Passwords and Device Access: What Your Executor Needs to Know

A short passcode is often all that stands between an executor and a phone full of bank alerts, two-step codes and family photos. Apple's own instructions for a forgotten iPhone passcode end with the phone being reset, and that reset erases the data on it.^[1] Few families expect to face that choice, and it is usually avoidable with one sheet of paper and one sentence telling your executor where that sheet is.

This guide treats passwords and device access as one subject, because for an executor they are the same problem: getting in. It doesn't repeat our separate guides on Apple Digital Legacy, Google Inactive Account Manager, digital legacy planning in Canada or cryptocurrency in your estate plan, and links to them where they fit.

Your executor needs the location, not the secret #

Your executor generally only needs to know where your access details are kept. They don't need the passwords themselves today, and handing them over while you are alive adds risk without adding much help.

The Life Discovery Kit, the executor document we build alongside your Will, works on exactly that principle. It records locations only. Naming each app or device is optional: a handwritten "All in my safe" is a complete answer. If you would like to be more specific, you can be, for example: "Phone and computer passcodes and my password manager's master password: handwritten sheet in the home safe, second copy in the safety deposit box."

Keep the secrets themselves out of your will as well. A will that goes through probate can become part of a court record that other people can see, and the Supreme Court of Newfoundland and Labrador, for one, says a probated will becomes a permanent public record.^[2] Whatever is written in a will may not stay private for long.

The most cautious option: handwritten, in two places #

Many people consider paper the safest home for the handful of secrets that unlock everything else. Write them by hand, keep the sheet in your home safe, and put a second copy in a safety deposit box, much as many people store a crypto wallet's recovery phrase (our cryptocurrency guide covers that side). Keeping these details off any computer is arguably the most cautious approach: a sheet of paper in a locked safe is hard to phish or hack, and it won't quietly sync somewhere you didn't intend.

The companies behind your accounts often suggest something similar for their own recovery details. Google suggests storing its sign-in backup codes somewhere safe, like where you keep your passport or other important documents.^[3] Apple suggests keeping a copy of an Apple Account recovery key in a safe place, and considering more than one place.^[4]

A few habits make the paper approach work:

• Date the sheet and rewrite it whenever you change a passcode, so your executor isn't guessing which version is current.
• Write clearly. Characters that are easy to confuse (a zero and a capital O, a one and a lower-case L) are worth labelling.
• Make sure the safe can be opened. A combination only you know turns the safe into one more locked device. The Life Discovery Kit asks where your executor can find the safe's access instructions, again as a location rather than the combination.

Next: a free password manager, with its master password on paper #

If you have dozens of online accounts, a password manager is a practical alternative to writing every login down, and you generally don't need to pay for one to plan for your executor. Phones and browsers come with them: Apple's Passwords app keeps passwords, passkeys and verification codes in one place and keeps them up to date across devices through iCloud Keychain,^[5] and Google Password Manager saves passwords and passkeys in your Google Account or on your device.^[6] Some standalone managers also offer a free plan; Bitwarden, for example, says the core features of its password manager are free.^[7]

The weak point is the master password, or for a built-in manager, the device passcode and account password that protect it. Many managers are designed so the company can't see inside your vault. Bitwarden, for instance, says it has no way to access, retrieve or reset your master password.^[8] A death certificate generally won't change that, so the master password is worth writing on paper and storing exactly like the sheet above: in the home safe, with a copy in the safety deposit box.

Built-in managers have a wrinkle of their own. Apple says a Legacy Contact can't access data stored in iCloud Keychain, which includes passwords and passkeys.^[9] If your passwords live in Apple's Passwords app, the paper copy of your passcode and Apple Account password may matter more than any Legacy Contact request. Our guides to Apple Digital Legacy and Google Inactive Account Manager explain what those tools do share.

Or both #

Many people end up combining the two. The password manager holds the long tail of logins: utilities, subscriptions, online shopping, the hockey league website. The paper sheet holds the short list that opens everything else: device passcodes, the master password, your main email password and any recovery codes. Your Life Discovery Kit entry can then stay short: "Password manager on my phone; master password and passcodes handwritten in the home safe, copy in the safety deposit box."

Device access: the keys that open everything else #

Most online accounts can be recovered one way or another. Devices tend to be less forgiving, and many accounts send their sign-in codes to a device. These are the items worth recording, or at least recording the location of.

Phone and tablet passcodes. Without the passcode, a phone can generally only be reopened by erasing it. Apple's instructions for a forgotten iPhone passcode reset the device and erase its data.^[1] Google's Android help says that if you can't unlock your phone, you'll need to erase it, and that backed-up data can be restored if you know the PIN or pattern that was set when the backup was made.^[10]

Computer logins and disk-encryption recovery keys. If a computer's drive is encrypted, the login password may not be the only key that matters. Apple warns that if you forget your Mac login password and lose your FileVault recovery key, you won't be able to log in and your files and settings will be lost; it suggests keeping the recovery key somewhere other than the encrypted disk and not in the same physical location as the Mac.^[11] On Windows, a BitLocker recovery key may be in your Microsoft account, a work or school account, a printout or a USB flash drive, and Microsoft says its support team can't retrieve, provide or recreate a lost key.^[12]

Account recovery keys. Some accounts let you add a recovery key for extra protection. Apple says it can't provide a lost Apple Account recovery key, and that without it you might lose access to your account data.^[4] If you have set one up, its location belongs in your Life Discovery Kit.

Two-step backup codes. Many services that send a code to your phone also offer one-time backup codes. Google's backup codes can be printed, and each one works only once.^[3] Bitwarden says a printed copy of its two-step login recovery code, kept in a safe place, is a good option because it prevents digital theft and accidental deletion, and warns that losing both the code and your two-step device may lock you out.^[13] Codes sent by text message depend on the phone, which brings you back to the passcode.

Your password manager's emergency kit or recovery kit. Some password managers offer a kit of this kind: a printable page or PDF holding what is needed to get back into the account, such as a recovery code or phrase, sometimes with a space to write the master password by hand. Proton, for example, lets you save a recovery phrase as a PDF and suggests printing it and keeping it in a safe or wherever you keep important documents.^[14] Your executor doesn't need a copy now. They need to know where it is kept.

Having a passcode doesn't settle every question. Providers often run their own process for a deceased person's account (Apple's Legacy Contact is one example^[9]), so the official tools in our Apple and Google guides are still worth setting up, and an executor who is unsure about signing in as you may want legal advice first.

Safety deposit boxes: a good backup, rarely a quick one #

A safety deposit box protects your second copy from a fire, flood or break-in at home. It is generally not the copy your executor can reach first, and it helps to know why before you rely on it.

Rules vary by bank and by province, so treat this as a general picture rather than the rule for your box:

• A supervised search for the will is often possible early. ATB Financial's executor guide says most banks will let next of kin access a deceased family member's safe deposit box for the sole purpose of checking for and retrieving a will.^[15] Nova Scotia's government guide says a bank may let an executor secure certain documents, such as the will, on the funeral director's proof of death and identification as executor or administrator, but that a letter of probate or administration may be needed for other documents in the box.^[16]
• An inventory may come first, with the bank present. In British Columbia, the Wills, Estates and Succession Act generally keeps a deceased person's box and its contents on the premises until an inventory has been prepared in the presence of the bank or its agent, and the original will can be removed once that inventory is done.^[17]
• A joint renter may face the same step. The British Columbia rule applies whether the box was rented alone or jointly with someone else, so a surviving co-renter may still need that inventory prepared before anything leaves the box.^[17]
• Everything else usually waits for proof of authority. ATB's guide says the personal representative will need to provide proof of legal authority to act for the estate.^[15] CIBC's executor checklist has the contents listed with a banking centre representative and then held at the banking centre for safekeeping, and asks the executor to provide the probate judgment where one applies.^[18]

Put together, the box may not be reachable quickly after a death, and its full contents may wait for probate. If the only copy of your phone passcode sits in the box, your executor could be locked out of the very phone that receives your bank's sign-in codes. The copy in your home safe lets them start: unlock the phone, find the bills, cancel what needs cancelling. The box copy stays where it is as the backup. The Life Discovery Kit also asks where you keep the key to your safety deposit box, so your executor knows how to reach that backup when the time comes.

Where It's Simple Will fits #

Your Will and your Life Discovery Kit do different jobs. The Will names your executor, the person with the authority to act for your estate. The Life Discovery Kit tells them where things are kept: the home safe, the safety deposit box key, the sheet with your passcodes, your password manager's recovery kit. It records locations only, so the document itself doesn't hand anyone your secrets. You can build both at app.itssimplewill.ca.