Who Gets the Passwords When You Die? A Security-First Guide for Executors

Executors do not automatically inherit a deceased person's passwords, and simply typing saved credentials into an online account can trigger automated security lockouts or violate federal computer access laws. Knowing how to organize estate executor digital security protects the decedent's assets, keeps legitimate probate processes on track, and shields the estate from identity theft after death.

For inbox-safety context, FTC phishing guidance recommends treating unexpected messages and requests for personal information with caution.

When someone dies, their digital presence remains active. Automated subscription billings continue to draw down checking accounts, security tokens expire, and unmonitored email inboxes become prime targets for automated credential stuffing and identity theft. Learning how to organize estate executor digital security requires shifting away from informal password guessing and toward a disciplined, administrative protocol. ClearFarewell is a planning and organizing tool, not legal, financial, tax, estate-administration, or religious advice. Requirements vary by state and funeral home — often confirm with your funeral home, an attorney, your state's vital-records office, or clergy.

Why Digital Security Is Now an Executor's Job, Not an Afterthought

Most individuals accumulate dozens of online accounts spanning banking, utilities, identity providers, and cloud storage over their lifetimes. A single inaccessible primary email address can create an administrative roadblock, preventing an executor from receiving monthly statements, processing password resets, or shutting down billing feeds. For a fiduciary, this modern reality creates two distinct, equally challenging threats: lockout and exposure.

Lockout occurs when security safeguards lock an account permanently because an unauthorized user tripped automated risk thresholds. Major service providers routinely freeze or restrict accounts when they detect anomalous logins from unfamiliar IP addresses or unauthorized login attempts after a reported death. Exposure is the opposite risk: leaving unmonitored accounts vulnerable to malicious actors. Public death notices and probate court filings provide biographical details that identity thieves use to target dormant profiles, attempt fraudulent tax filings, or divert lingering balances.

A frequent point of confusion is the legal difference between an estate's personal representative and a technology company's authorized user. A probate court judge may appoint you as personal representative or executor through Letters Testamentary, giving you legal authority over tangible and financial assets. However, technology platforms are governed by terms of service agreements and statutory frameworks like the Computer Fraud and Abuse Act (CFAA), alongside state enactments of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA). To an automated identity platform, an executor typing in someone else's master password can look like an unauthorized account takeover.

Understanding how to organize estate executor digital security is fundamentally a planning, documentation, and asset-governance challenge rather than a technical workaround. This guide covers a six-step defensive framework: building a verified inventory, establishing legal authority with custodians, handling two-factor authentication, enforcing access hygiene, preventing fraud, and establishing long-term credential custody.

Step 1: Build a Digital Asset Inventory Before You Touch a Single Login

The most critical rule when taking over estate administration is to pause before attempting logins. Fiduciaries should avoid guessing passwords on the decedent's primary laptop or clicking saved bookmarks without documentation. Instead, begin your discovery using physical paperwork and offline records.

Paper records reveal an individual's digital footprint methodically and with far less operational risk than ad hoc digital exploration. Pull and inspect:

• Physical mail and financial statements: Bank and brokerage statements, mortgage notices, utility invoices, and pension slips surface the institutions where accounts exist.
• Tax returns: Look at Schedule B (interest and dividend statements), Schedule D (capital gains), and Form 1099s from the prior two years to discover active financial accounts, secondary brokerage platforms, and crypto accounts.
• Mobile phone bills: Itemized statements identify carrier names, account numbers, and whether secondary family members are bundled under the primary subscription.
• Hard-copy receipts and filing cabinets: Check for physical invoices detailing software purchases, domain registrations, or safe deposit box leases.

Organize your discoveries using functional account tiers rather than an unorganized list. For a structured approach, review our guide on how to create a digital asset inventory to ensure you cover critical asset categories:

• Financial accounts: Primary checking, savings, retirement, certificates of deposit (CDs), mutual funds, peer-to-peer payment apps, and retail store credit cards.
• Identity anchors: Primary email addresses, secondary recovery emails, mobile carrier profiles, Apple IDs, Google accounts, and government service portals.
• Records and intellectual property: Cloud storage vaults, photograph repositories, domain names, personal websites, and external hard drives. For considerations on evaluating storage platforms, refer to our comparison of a digital vault vs cloud storage for estate planning.
• Active subscriptions: Media streaming, cloud compute resources, monthly delivery memberships, recurring donations, and magazine subscriptions that trigger automatic debit charges.

Document each entry by noting the provider name, user handle, associated recovery email, bound phone number, and whether the service holds monetary value or active billing. Store the actual passwords in a distinct, separate location away from the inventory sheet. Identify the keystone accounts: the primary email inbox, the mobile phone line, and the password manager. Losing access to these keystones complicates recovery for downstream accounts across the estate.

Treat this inventory as an active administrative record. For individuals organizing their own affairs in advance, scheduling an annual inventory review alongside routine tax preparation ensures credentials, devices, and recovery paths remain accurate as services evolve.

Step 2: Establish Your Authority Before You Request Access

Major service providers operate under statutory privacy constraints and will not release account access or data based on informal family requests. They adhere to formal legal workflows that require specific documentation before releasing data archives, transferring ownership, or terminating services.

Your first administrative requirement is obtaining certified death certificates. Probate courts and financial custodians routinely advise securing multiple official copies with raised seals, as many institutions retain originals for their permanent compliance files.

When approaching digital providers, distinguish between three primary administrative pathways:

1. Platform-native legacy tools: If the decedent configured built-in succession tools, access proceeds smoothly without requiring court intervention. Services like Google Inactive Account Manager allow users to designate specific contacts who receive access to selected archives after a prolonged period of dormancy. Similarly, Apple Support's guide on requesting access to a deceased family member's Apple Account explains that designated Legacy Contacts can request account data and have Activation Lock automatically removed after submitting an access key and a death certificate.
2. Formal fiduciary requests for account closure: If no native legacy mechanism was configured, executors must submit formal administrative packets. This typically includes a certified death certificate, certified Letters Testamentary or Letters of Administration from the probate court, government identification for the executor, and a formal request letter detailing whether the estate requests account termination or an archive export. Consult our breakdown on how to organize estate document access for executors for tracking these submissions.
3. Court orders and legal subpoenas: When dealing with uncooperative platforms, encrypted cloud storage, or intellectual property where the custodian requires specific court instructions under RUFADAA, an executor may need to petition the probate court for a targeted order directing the provider to release data archives.

Having a digital asset clause in a Last Will and Testament is helpful, but it does not grant direct administrative rights over service providers. A will cannot override an online platform's terms of service agreement. Review our guide on how to appoint a digital executor to understand how express consent clauses interact with service provider requirements under state law.

Finally, understand the distinction between accessing an account and accessing the data within it. Major email and cloud platforms frequently permit the export of photos, emails, and address books to a certified fiduciary, but their security policies generally forbid transferring login credentials or allowing a third party to send messages under the decedent's identity.

Step 3: Managing 2FA for Deceased Estates Without Locking Yourself Out

Two-factor authentication (2FA) is one of the most common operational hurdles in digital estate administration. Even when an executor possesses a valid master password or answers security questions, modern platforms block the login attempt until a secondary token is verified. In most cases, that secondary verification method is tied to the decedent's physical hardware.

A frequent error during the early days of administration is wiping, trading in, or cancelling the decedent's smartphone. Keep the smartphone connected to power, connect it to known household Wi-Fi networks, and set the screen display timeout to a longer interval if you know the device passcode. If the lock screen code is unknown, keeping the phone charged and active allows it to receive incoming SMS verification codes without restarting, as restarting some models restricts network access until the initial PIN is entered.

When managing 2FA for deceased estates, executors encounter several common verification methods, each requiring a specific approach:

SMS-Based Two-Factor Codes

SMS verification remains the most common 2FA fallback. Maintain the decedent's active wireless subscription until major financial institutions, government portals, and identity providers have been transitioned. Gaining administrator access to the carrier billing account allows an executor to transfer the phone number to an estate-controlled device or replace a broken SIM card if physical access to the original phone is lost.

Authenticator Apps (Software TOTP)

Apps like Google Authenticator, Microsoft Authenticator, and Authy generate time-sensitive six-digit codes. These codes are tied to the local device unless cloud synchronization was intentionally enabled. If the app was synced to a cloud account that you can legally access, you can restore those tokens to an executor-managed secondary phone. If the app was stored locally on an inaccessible, PIN-locked phone, you cannot extract the secret keys. In this scenario, you must bypass the app using the platform's standard identity recovery workflow, submitting estate credentials and death certificates directly to the service provider.

Hardware Security Keys (FIDO2 / YubiKey)

If the decedent practiced advanced security hygiene, their critical accounts may require a physical security key plugged into a USB port or tapped via NFC. Inspect key rings, desk drawers, and home safes for physical hardware tokens. Look for backup security keys as well, as many users keep a secondary key in a secure box. If the physical key cannot be found, you must rely entirely on the platform's formal account recovery process.

Email-Based Verification

If you have established access to the decedent's primary email account, you can resolve secondary factors across downstream accounts. This makes primary email addresses a cornerstone asset of modern estate administration. Safeguarding the primary inbox provides a secure, auditable path to resetting forgotten passwords across the decedent's digital footprint. Explore our walkthrough on how to organize digital passwords for heirs and read our overview of digital estate planning for retirees to see how early preparation simplifies these systems.

Fiduciaries should avoid attempting to brute-force security controls, hiring unvetted password-cracking services, or running unauthorized access scripts, as these actions violate terms of service, risk permanent account lockouts, and create legal complications for the estate. Log every official access request in an administrative journal, noting the platform, submission date, ticket reference number, and supporting documents provided.

Step 4: Secure the Accounts You Can Reach — and Contain the Ones You Can't

Once you establish lawful administrative control over an account, transition it into a secure, controlled state. The objective of protecting digital accounts for executors is to establish a clear boundary between the decedent's historical activity and your administrative actions.

First, update the passwords on all keystone accounts using long, randomized passphrases generated inside an estate-managed password manager. Avoid reusing historical passwords, and refrain from storing newly generated credentials in unencrypted shared documents or plaintext notes.

Second, update the two-factor authentication configuration. Remove the decedent's old hardware tokens or personal phone numbers and register an authenticator app or security key controlled directly by you as executor. This step invalidates existing browser sessions or third-party devices that might still hold valid login tokens.

Third, terminate active login sessions and audit authorized applications. Within the account settings of major platforms:

• Navigate to security settings and select options such as "Sign out everywhere" or "Log out of all other sessions."
• Review authorized devices and remove legacy tablets, workplace computers, smart TVs, and older mobile phones.
• Audit connected applications and third-party integrations, revoking access for any software that no longer serves an administrative purpose.

Fourth, contain financial leaks by closing non-essential accounts. Terminate streaming services, retail memberships, delivery subscriptions, web hosting packages, and gaming profiles. If an account stores a credit card or linked checking account on file, remove the stored payment method to prevent automated recurring debits from depleting estate liquidity.

Fiduciaries should also avoid administrative over-collection. An executor's legal responsibility is to collect estate assets, satisfy debts, and distribute property based on the will or state intestacy laws. You do not hold an open mandate to inspect personal direct messages or read unrelated personal correspondence. Access only what is necessary to administer the estate, and maintain an access log detailing when an account was opened, which records were downloaded, and the administrative purpose behind the action.

Step 5: Protect the Estate From Identity Theft and Account Takeover

Deceased identity theft—often termed "ghosting"—is a recognized vulnerability for estate administrators. Because vital statistics records, obituary notices, and probate court dockets are matters of public record, bad actors monitor public records to identify targets. A deceased person's credit file remains open and active until the major credit reporting agencies are officially notified, creating potential exposure for unauthorized credit applications or fraudulent tax filings.

To defend the estate against identity theft, carry out three essential administrative steps promptly upon appointment:

1. Request a deceased credit freeze: Contact the three major credit bureaus—Equifax, Experian, and TransUnion—in writing or via their official executor portals. The FTC credit freeze guidance explains how credit freezes restrict access to credit reports and help prevent new accounts from being opened fraudulently. Submit a certified death certificate, Letters Testamentary, and the decedent's full legal name, Social Security number, date of birth, and last known address, requesting that the file be flagged: "Deceased. Do Not Issue Credit."
2. Forward physical mail via the United States Postal Service: Submit an official change-of-address order redirecting the decedent's physical mail directly to your administrative address or an estate-designated P.O. Box. Intercepting paper statements prevents unauthorized parties from discovering account numbers or intercepting replacement payment cards.
3. Notify the Internal Revenue Service and state taxing authorities: File IRS Form 56 (Notice Concerning Fiduciary Relationship) to formally establish your authority to handle tax matters for the estate. This step alerts the agency to direct tax correspondence to you and helps flag potential identity theft involving fraudulent refund claims.

Executors must also be alert to targeted phishing campaigns. Bad actors sometimes monitor probate filings to identify executors, sending deceptive messages that mimic courts, county clerks, or debt collection agencies. Avoid clicking verification links in unexpected messages that claim estate assets are frozen or fees are overdue. Validate invoices and court notices directly with the court clerk or the institution's verified contact number, and maintain a log of any suspicious correspondence.

Step 6: Store Credentials So the Next Executor Isn't Starting From Zero

Estate administration often spans many months. If an executor falls ill, resigns, or becomes incapacitated, an incoming successor executor must be able to resume administrative duties without restarting the digital discovery process from the beginning.

Build a secure, organized system that separates the map from the keys:

Component	What It Contains	Security & Access Protocol
The Map (Inventory)	List of institutions, usernames, account numbers, registered domains, associated recovery emails, and active recurring subscriptions.	Can be shared with probate attorneys, co-executors, or family members. Contains no passwords, master keys, or seed phrases.
The Keys (Credentials)	Master passwords, multi-factor authentication secret seeds, device PINs, disk encryption keys, and safe combinations.	Restricted exclusively to the active personal representative. Stored in an encrypted vault with emergency access provisions.

When selecting a storage system for active estate credentials, evaluate the specific operational tradeoffs:

• Dedicated digital vaults: Secure vaults designed for estate documentation provide access controls, file auditing, and structured permission sharing. They keep sensitive files organized alongside asset manifests while maintaining strong encryption.
• Password managers with emergency access: Reputable password managers allow the primary user to designate trusted emergency contacts. If access is requested, a predetermined waiting period begins; if the account holder does not decline the request, access is granted automatically.
• Sealed physical master sheets: A written document stored in a fireproof home safe or an attorney's vault provides an offline, tamper-evident solution. However, paper records cannot automatically update when credentials change, requiring manual maintenance whenever an account password is refreshed.

Document the location of the inventory in writing, provide a copy to the estate attorney, and name your successor clearly. When coordinating duties among multiple family members, read our guide on how to manage shared family estate tasks to prevent conflicting access requests and maintain family transparency.

Common Mistakes Executors Make With Digital Accounts

Even conscientious executors can encounter serious legal and technical pitfalls when managing unfamiliar digital accounts. Avoid these six common mistakes:

• Guessing passwords or relying on auto-fill browser sessions: Attempting to log into a financial app using auto-filled passwords on a decedent's shared desktop may seem convenient, but it can trigger automated security lockouts. Accessing an account without explicit platform authorization can also complicate your standing as a fiduciary under computer access statutes.
• Terminating the line severs SMS two-factor authentication across accounts tied to that number, turning straightforward logins into lengthy administrative recovery disputes.
• Publishing detailed obituaries before securing accounts: Sharing a loved one's full date of birth, mother's maiden name, childhood hometown, and workplace provides bad actors with information frequently used in security verification questions.
• Assuming a standard will overrides terms of service agreements: A clause stating that digital accounts pass to a beneficiary does not compel service providers to hand over passwords. Most major tech companies provide data exports or close the account based on their user agreements and privacy policies.
• Failing to maintain an administrative log: If beneficiaries later question whether digital assets or private documents were handled properly, an executor who kept no record of logins, downloads, or closures faces heightened scrutiny.
• Attempting to manage the entire estate in isolation: Managing digital assets, probate requirements, utility transitions, and funeral costs simultaneously leads to administrative burnout. Sharing logistical checklists across family members keeps everyone aligned and reduces friction.

A Practical 30-Day Digital Security Sequence for Executors

Managing digital assets alongside probate filings requires an orderly, phased schedule. Follow this practical 30-day sequence to organize estate executor digital security effectively in 2026:

1. Days 1–3: Hardware Containment and Continuity
   • Locate the decedent's primary smartphone, laptop, tablet, external backup drives, and hardware security keys.
   • Keep the smartphone powered on, plugged into an electrical outlet, and connected to its home Wi-Fi network.
   • Ensure the mobile wireless subscription remains funded; keep the cellular line active during initial discovery.
2. Days 4–10: Passive Discovery and Mapping
   • Collect physical mail, tax filings, bank notices, and paper invoices to identify online accounts.
   • Identify the three keystone accounts: primary email inbox, mobile network account, and password manager.
   • Construct the digital asset inventory, recording usernames, account purposes, and billing cycles while keeping passwords separate.
3. Days 11–20: Formal Notices and Identity Protection
   • Submit credit freeze requests with Equifax, Experian, and TransUnion using certified death certificates.
   • File a permanent mail forwarding request with the USPS to redirect physical correspondence to the executor.
   • Submit formal fiduciary access or closure packages to major tech platforms and financial institutions accompanied by Letters Testamentary. ClearFarewell tracks what needs filing and generates letter templates you send yourself; it does not file paperwork, administer estates, or guarantee reimbursement.
4. Days 21–30: Credential Transition and Containment
   • Update passwords and passphrases on established keystone accounts.
   • Reconfigure two-factor authentication so secondary tokens route to executor-managed devices.
   • Sign out secondary browser sessions, audit connected applications, and cancel unused recurring entertainment and retail subscriptions.
5. Ongoing Duties: Maintenance and Successor Handoff
   • Conduct a monthly review of redirected postal mail, forwarded emails, and credit reporting alerts.
   • Update the administrative access log whenever an account is settled, closed, or exported.
   • Store the updated inventory and master credentials in a secure location accessible to a designated successor executor.

Frequently Asked Questions

Can an executor legally log into a deceased person's online accounts?

Generally, an executor should not use a deceased person's personal passwords to log into online accounts as if they were the account owner. Even though an executor holds authority over estate assets under state probate law, accessing an account directly without platform authorization can violate federal computer access statutes (such as the CFAA) and breach provider terms of service agreements. The lawful approach is to present certified Letters Testamentary and a death certificate to the platform or utilize recognized tools like Apple Legacy Contact or Google Inactive Account Manager to request access archives or account closure through official channels.

What happens if the deceased used an authenticator app with no backup?

If time-based one-time password (TOTP) codes were stored in an authenticator app on a locked smartphone with no cloud synchronization, you cannot extract those dynamic codes without unlocking the device. If the phone passcode is unknown, you must initiate an account recovery request with each provider individually. This involves submitting certified copies of the death certificate, court appointment documents, and proof of identity to bypass the authenticator app and reset account access through official administrative channels.

Should I cancel the deceased's phone number right away?

Cancelling a deceased person's mobile phone number during early estate administration typically causes severe access complications. Most online accounts, financial institutions, and email services use SMS verification as a fallback authentication method. Cancelling the cellular subscription terminates your ability to receive these security codes and can permanently lock you out of critical accounts. Maintain the cellular line until you have fully audited, transitioned, and closed all associated digital services.

How do I handle a password manager I can't unlock?

If the decedent used a password manager and did not document the master passphrase or configure an emergency contact, service providers cannot decrypt the vault for you due to zero-knowledge encryption architecture. Start by searching physical home offices, fireproof safes, and safe deposit boxes for an emergency access sheet or recovery key. If no physical record exists and no emergency contact was established, you cannot recover the vault itself. Instead, rely on your physical inventory of paper statements, credit bureau reports, and direct fiduciary requests to secure individual accounts one by one.

Do I need a lawyer to get access to digital accounts after a death?

You do not necessarily need an attorney to access digital accounts if the decedent configured platform-native features like Google Inactive Account Manager or Apple Legacy Contact, or if the custodian readily honors standard Letters Testamentary under state digital access laws. However, if a platform refuses to cooperate, if high-value business assets or cryptocurrency are locked behind inaccessible credentials, or if heirs dispute the management of digital property, consult a qualified probate attorney to obtain a formal court order compelling the custodian to release the data.

Conclusion: Security Is the Executor's Quiet Duty

Administering an estate has evolved beyond collecting paper certificates from a safe deposit box and closing local checking accounts. Digital assets carry substantial financial and personal value, and leaving them unmonitored invites identity theft, billing leaks, and administrative delay. By establishing a methodical process—building an asset inventory, asserting legal authority, managing 2FA securely, isolating active accounts, and monitoring for fraud—you fulfill your fiduciary duties while safeguarding the decedent's legacy.

The what-to-do-now checklist and the free calculators require no account and no email — they work immediately. Explore our free what-to-do-now checklist to begin organizing immediate steps. ClearFarewell tracks what needs filing and generates letter templates you send yourself; it does not file paperwork, administer estates, or guarantee reimbursement.