How to share passwords with family in an emergency

Everyone who has thought about this for more than a minute has arrived at the same uncomfortable place. You want somebody to be able to get into your accounts if something happens to you. You do not want them to be able to get in today. Those two wishes pull in opposite directions, and most of the bad answers come from giving up on one of them.

The bad answers are familiar. A shared note on the fridge. A document called passwords.docx in a shared drive. Telling your partner the master password and hoping neither of you ever falls out with anyone. A sticky note under the keyboard, which is funnier in theory than in practice.

Here is what actually works, in rough order of how much effort it takes.

First: stop thinking about passwords, and start thinking about recovery

The instinct is to hand over a list of passwords. That instinct is usually wrong, for a simple reason: the list is out of date the moment you change one, and you will change dozens over the next few years.

What does not go stale is access to the things that regenerate passwords. In practice that means two items:

• Your primary email account. Almost every other account resets through it. Whoever can read your email can recover most of the rest.
• Your phone, or your second factor. A password without the authenticator app is not access, and this is the piece people forget.

If you get those two into the right hands, you have solved perhaps eighty percent of the problem with two items instead of two hundred. Everything else is detail.

Option 1: a password manager’s emergency access

Effort: about ten minutes. Cost: free or near enough.

Most reputable password managers have some version of this. You nominate a trusted contact. If they ever request access, you are notified, and a waiting period begins — often somewhere between a day and a week, and usually one you choose. If you do not decline within that window, they are let in. If you do decline, nothing happens.

That delay is the clever part. It means a person who requests access while you are alive and well gets nothing except a very awkward conversation.

Where it falls short. It covers what is inside the manager. It does not deliver a document, it cannot carry a message explaining what any of it is for, and it does nothing about accounts you never saved there. It also assumes your contact knows the service exists and remembers to use it.

Turn it on anyway. It is the single highest-value ten minutes in this article.

Option 2: a sealed envelope, properly done

Effort: an hour. Cost: nothing.

Paper is not stupid. It cannot be hacked, it needs no battery, and a seventy-year-old relative can use it without help. It has three real problems: it goes stale, it can burn, and anyone who finds it has everything.

If you are going to use paper, do it properly:

• Write the recovery path, not a list of every password: the email account, the phone PIN, where the backup codes are.
• Store it somewhere with a lock and a second person’s name on it. A bank safe deposit box, a solicitor holding it with your will, a fireproof safe your executor knows about.
• Split it if you can. The password in one place, the second factor backup codes in another, so that finding one is not enough.
• Diary a date once a year to check it is still true.

The stale-and-forgotten problem is the one that gets people. An envelope written in 2019 that says “the phone PIN is 4417” is not helpful in 2026.

Option 3: a deadman switch

Effort: fifteen minutes to set up, one minute a month after that.

This is the option that directly resolves the tension the article opened with. You write the message now. It sits encrypted and unread. It goes to one named person only if you stop confirming you are fine.

The mechanics are straightforward. You choose an interval — a week, a month, whatever you can actually keep. Each time you check in, the clock resets to full. If the clock ever reaches zero, your message and any attached files are emailed to the person you named, and the vault is finished.

The properties that matter here:

• Nothing is sent early. Your recipient is not notified when you create it, arm it or edit it. They hear nothing until the day it delivers.
• It carries more than passwords. A written explanation, a scanned document, a letter. Passwords alone are rarely enough; what people need is context.
• The recipient needs nothing. No account, no app, no technical knowledge. It arrives as an email.
• It does not go stale silently. You are back in it every month to check in, which is exactly the moment to notice that something has changed.

Where it falls short. It depends on you remembering to check in. Choose a short interval and you will trigger it by accident on a holiday. We have written at length about choosing an interval you will actually keep, and the short version is: pick the longest one you are comfortable with, not the shortest.

Option 4: the platforms’ own legacy tools

Effort: five minutes each. Cost: free.

Google’s Inactive Account Manager, Apple’s Legacy Contact, Facebook’s legacy contact. Each lets you nominate someone who can reach some of your data after you are gone or after a long period of inactivity.

Set them all up. They are free and official. Just be clear about what they are: each covers one company’s data, and none of them will explain to your sister what any of it means or what you wanted done.

What to do about two factor authentication

This is where most plans quietly fail. You leave a perfect list of passwords, and your executor discovers that every account asks for a six digit code from an app on a phone that is locked, in an evidence bag, or at the bottom of a river.

Three things fix it:

1. Save the backup codes. Every service that offers two factor authentication issues a set of one-time recovery codes when you turn it on. Most people skip past that screen. Do not. Those codes are the emergency route in.
2. Keep them with the plan, not with the phone. A backup code stored on the device that holds the authenticator is not a backup.
3. Include the phone’s own passcode. If your recovery path runs through SMS or an app on the handset, the handset’s PIN is part of the plan.

Whom to tell, and what to say

Pick one person. Not a committee. One person who is organised, who you expect to outlive you, and who is not going to lose the envelope.

Then tell them three things:

1. That something exists.
2. Roughly where it will come from — “you may one day get an automated email from a service called X; it will be from me and it will be real”.
3. Who else to loop in when the time comes.

That third point matters more than it looks. The person who receives the instructions is not always the person who should act on all of it. Say so in the message.

A sane combination

You do not have to choose one. The arrangement that covers the most ground for the least effort is roughly this:

• A password manager, with emergency access turned on, holding the day-to-day logins.
• The platform legacy tools configured for Google and Apple.
• A deadman switch holding the explanation: the recovery path for email and phone, the backup codes, the documents, and a letter saying what you want done and who to call.
• One person told that all of this exists.

That is an evening’s work and it covers nearly every realistic case.

Where we come into it

My Signal Vault is the third item on that list. You write a message, attach files if you need to, name one recipient, and choose how often you will check in. Files are encrypted with AES-256-GCM before they are stored, the recipient hears nothing until it delivers, and everything that happens on your account is written to an audit log only you can read.

The free plan includes one vault and 100MB of encrypted storage, with no card and no expiry — enough for the recovery path, the backup codes and a letter. If you would rather read the mechanics first, the help centre explains it plainly.