The Password Problem Nobody Puts in Their Will

Relative Ease News · October 12, 2026

Picture a household that runs the way most households run. One person handles the money: the bank logins, the investment accounts, the bills on autopay. The family photos live in that person's cloud account. That email address is the reset button for everything else — every recovery link lands in that one inbox. Two-factor codes go to that person's phone.

Now picture that person in a hospital, or gone. The family knows the money exists. Statements still arrive in the mail. What the family cannot do is get in. This isn't a specific family's story — it's a generic example, but estate attorneys and banks recognize it instantly, because some version plays out constantly. Modern wealth isn't locked in a vault. It's locked behind credentials that die with the only person who knew them.

The lockout has layers

First, ignorance: survivors can't access accounts they've never heard of. A crypto wallet, a side-business payment account, a photo archive from three phones ago — if it isn't written down somewhere, it may as well not exist. Self-custodied cryptocurrency is the extreme case: no bank to call, no password reset. If the recovery phrase exists only in the owner's head, the assets are effectively gone, permanently, with real money inside.

The second layer is authentication itself: even a known password may not be enough when the confirmation code goes to a phone that's locked, lost, or disconnected — and the security questions were answered a decade ago by someone no longer available to answer follow-ups.

The third layer is legal: even a spouse with the password in hand may not have the legal right to use it. Account terms of service typically make accounts non-transferable, and federal law — the Stored Communications Act — restricts when companies can hand over the contents of someone's electronic communications. Love and a login are not the same as authority.

The law caught up — mostly

State legislatures have spent a decade fixing that third layer. The Uniform Law Commission finalized the Revised Uniform Fiduciary Access to Digital Assets Act — RUFADAA — in 2015, and it has since been enacted in 46 states. It gives executors, trustees, guardians, and agents under a power of attorney a legal path to manage a person's digital property: files, web domains, virtual currency.

But RUFADAA is more privacy-conscious than families expect. It draws a line between managing assets and reading communications. An executor can generally deal with digital property, but the content of emails, texts, and social media stays off-limits unless the owner expressly consented — in a will, trust, power of attorney, or the provider's own online tool. And there's a hierarchy: a designation in a provider's built-in tool outranks your will, which outranks the terms of service. A sentence in your will saying "my executor gets everything" may not open your inbox.

The tools exist. Almost nobody turns them on.

The three platforms that anchor most people's digital lives each let you name your person in advance, in minutes.

Google's Inactive Account Manager lets you choose an inactivity period — 3, 6, 12, or 18 months — after which Google notifies up to ten people you name and shares the data you select: Gmail, Photos, Drive. Without it, your family faces a far narrower process, often needing a court order for content.

Apple's Legacy Contact generates an access key that you give to a trusted person. After your death, that person presents the key along with a death certificate to access your iCloud data — photos, messages, files. No key, no access; Apple is firm about it, which is why the key belongs with your estate documents.

Facebook's legacy contact can manage your profile once it's memorialized: pin a post, respond to friend requests, update your photos. They can't log in as you or read your messages. You can also choose to have the account deleted after your death — but only in advance.

None of these tools hands over passwords or unlocks your bank. Each covers one company's garden; everything else — utilities, insurers, subscriptions quietly renewing — still needs a plan.

The sticky-note solution is a security hole

The instinctive fix is to write the passwords down: a notebook in a desk drawer, a spreadsheet named something discreet, a list in an email draft. Consider what that list actually is. It's a single, unencrypted key to a person's entire financial life — readable by anyone who finds it, impossible to revoke, and silently going stale every time a password changes. The most sensitive document in the house shouldn't be the least protected one.

The safer pattern is boring, which is usually a good sign. Keep credentials in a reputable password manager with a strong master password. Record the master password, access keys, and recovery codes in one secured place your named person can reach, alongside the account inventory. Say in your will or trust, explicitly, that your fiduciary may access the content of your electronic communications, so RUFADAA's consent line is satisfied. Then turn on the three legacy tools above — an evening's work in total.

Nobody puts "my family can get into my email" in a will because it doesn't sound like an asset. It is one. The accounts are where the money, the photos, and the reset buttons live — and access, arranged in advance, is the difference between an estate that settles and one that stalls at a login screen.

Sources