How to Organise Your Passwords and Accounts So They Survive You
You cannot bequeath the unknown, so the inventory is the estate — and the security rules that keep attackers out are the same rules that lock your executor out, which is a tension to bridge, not a rule to break. This page is the succession counterpart to the password-manager guide: it assumes the security discipline is correct and asks what to do when that very correctness becomes the obstacle. Here is the category sweep, the two-sided tension scale, the newspaper test, and the emergency-access-versus-written-list compare.
The Counterpart
The Security Guide Was Right, and That Is the Problem
Our password-manager guide teaches the correct discipline: unique passwords per account, two-factor authentication, a strong master password, and — the rule that matters most here — never share the secret. Every one of those rules is right, and together they build a perimeter that is excellent at keeping attackers out and, in exactly the same motion, excellent at keeping your executor out the day you cannot open the door yourself. The person who followed our advice perfectly has, by following it perfectly, created a succession problem the advice did not solve.
This page is not a correction to that advice and not a reason to weaken it. It is the succession counterpart: the work you do on top of a locked perimeter so that a designated person has a way to knock without you handing the master key to anyone who might read it over your shoulder. The framing to hold is that security and survivability are not opposites to trade off — they are two goals that a bridge satisfies, and the bridge is the inventory plus a break-glass path, not a weaker password or a shared secret. Read the password-manager guide first if you have not; this page assumes its rules are in place and asks what survives them.
The Inventory
You Cannot Bequeath the Unknown, So the List Is the Estate
The single highest-leverage move in a digital estate is not a clever access mechanism at all — it is a complete list of what exists. Most digital estates fail not because the access plan was wrong but because the executor never knew the account existed: the crypto wallet, the old cloud drive with the photographs, the subscription nobody mentioned, the domain that renews silently. An access plan for an account nobody knows about is a key to a door nobody can find. So the real work is the sweep, and everything else on this page depends on it.
Sweep these categories and write down, for each thing you find, what it is, where it lives, and which door it needs (a platform legacy contact, the executor's authority, or the break-glass). The categories marked hot are the ones most often forgotten and most costly to miss.
The email category is hot for a structural reason the closing-after-death guide makes concrete: email is frequently the reset hub, the account that receives the password-reset links for everything else, so a missing email access can cascade into a missing estate. The password manager is hot because it is the vault the break-glass protects. Finance, subscriptions, and crypto are hot because they are the ones with money attached and the ones most often unmentioned.
The sweep's discipline is that it is a map, not a secret. For each entry you record the name, the provider, the username or identifier, and which door opens it — and you record where the password lives ("in the manager," "in the strongbox break-glass," "with the provider's deceased-account process") without recording the password itself. That separation is what makes the map safe to store somewhere findable, and it is the bridge to the newspaper test below. The inventory is the raw material the other two pages in this cluster consume: the legacy-contact guide points a designated person at it, and the closing-after-death guide starts an executor from it. You cannot bequeath the unknown, so the list is, quite literally, the estate.
The Tension
Security and Survivability Pull Opposite Ways — and the Bridge Is Not a Compromise
The reason people get this wrong is that they frame security and succession as a single slider: more access for family means less security against attackers, so they pick a point and live with the regret. The honest model is two separate pans on a scale, each pulling hard, with a fulcrum between them that is not a midpoint but a different instrument entirely. The break-glass does not weaken the perimeter; it adds a designated knock on a locked door.
Security pulls this way
- Unique passwords, never reused
- Two-factor on everything that supports it
- A strong master password, shared with no one
- No secrets written where a stranger could find them
- The perimeter locked tight against intrusion
inventory + break-glass
Survivability pulls this way
- Someone must be able to reach the accounts
- The executor needs to know what exists
- The 2FA device will be locked or gone
- The master password cannot die with you
- A designated person needs a way to knock
The fulcrum is the page's thesis: you satisfy both pans not by loosening the security pan — which would simply trade a succession problem for a burglary — but by adding an instrument on the survivability side that the security pan does not govern. The inventory satisfies "someone must know what exists" without touching a single password. The break-glass satisfies "the master password cannot die with you" through a designated, delayed, revocable request path rather than a shared secret. Neither weakens the perimeter; both give the right person a way to knock. The mistake the scale prevents is the midpoint — a weaker master password, a shared 2FA code, a note in the drawer — which is not a bridge at all but a hole drilled in the door.
The Newspaper Test
Record What Is Safe to Leave Lying Around; Never the Secret Itself
The operational rule that keeps the bridge from becoming a hole is a single test, and it divides everything you might write down into two bands. The test is the one our legacy-contact guide's master-password rule depends on, stated here as a habit: could this slip be read by a stranger, on a newspaper, and be harmless? If yes, it belongs in the findable map. If no, it belongs in the break-glass, and the map only points to it.
Safe to record in the findable map
- The list of accounts: name, provider, username or identifier
- Which door each account needs (contact / executor / break-glass)
- Where a password lives ("in the manager"), never the password
- The location of the strongbox or break-glass, described not opened
- The names of the designated people and how to reach them
- Notes on what each account is for, so the executor understands it
Never in the map — only in the break-glass
- The master password, in any form
- 2FA recovery codes or seed phrases
- Full card numbers, PINs, or security-answer values
- Any string that, read by a stranger, grants entry
- Crypto private keys or wallet seeds
The two bands and the test between them are the whole method, and they resolve the tension without a compromise: the map is comprehensive and findable precisely because it contains nothing a stranger could use, and the secrets are protected precisely because the map only points to where they live. The failure mode the test prevents is the well-meaning one — a person who writes their master password on the inventory "so the family has everything in one place," producing a single document that is both the map and the skeleton key, and which, if found, opens the entire estate to a stranger. The map and the key must live apart; the newspaper test is how you keep them apart without thinking about it each time.
The Compare
Emergency Access Versus a Written List — They Fail in Opposite Directions
There are two common bridges and they fail in opposite ways, which is why the honest answer for most people is a combination rather than a choice. A password manager's emergency-access feature is structured, revocable, and time-delayed; a written list is universal, static, and insecure if read. The compare below states how each works, what it covers, how it fails, and whether you can take it back.
Manager emergency access
You designate a contact; after a waiting period you set, and unless you cancel a pending request while alive, they can request access to the vault. The specifics and the delay vary by manager — read its own documentation.
Everything inside that one manager, and only that. Accounts outside the vault are invisible to it.
It depends on the manager still existing and on the account having been kept current; it cannot reach what you never stored there.
Yes — while you live you can change or remove the contact and cancel a pending request, which is the security property a written note can never have.
Written list
A document — paper or file — listing accounts and, in the bad version, the secrets themselves. Universal in principle, since it can describe anything.
Everything you thought to write, including accounts outside any manager, which is its one genuine advantage.
It is static and rots the moment a password changes; and if it contains secrets, anyone who reads it has the estate, which is the exposure the newspaper test exists to prevent.
No — a note in a drawer cannot be un-handed, and a list you have copied is gone from your control the moment it exists.
| The question | Emergency access | Written list |
|---|---|---|
| Contains the secret? | No — it grants a path, not a copied password | Often yes, which is the danger |
| Revocable while you live? | Yes | No |
| Covers accounts outside the vault? | No | Yes, if you wrote them |
| Rots when a password changes? | No — the vault is current | Yes, immediately |
| Safe if a stranger reads it? | Yes — there is nothing to read | No, if it holds secrets |
The combination the table points to is the honest recommendation: use the manager's emergency access for the secrets, because it is revocable, current, and contains nothing a stranger could read; use a written map for the inventory, because it can describe the accounts that live outside any vault; and make the map pass the newspaper test, so it points to the break-glass without containing it. The written list's one genuine advantage — universality — is preserved in the map role, and its one fatal disadvantage — that a secret on paper is a skeleton key — is confined to the break-glass role where the manager's revocable path replaces it. You are not choosing a bridge; you are using two, each for what it is good at, and the newspaper test is the rule that keeps them from merging into a single dangerous document.
A worked example: the perfect perimeter that nearly sealed the estate
Concretely, the tension, the newspaper test, and the compare catching a person who did the security right and the succession wrong. A person follows our password-manager guide faithfully: unique passwords everywhere, two-factor on every account that supports it, a strong master password shared with no one, and a sensible refusal to write anything down "because that is how people get hacked." The perimeter is excellent. Then they are diagnosed seriously ill, and the succession question arrives uninvited.
The tension is real, not theoretical. Their spouse is the executor, and the perfect perimeter means the spouse has nothing: no master password (correctly, never shared), no second factor (the phone will be locked or wiped), and no list (correctly, nothing written down). The security rules that kept attackers out are, in the same motion, keeping the spouse out — exactly the two pans pulling opposite ways. The instinct the scale warns against is the midpoint: "just write the master password on a card in the drawer," which would convert a succession problem into a burglary waiting to happen.
The bridge, not the compromise. Instead they do the inventory sweep — and the sweep itself reveals the unknowns the estate would otherwise have lost: a cloud drive holding fifteen years of photographs, a domain that renews silently, a subscription the spouse never knew about and that would have kept billing. They set up the manager's emergency access for the vault, a revocable, delayed path that hands the spouse a way to knock without a copied secret, and they test it with the spouse while alive. For the accounts outside the vault, they write a map that passes the newspaper test: it names each account, its provider, which door opens it, and where its password lives — never the password itself. The map is comprehensive and findable precisely because a stranger reading it would gain nothing.
The result is both pans satisfied. The perimeter is unchanged — the master password is still unshared, two-factor still on, nothing written that grants entry — and yet the spouse now has a complete map and a revocable break-glass, so the estate is survivable without being exposed. Had they taken the midpoint and written the master password on the inventory, the single document would have been both map and skeleton key, and the illness that prompted the planning would have been compounded by the theft that the document invited. The bridge held; the compromise would not have.
The Check
A Sensible Default
- Hold the counterpart framing: the security rules are right, and this page builds on top of them, never weakens them.
- Do the inventory sweep first — you cannot bequeath the unknown, so the list is the estate.
- Treat email as the reset hub and the manager as the vault; both are hot categories.
- See the tension as two pans with a fulcrum, not a slider; the bridge is inventory + break-glass, never a midpoint.
- Apply the newspaper test: record what is harmless if read; secrets live only in the break-glass, and the map only points.
- Use emergency access for the secrets (revocable, current, nothing to read) and a written map for the inventory (universal, safe).
- Never let the map and the key merge into one document; that is the skeleton-key failure the test prevents.
- Test and review the break-glass with the designated person while alive, on a cadence, as the legacy-contact guide's sequence requires.
The honest takeaway is that a locked perimeter and a survivable estate are not rivals but two goals satisfied by one addition: a complete map that contains nothing a stranger could use, and a revocable break-glass that gives the right person a way to knock without ever handing them a copied secret. The security discipline you already have is the foundation, not the obstacle — the obstacle is the assumption that survivability means weakening it. For the security rules this page builds on, see our password-manager guide; for the living-half doors this inventory feeds, see our legacy-contact guide; for the bereaved side that starts from this map, see our closing-after-death guide; for the master-password-in-the-will rule this page operationalises, see our legacy-contact guide again; and for the jurisdiction and manager specifics the disclaimer routes out, see an estate professional and your manager's own documentation.
Common Questions
Frequently Asked Questions
What is the first step in making my accounts survivable?
Building the inventory, because you cannot bequeath what nobody knows exists. The high-leverage move is not a clever access mechanism but a complete list of what you have, where it is, and which door each account needs. Most digital estates fail not because the access plan was wrong but because the executor never knew the account existed.
Should I write my master password down for my family?
Generally no, and this is the tension the page is built around. A written master password defeats the security of the manager it unlocks and can be found by anyone who reads the note, which is the same exposure a public will risks. The safer bridge is a password managers emergency-access feature, which lets a designated person request access after a waiting period you set and can revoke while you live.
How is emergency access different from a written list?
They fail in opposite directions. Emergency access is structured, revocable, and time-delayed, so it is safer against a curious stranger, but it only covers what lives inside that one manager. A written list can cover everything, including accounts outside any manager, but it is static, insecure if lost or read, and rots as soon as a password changes. The honest answer is a combination: the manager for the secrets, a list for the map.
Does this replace the password manager guide?
No, it is the succession counterpart to it, and it assumes the security discipline is already in place. The password-manager guide teaches unique passwords, two-factor, and not sharing secrets, which are correct rules that unfortunately create the succession problem this page addresses. You do not weaken the security rules to solve succession; you add a break-glass path on top of them.
What if I do not use a password manager at all?
Then the inventory is even more important, because without a vault there is no emergency-access feature to bridge with, and the written map becomes the only thing that tells your executor what exists. The honest advice is to adopt a manager for the secrets and use its break-glass, because a map that points to "the password is in my head" is a map that ends at your death. But if you will not, at minimum record the map and the doors, and keep the secrets in a secured break-glass rather than on the same page.
Is a written list always unsafe, then?
No — a written map that passes the newspaper test is safe and necessary, because it is the only thing that can describe the accounts outside any vault. What is unsafe is a written list that contains secrets, because that document is a skeleton key. The distinction is the whole test: map the accounts, never the passwords, and the list becomes the findable, harmless half of the bridge.
How do I know the break-glass actually works before I need it?
Test it with the designated person while you are alive, which is step 5 of the legacy-contact sequence and the step most plans skip. Run a dry request, confirm they can find it and understand it, and set a review cadence, because a break-glass that has never been exercised is a hope rather than a path — and the manager's feature, the delay, and the contact details all change over time.
More passwords & digital-estate guides like this
We treat a locked perimeter and a survivable estate as two goals satisfied by one addition — a complete map that contains nothing a stranger could use, and a revocable break-glass that gives the right person a way to knock without ever handing them a copied secret.
Explore All GuidesKeep Reading
Sources:
UK NCSC — password & credential security guidance (the security side of the tension) · CISA — managing credentials & account recovery guidance · Apple — Digital Legacy / legacy contact (example of a designated-access mechanism; check your own)
Other Projects
More from the creator
Explore two other projects from the same creator.