Should you put your passwords in your will?
When people start planning what happens to their online accounts, the will seems like the obvious place for the passwords. Lawyers almost all say the same thing: don't. Here's why, what your will should say about your digital life instead, and where the passwords themselves should live.
Reason 1: a will can become public
A will is private while you're alive, but that can change after your death:
- England and Wales: once probate is granted, the will becomes part of the probate record. Anyone can order a copy online through the government's probate search service, for £16.
- United States: a will filed with the probate court generally becomes a public court record, although the rules and timing vary by state.
Anything written in the will, passwords included, could be read by people you'd never have chosen.
Reason 2: passwords change, wills don't
You'll probably change dozens of passwords before your will is ever read. Updating a will means a new will or a formal amendment, signed and witnessed. Passwords written into a will are almost certainly out of date by the time anyone needs them.
Reason 3: the will is read too late
Your family may need access within days: to find documents, stop subscriptions or let people know what has happened. A will is often read after the funeral, and probate can take months.
Reason 4: a password isn't permission
Logging in as someone else can break a service's terms, even with the right password. In most US states, a law called the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA) sets out who can access a person's accounts after death, in a clear order of priority:
- Settings you made with a company's own tool, such as Google's Inactive Account Manager or Facebook's legacy contact, come first.
- Instructions in your will or another document come next.
- The service's terms of service apply if you left no instructions.
In other words, a setting you chose in an app can override what your will says. Make sure the two agree.
What your will can say instead
- Who should deal with your digital accounts, usually your executor, perhaps with help from someone you trust with technology.
- Consent to access the content of your accounts, such as emails and messages. Under RUFADAA, an executor generally can't see the content of your messages without it.
- What you want done with each type of account: keep, download, memorialize or close.
- Where your instructions and passwords are kept, without including the passwords themselves.
Where to keep the passwords
- A password manager with emergency access. Some, like Bitwarden, let a trusted person request access; if you don't refuse within a waiting period you set, they're let in.
- The platforms' own tools: Apple Legacy Contact, Google Inactive Account Manager and Facebook's legacy contact.
- A letter of wishes kept with your will by your lawyer. It isn't made public, but it's only as current as the last time you rewrote it.
- An encrypted vault designed to be handed over, which the people you choose can open only when it's needed.
Whatever you choose, think about two-factor authentication too: if the codes go to your phone, someone needs a way to unlock it, or a set of backup codes.
A simple plan
- List your important accounts and what should happen to each.
- Set up the platform tools for Apple and Google.
- Keep passwords in a password manager or encrypted vault with emergency access.
- Ask your lawyer to add a digital assets clause to your will, including consent to access your messages.
- Review everything once a year.
Our digital estate planning checklist walks through it step by step.
This guide is general information, not legal advice. Laws on wills and digital assets differ between countries and states, so check with a lawyer where you live.