How to leave your family your passwords, properly

What your family will need them for

• The phone. Contacts, photos, and the text messages that carry sign-in codes for other accounts.
• The main email. Bills arrive there, and nearly every other account resets its password through it.
• Bills and subscriptions. Utilities, streaming, memberships and anything on autopay, so they can be cancelled or moved.
• Photos and files. The things nobody can replace.
• Everyday accounts. Shopping, travel points, the car, the doctor's portal.

What to write down for each one

1. The site or service, and its web address if it is not obvious
2. The sign-in name, and the email address on the account if that is different
3. The password
4. How the second step works: a text to your phone, an authenticator app, a security key
5. The backup codes the service gave you, if it gave you any
6. Security questions and the answers you actually used
7. What you want done with the account: close it, keep it, hand it over

If you already keep your logins in a browser or a password manager, you do not have to retype them. See how to bring them all across at once.

Where a password is not the answer

Having someone's sign-in is not the same as having the legal right to their account. For email, photos and bills that distinction rarely causes trouble. For money it does.

The money in a bank, brokerage or retirement account belongs to the named beneficiary or to the estate, not to whoever can sign in. Banks, brokers and insurers each have their own process after a death: a death certificate, a claim form, and for some accounts the court's letter naming the executor. Your family should use it. Signing in as you to move money usually breaks the firm's terms, can upset other heirs, and tends to end with the account frozen and questions to answer.

So leave the bank sign-in if you like, so your family can see what is there and download statements. Make the real plan a beneficiary form, which pays the right person without anyone signing in.

Where to keep them

• Not in your will. A will is filed with the court after death and becomes a public record.
• Not on a sheet in a drawer. Anyone who finds it can read it, and it is out of date within months.
• Not in an email to yourself or a note on your phone. Both sit behind the very passwords your family does not have.
• Somewhere sealed that opens only for the right person, at the right time. A password manager with emergency access does this for logins. A sealed envelope service does it for logins and everything else.

If it happens without warning

Whatever you use, test it against a sudden death. Your family will not have your phone, your email or your recovery codes, so the arrangement must open with things that are already theirs. See what a family can actually open.

The sign-ins you would rather nobody used

Some accounts you may not want your family to open at all. Leave those to one trusted person with instructions to close them first, or keep them out of the hand-off entirely. See things you want deleted before anyone looks.

Mind the second step

A password alone often is not enough. Many services send a code to your phone before letting anyone in. That is why the phone passcode belongs at the top of the list, and why your family should keep the phone plan running until the accounts are sorted. See why the phone and the main email come first.

Keep it true

Passwords change. Set a reminder once a year to look through the list, and update an entry whenever you change a password that matters. A stale password costs your family an afternoon. A stale phone passcode can cost them everything behind it.