What Happens to Your Passwords and Online Accounts When You Die

Most of us have dozens of online accounts: email, photos, cloud storage, social media, banking. Many people assume that if their family knows the passwords, everything will be fine. It is more complicated than that.

When someone dies, two sets of rules decide who gets in. The first is state law. The second is each company's terms of service and the settings the account holder chose (or didn't) while alive. Knowing how they fit together can save your family months of letters to customer support.

Here is how it works in the US, and what you can do this week.

Why your family can't just use your password

The account usually isn't yours to hand over. When you sign up for a service, you agree to its terms of service. Those terms typically make the account personal to you. The state laws on digital assets add that an executor's authority "may not be used to impersonate the user."

Federal privacy law limits what companies can share. The Stored Communications Act generally stops email and cloud providers from disclosing the contents of your communications. One exception is "the lawful consent" of the sender or recipient, which is why your written consent matters so much.

Logging in as someone else can raise legal questions. The federal Computer Fraud and Abuse Act makes it a crime to access a computer "without authorization." Whether an heir using a password counts is not clear cut. It is a gray area worth avoiding, and an attorney is the right person to ask.

There are practical problems too. Two-factor codes go to a phone that may be locked, and Apple says a Legacy Contact can't see passwords stored in iCloud Keychain at all.

The law most states follow: RUFADAA

The Uniform Law Commission wrote a model law to sort this out: the Revised Uniform Fiduciary Access to Digital Assets Act of 2015, or RUFADAA. It only becomes law when a state passes it, and states can change the wording.

By our count, using state legislature records and a published state survey, 47 states plus Washington, D.C. have adopted a version of it. Oklahoma was one of the most recent, in 2024. The exceptions: Massachusetts has a bill that has not yet passed, while Delaware and Louisiana have their own, different laws.

RUFADAA sets a three-tier order of priority:

1. The company's online tool comes first. If a service lets you name who can access your account after death, and you used it, that choice generally wins, even over your will.
2. Your will, trust or power of attorney comes next. Without an online tool, your estate documents can allow or forbid disclosure to your executor or agent.
3. The terms of service apply if you did neither. With no direction from you, the company's own rules decide.

The law also draws a line between the content of your messages and everything else. An executor can usually get a list of who you emailed and when (a "catalog"). Reading the actual messages generally requires your consent or a court order.

The takeaway: your account settings may matter more than your will, and if you want your executor to read your email, your documents should say so clearly.

What the major platforms offer

Apple: Legacy Contact. You can name one or more Legacy Contacts in Settings, under your name, then Sign-In & Security. After your death, they request access with the access key you generated plus your death certificate. They can see data like photos, messages, notes, files and backups, but not purchased media or iCloud Keychain passwords and passkeys.

Google: Inactive Account Manager. You choose how long Google should wait after your account goes quiet. Then it can notify up to 10 people and share the data you picked with each. Without a plan, Google may delete an account inactive for at least two years.

Facebook: legacy contact or delete after death. You can choose a legacy contact to look after your memorialized profile, or have your account deleted after death. A legacy contact can write a pinned post, change profile and cover photos, request removal, and download what you shared if you allowed it. They can't log in or read your messages.

Instagram: memorialization. No one can log into a memorialized Instagram profile, and without a legacy contact it can't be changed. You can choose Delete After Death instead.

Microsoft: OneDrive Digital legacy. You give a trusted contact a code. After your death they enter it, wait 72 hours, and get read-only access to your OneDrive. Without it, Microsoft generally needs a subpoena or court order to consider releasing contents, with no guarantee.

X: deactivation only. X will deactivate an account for an estate representative or verified immediate family member, with ID and a death certificate. It says it is "unable to provide account access to anyone regardless of their relationship to the deceased."

Password managers. Bitwarden's Emergency Access (premium plans) lets trusted contacts request view or takeover access, granted if you don't reject it within a waiting period you set. 1Password suggests printing your Emergency Kit and giving a copy to someone you trust, "like your spouse or someone in your will."

Banks. Money usually moves through the estate and how accounts are titled, not through logins. A joint account may pass to the surviving owner, depending on how it was set up. Ask your bank how your accounts are titled.

What to do this week

Pick a quiet half hour.

• Turn on the tools you already have. Add an Apple Legacy Contact, set up Google Inactive Account Manager, and pick a Facebook legacy contact. Keep access keys where your family can find them.
• Decide what you want, account by account. Some accounts should be kept and shared. Some should be memorialized. Some should simply be closed.
• Write an account list, not a password list. Note which accounts exist and where the important details are kept. Don't put passwords in your will.
• Ask your attorney about digital assets. Ask whether your will and power of attorney give your executor authority over digital assets, including the content of your messages, under your state's law.
• Tell someone. The best plan in the world doesn't help if nobody knows it exists.

A note for readers outside the US

This post covers US law. Other countries, including the UK, have their own rules, so check where you live. Nothing in this post is legal, tax or financial advice.

Where SaveMySecrets fits (and where it doesn't yet)

We're building SaveMySecrets for the part no single platform covers: the notes, instructions and messages that tie everything together. You store them in a vault that's encrypted on your own device, and you name the people who should receive it. If you stop responding to regular check-ins, and after a final check, those people go through a verification process before anything opens.

We're in alpha, and we mean it. Please don't store passwords to important accounts or anything else mission critical with us yet, and keep your usual backups. If you'd like to try it with something low-stakes, such as a list of which accounts exist and where the paperwork is kept, it's free during the alpha. You can create a vault at savemysecrets.com. Whatever you use, turn on the tools, write down your wishes, and tell someone where to look.

Sources

1. Uniform Law Commission, Fiduciary Access to Digital Assets Act, Revised (2015): https://www.uniformlaws.org/committees/community-home?CommunityKey=f7237fc4-74c2-4728-81c6-b39a91ecdf22
2. Minnesota Statutes ch. 521A (an enacted version of RUFADAA), sections on user direction (521A.04), content and catalog disclosure (521A.07, 521A.08), and fiduciary authority (521A.15): https://www.revisor.mn.gov/statutes/cite/521A
3. Oklahoma HB 3778 (2024), Revised Uniform Fiduciary Access to Digital Assets Act, approved April 23, 2024: https://oklegislature.gov/BillInfo.aspx?Bill=HB3778&Session=2400
4. Massachusetts Legislature, Bill H.4639 (194th General Court), bill history: https://malegislature.gov/Bills/194/H4639
5. Delaware Code, Title 12, Chapter 50, Fiduciary Access to Digital Assets and Digital Accounts Act: https://delcode.delaware.gov/title12/c050/index.html
6. Louisiana Code of Civil Procedure Art. 3191: https://www.legis.la.gov/legis/Law.aspx?d=111641
7. Family Estate Guide, "Digital Asset Laws by State" (statuses checked Oct 14, 2026), used for the state count: https://familyestateguide.com/estate-planning-data/digital-assets-estate-laws-by-state/
8. 18 U.S. Code § 2702 (Stored Communications Act, voluntary disclosure), via Cornell LII: https://www.law.cornell.edu/uscode/text/18/2702
9. 18 U.S. Code § 1030 (Computer Fraud and Abuse Act), via Cornell LII: https://www.law.cornell.edu/uscode/text/18/1030
10. Apple Support, "How to add a Legacy Contact for your Apple Account": https://support.apple.com/en-us/102631
11. Google Account Help, "About Inactive Account Manager": https://support.google.com/accounts/answer/3036546
12. Facebook Help Center, "About legacy contacts on Facebook": https://www.facebook.com/help/1568013990080948
13. Facebook Help Center, "What happens to your Facebook profile if you pass away": https://www.facebook.com/help/103897939701143
14. Instagram Help Center, "About memorialized Instagram profiles": https://help.instagram.com/231764660354188
15. Microsoft Support, "Preserve your digital legacy with OneDrive": https://support.microsoft.com/en-us/onedrive/preserve-your-digital-legacy-with-onedrive
16. Microsoft Support, "Accessing Outlook.com, OneDrive and other Microsoft services when someone has died": https://support.microsoft.com/en-us/accounts-billing/manage/accessing-outlook-com-onedrive-and-other-microsoft-services-when-someone-has-died
17. X Help Center, "How to contact X about a deceased family member's account": https://help.x.com/en/rules-and-policies/contact-x-about-a-deceased-family-members-account
18. Bitwarden Help, "About Emergency Access": https://bitwarden.com/help/emergency-access/
19. 1Password Support, "Get to know your Emergency Kit": https://support.1password.com/emergency-kit/
20. Consumer Financial Protection Bureau, "What happens if I have a joint bank account with someone who died?": https://www.consumerfinance.gov/ask-cfpb/what-happens-if-i-have-a-joint-bank-account-with-someone-who-died-en-1101/

More from the blog: The Lost Bitcoin Fortunes Nobody Can Open