How to pass on MacBook FileVault, Windows BitLocker, and home NAS encryption keys to your family

7 November 2026 · 6 min read

Years ago, if a family member died and nobody knew their Windows or Mac login password, a local computer repair shop could simply unscrew the bottom of the laptop, pull out the hard drive, plug it into a $15 USB adapter, and copy off all the family photos and tax documents in 10 minutes. On modern laptops, that trick is completely dead.

Why pulling the SSD out of a modern Mac or Windows 11 PC no longer works

Both Apple and Microsoft now encrypt the entire solid-state drive (SSD) at the hardware level by default (see how to access a deceased person's computer):

1. Apple Silicon MacBooks (M1 / M2 / M3 / M4) + FileVault: The SSD chips are soldered directly onto the logic board and encrypted by the Apple Silicon Secure Enclave. If FileVault is enabled and your family neither knows the macOS user password nor has the 24-character FileVault Recovery Key (or Apple ID password with 2FA device access), Apple's own Genius Bar cannot decrypt the drive — even with a court order and death certificate.
2. Windows 11 Automatic BitLocker Device Encryption: Starting with Windows 11 24H2 (and on most Dell, HP, Lenovo, and Surface laptops), Microsoft automatically enables BitLocker full-disk encryption during initial setup. If a grieving spouse tries too many PIN attempts, changes a boot setting, or triggers a Windows security check, the laptop displays a blue screen demanding a 48-digit BitLocker Recovery Key.
3. Encrypted external SSDs, VeraCrypt containers, and Synology/QNAP NAS drives: Tech-savvy parents often keep decades of family photos and financial PDFs on an encrypted Samsung T7/APFS external SSD or a home Synology NAS with encrypted shared folders (.pat / .key files). Without the encryption passphrase, those terabytes of family history are mathematically unrecoverable random noise.

Lock in the $3.99/month early-access price →Or $74.99 once for life. Your heirs never pay. Waitlist members keep the launch price.

Where disk encryption recovery keys hide — and how families get locked out

Read that Synology / QNAP NAS warning twice!

If you run a home NAS (Synology, QNAP, TrueNAS, or Unraid) to store your family's photos and tax documents, here is the trap that destroys data after a tech-savvy spouse dies:

When your spouse can't log into your Synology NAS, they search Google for *"how to reset Synology admin password."* Google tells them to hold a paperclip in the back reset button for 4 seconds. For security reasons, pressing the physical reset button on a Synology NAS automatically unmounts every encrypted shared folder and deletes the auto-mount key! Unless you left the encryption passphrase or .key recovery string in Heritkey, pressing that reset button locks your family out of the encrypted folders forever.

How to find and save your recovery keys in Heritkey in 3 minutes

1. On Windows 11 (BitLocker): Visit account.microsoft.com/devices/recoverykey (or run manage-bde -protectors C: -get in an Administrator Command Prompt) and copy your 48-digit BitLocker Recovery Key (plus the Key ID) into your Heritkey vault.
2. On Mac (FileVault): Record your exact macOS login password (not just Touch ID, which disables after 48 hours or a reboot!) AND your 24-character FileVault Recovery Key in Heritkey.
3. For External SSDs & Home NAS: Record the volume encryption passphrase for every APFS Encrypted / BitLocker To Go / VeraCrypt drive and your Synology/TrueNAS encrypted folder passphrases — along with explicit instructions: *"Do NOT press the physical reset button on the NAS; log in with these credentials instead."*

Everything inside Heritkey is encrypted on your device with AES-256-GCM (how Heritkey works) and released to your loved ones only if your check-in timer expires.

This guide is general information, not legal advice. Laws on wills and digital assets differ between countries and states, so check with a lawyer where you live.