentication designed specifically to keep out anyone who isn't the account holder.
This isn't a failure of the providers. It's the security working. But the result is that families lose decades of photographs, businesses become unrunnable, and subscriptions bill a dead person's card for years.
An hour of setup prevents most of it.
Why it's harder than it should be
Terms of service usually make accounts non-transferable. You have a licence to use the service, not an asset that passes to your estate.
Sharing passwords may violate those terms, even with the account holder's consent. In practice this is widely ignored and rarely enforced, but it's why providers can't simply hand over credentials.
Two-factor authentication blocks recovery. Even someone with the password can't get in without the phone.
Provider processes vary enormously. Some have well-defined legacy programmes. Some require a court order. Some will only delete the account, not provide access.
Executors frequently don't know the accounts exist. You can't request access to something you've never heard of.
Some content genuinely can't be inherited. Purchased media licences typically end with the licensee.
The built-in tools, and using them
Several major platforms have legacy features. Set these up — they're the cleanest route because they're designed for the purpose and don't require anyone to violate any terms.
Apple offers a Legacy Contact: you nominate someone, they receive an access key, and after providing a death certificate they can access much of the account's data.
Google offers Inactive Account Manager: after a period of inactivity you specify, it can notify chosen contacts and share selected data, or delete the account.
Facebook and Instagram offer a legacy contact who can memorialize the account, and an option to have it deleted instead.
Password managers typically offer emergency access: a trusted person requests access, and if you don't decline within a set period, they receive it.
Set up the password manager one first. It's the master key, and it makes everything else reachable.
These take about ten minutes each and they're the single most effective thing in this article.
The document your executor actually needs
Beyond the built-in tools, someone needs a map. Not passwords in a document — a description of what exists and how to reach it.
Create Digital Estate Instructions, and keep it with your will or your important documents:
DIGITAL ESTATE — [Your name] — updated 2025-04-08
THE MASTER KEY
My password manager is [name]. Emergency access is set up for
[person]. They can request access and will receive it after 7 days.
Everything else is reachable from there.
The master password is also in a sealed envelope at [location].
WHAT EXISTS AND WHY IT MATTERS
Email: [provider] — the main account, resets everything else
Photos: [service] — ~30 years, most important thing here
Cloud storage: [service] — documents, financial records
Business: [platform names] — the shop, the site, the customer list
Domain: registered with [registrar], renews [month] — MUST NOT LAPSE
Financial: [bank, investment platforms] — details with the will
Subscriptions: list in the password manager under "Subscriptions"
WHAT I'D LIKE DONE
Photos: download everything, give copies to [names], keep the family archive
Email: don't publish it. Look for anything needed for the estate, then close.
Social: [memorialize / delete]
Business: [sell it / wind it down] — see notes in [location]
Blog: keep it online if hosting is cheap, otherwise archive and take down
WHAT TO CANCEL PROMPTLY
Anything billing monthly — the list is in the password manager
WHO KNOWS THIS SYSTEM
[Name] can help — they know how the business runs
[Name] has a copy of these instructionsThe "what I'd like done" section matters more than people expect. Families face these decisions while grieving, and guessing what someone would have wanted about their email archive or their social profiles is genuinely painful. Saying so removes the burden.
Where to store the credentials
Don't put passwords in your will. Wills can become public documents in probate, and they're not updated often enough to stay accurate.
Do use the password manager's emergency access. Cleanest route.
And a physical fallback: the master password and recovery kit, in a sealed envelope, in a safe or with your solicitor. Tell your executor where it is.
Reference it in the will without including it: "Instructions regarding my digital accounts are kept with [my solicitor / in the safe at my home]."
The physical copy matters because emergency access depends on a company continuing to exist and continuing to operate that feature.
The categories people forget
Cryptocurrency. If nobody has the keys or the seed phrase, the assets are permanently and irretrievably gone. There is no recovery process, no support line, no court order that helps. Cryptocurrency without a documented recovery path is money that ceases to exist. If you hold any, this needs specific, explicit planning.
Two-factor devices. Your executor needs the phone, or the recovery codes, or a registered hardware key. Without one of these, the password alone is often useless. Store recovery codes with the physical envelope.
Domain names. They expire. A domain that lapses during probate can be registered by someone else, and if it was a business domain, that ends the business's email and website simultaneously.
Business systems. Who can run the shop, access the customer list, issue refunds, file the accounts? If the answer is only you, the business stops the day you do.
Recurring payments. Subscriptions bill a dead person's card until the card is cancelled or the account is closed. A list makes this a half-hour job instead of a year of discoveries.
Photos on phones. The single most emotionally valuable thing in most estates, and it's behind a device passcode that nobody else knows.
Files that only exist in the cloud. If your storage is only reachable through your account, the family may lose everything in it.
Loyalty points and account balances. Often transferable on request, and only if someone knows they exist.
For a business specifically
If a business depends on you, the digital estate document isn't sufficient. You need:
A second administrator on every critical platform — hosting, domain, shop, payment processor, email. Not a shared login: their own account with their own access.
Documented systems. How the business runs, where things are, who the suppliers and clients are. This overlaps entirely with documenting systems before hiring, and the same document serves both purposes.
A named person who could step in, and who knows they've been named.
Bank and payment processor arrangements that don't collapse when the sole signatory dies. This one needs professional advice.
If your business would be worth something to your family, this planning is what makes that value realizable. A business nobody can log into is worth its assets, not its earnings.
What your family should do, in order
Worth including in the document, because it's not obvious:
- Don't try to guess passwords. Repeated failures can lock accounts.
- Find the password manager emergency access, or the physical envelope.
- Secure the phone. Don't reset it — it's often the key to everything else via two-factor.
- Get certified copies of the death certificate. Every provider will want one.
- Prioritize: anything financial, anything billing, anything with a deadline like a domain renewal.
- Download before closing. Once an account is closed, the data goes. Export photos, email, and files first.
- Then close accounts, one at a time, keeping records.
- Get professional advice for anything financial or business-related.
Do this today
Ten minutes:
- Set up emergency access on your password manager.
- Set a legacy contact on your main platform account.
- Write the document above, even roughly.
- Tell one person it exists and where to find it.
Then review it once a year — the same annual security checkup is the natural time.
The reason to do it now rather than at a sensible age is that the accounts already exist and already hold everything. The planning isn't about mortality; it's about the fact that a decade of photographs currently sits behind a password nobody else knows.
Provider legacy programmes, and the law governing digital assets in estates, vary significantly by country and change. Consult a solicitor when making formal arrangements, particularly for business assets and cryptocurrency.
Next in this series: How to Protect Your Files From Accidental Deletion