Two-factor authentication after death: why families get locked out, and how to prevent it

29 October 2026 · 6 min read

Many families do find the password. They open the laptop, find the list in a drawer or the notes app, type it in, and then hit a screen that says "Enter the code we sent to your phone". The phone is locked, or the contract has been cancelled, and the account stays closed. Two-factor authentication protects you from hackers. Without a plan, it protects your accounts from your family too.

Keep two-factor authentication on

This isn't a reason to switch it off. A second step at sign-in stops most account takeovers. The answer is to plan for the second step, not to remove it.

How families get stuck

• Codes sent by text message. The code arrives on a phone your family can't unlock. Or the phone contract is cancelled, and the number eventually goes to someone else. Princeton researchers who looked at 259 recycled phone numbers at two US carriers found that 171 of them, 66%, were still linked to accounts at popular websites.
• Authenticator apps. The codes are generated on the phone itself. Without the phone's passcode, there are no codes.
• Security keys and passkeys, which live on a physical key, a phone or a password manager. If nobody knows where they are, they can't be used.
• "Is this you?" prompts that appear on your other devices: on a phone nobody can unlock.

Five steps that prevent it

1. Save your backup codes. Most services that use two-step verification offer one-time backup or recovery codes. Google, for example, gives you sets of ten 8-digit codes, each of which works once. Print them or store them safely, with a note of which account they belong to.
2. Make your phone reachable. Your phone is the key to most codes, and a modern phone can't be unlocked without its passcode, not even by the manufacturer. Leave the passcode where the right person will find it. Our guide on unlocking a deceased person's iPhone explains why this matters so much.
3. Ask your family not to cancel your phone number straight away. Keeping the line active for a few months gives them time to receive codes and move each account to their own details.
4. Use the official legacy features. Apple's Legacy Contact and Google's Inactive Account Manager give the people you choose access to some of your data without your codes. See our guides to Apple Legacy Contact and Google Inactive Account Manager.
5. Start with your email. Password resets for almost every other account go to your email. Make sure your family can get into that one, and the rest becomes much easier.

Write down how each account is protected

A short list makes all the difference: for each important account, the method you use for the second step (text message, authenticator app, security key) and where the backup codes are. It takes twenty minutes, and it's the part of a password list that most people forget. Our digital estate planning checklist covers the rest.

Where Heritkey fits

We're building Heritkey to keep the whole picture in one place: your passwords, your backup codes, your phone passcode, and a note of how each account is protected. It's all end-to-end encrypted, so nobody can read it while you're alive, not even us. The people you choose can open it after a waiting period you set, and you can refuse any request while you're able to. See how Heritkey works.

Join the waitlist