What is a dead man’s switch, and do you need one?

A dead man’s switch is a device that does something when the person operating it lets go. Train drivers have had them since the nineteenth century: the driver holds a lever, and if they release it — because they have fallen ill, or worse — the brakes come on by themselves. The switch does not detect danger. It has no opinion about the driver’s health. It detects one thing only: the absence of a hand.

Every digital version of the idea works the same way. Something is set to happen. You keep postponing it. If you stop postponing it, it happens.

How the digital version works, step by step

Strip away the branding and every implementation has the same four parts.

1. A payload. A message, some files, or both. The thing that gets sent.
2. A recipient. One person, or several, who receive it.
3. An interval. How often you have to confirm you are fine. An hour, a week, a month.
4. A check in. A button. Pressing it sets the clock back to full.

You arm it, and a countdown starts. Every check in resets the countdown. If the countdown ever reaches zero, the payload is delivered and the switch is spent.

That is the whole mechanism. There is no judgement in it, no attempt to work out whether you are actually in trouble, and no human deciding whether today is the day. The only question it ever asks is whether you checked in before the deadline.

What a good one adds

Beyond the four parts, the differences between a well-built switch and a crude one come down to a handful of things:

• Warnings before it fires. A switch that delivers without warning you first is badly designed. Ours sends reminders at 75 and 90 percent of the interval, by email and by push notification, so a busy fortnight does not become an accidental delivery.
• A pause. You are going somewhere with no signal. You should be able to stop the clock rather than gamble on finding reception.
• Encryption at rest. The payload sits on somebody’s server for months or years before it is needed. It should not sit there in plain text.
• A log. You should be able to see every check in, every change and every sign in, so that if something looks wrong you can tell.
• Silence until it fires. The recipient should not be told it exists. Nothing should reach them until the day it delivers.

Who actually uses one

The stereotype is the whistleblower with an insurance file. That does happen, but it is a tiny fraction of real use. The people who set these up are, overwhelmingly, ordinary people solving an ordinary problem: there is something only they know, and no sensible way to hand it over in advance.

The practical estate

By far the most common case. Passwords, the phone PIN, where the documents are, which accounts exist, who to call, what to do with the business. It is not a will and does not try to be — it is the instruction sheet that makes a will possible to act on. See what actually happens to accounts when nobody has made arrangements.

People who live alone

A switch with a three or seven day timer, sending “something is wrong, please check on me” to a friend, is a quiet answer to a real fear. It costs one button press a week and it means somebody would notice.

People who travel or work somewhere risky

Solo hikers, sailors, people working in difficult places, people with a medical condition that could go wrong quickly. Often armed for a specific window and paused again on return.

Journalists, researchers and people with something to protect

Here the switch is not about death, it is about disappearance. Material held by one person and released automatically if that person goes quiet. This is the dramatic case and it is real, but it is not the common one.

The letter

Sometimes the payload is not data at all. It is a letter that was never going to be sent while the writer could still speak.

When a dead man’s switch is the wrong tool

An honest article has to include this section.

It is not an emergency service. If your timer is seven days and something happens on day one, nothing is sent for six more days. If you need someone alerted in minutes, you need a person with your phone number, or a medical alert device, not this.

It is not a will. Delivering instructions to a named person confers no legal authority on them. Use it to make a will easy to act on, not to replace one.

It is not a substitute for telling people things. If you can have the conversation now, have it now. A switch is for what cannot be said in advance, not for what you would rather avoid saying.

It does not suit an unstructured life, at short intervals. A one-day timer is a promise to press a button every day for the rest of your life, including the day the phone dies and the weekend with no signal.

The thing everyone gets wrong: the interval

If you take one practical point from this article, take this one.

The interval is not a measure of how urgent your secret is. It is a measure of how reliably you can press a button. People set a short timer because the contents feel important, and then they trigger it by accident within a month, on an ordinary Tuesday, to a recipient who has no idea what is going on.

The rule that works: take the longest realistic stretch you might go without reliable internet — a flight, a hospital stay, a camping trip, a genuinely awful week — and double it. That is your minimum safe interval.

For the classic estate case, thirty days is right. Nothing about “here is how to reach my accounts” becomes useless because it arrives three weeks later, and a monthly check in is a habit you can keep for years. Run a second, shorter vault if you also want someone alerted quickly. There is no rule that everything lives on one timer, and this is covered properly in the help centre.

What about the obvious objections?

“What if the service disappears?”

A fair question and you should ask it of any provider. The mitigation is not to trust a promise; it is not to make any single arrangement the only one. Keep a paper copy of the critical recovery path somewhere safe as well. A deadman switch should be the thing that delivers your plan reliably, not the only place your plan exists.

“What if it fires by accident?”

Then a letter arrives early, and you make an awkward phone call. This is why warnings, pausing and a sensible interval matter, and why the shortest interval on a serious vault should be measured in weeks rather than hours.

“Can the provider read it?”

Ask. And be suspicious of a service that answers this too smoothly. Any switch that can email an attachment to someone with no account and no key must be able to decrypt on your behalf, which means the honest answer is never “nobody could ever read this”. Ours is that files are encrypted with AES-256-GCM and the keys are themselves encrypted, which defeats every realistic attack on data at rest — a stolen bucket, a leaked backup, a compromised host — but decryption happens on our server at the moment of delivery. If you need a stronger guarantee than that, encrypt the file yourself before uploading it and give your recipient the passphrase another way. We set out the whole position in how your files are encrypted.

Setting one up, realistically

Fifteen minutes, once, and then a minute a month.

1. Decide who receives it. One person. Check the address character by character; a typo here is invisible until the day it matters.
2. Write the message to someone who has no idea this service exists. Two lines of context at the top saves a great deal of confusion.
3. Attach anything that needs to go with it.
4. Choose an interval you can keep on your worst week, not your best one.
5. Arm it.
6. Put a recurring reminder in your own calendar. This is the step everyone skips and it is the one that makes it work for years.
7. Tell the recipient it exists.

In short

A dead man’s switch is a simple idea with a grim name and a mundane, useful purpose: it makes sure something gets said if you are not there to say it. Most people who use one are not protecting a secret. They are sparing somebody six months of phone calls.

My Signal Vault is a dead man’s switch with encrypted file storage attached. The free plan gives you one vault, 100MB of encrypted storage and the full audit log, with no card and no expiry. If you would rather understand the mechanism first, the help centre covers all of it, and our guide to choosing a service lists the questions worth asking of anyone, including us.