Digital Estate Planning: What Happens to Your Online Accounts When You Die

Most people have a rough plan for the house, the car, and the bank account. Almost nobody has a plan for the two hundred online accounts holding their photos, their money, their business, and their private messages.

When someone dies without a digital plan, families discover the same brutal facts in the same order: the phone is locked, the password manager is locked, the cloud account holding twenty years of family photos will not open, and no support agent is allowed to help. Meanwhile the dormant accounts sit there indefinitely, a slowly ripening target for identity theft.

Digital estate planning fixes this. It takes an afternoon and it is one of the most practical gifts you can leave the people who will have to sort things out.

Why Your Family Cannot Just "Get Into" Your Accounts

Two things block them, and both surprise people.

Terms of service. Most online accounts are non-transferable licences, not property. Your Kindle library, your Steam games, your music purchases — you licensed them for your lifetime. They generally do not pass to heirs the way a shelf of paperbacks does.

Computer access law. In many jurisdictions, logging into someone else's account without authorisation is a criminal offence, even with good intentions and even for a spouse. Handing over a password in a will does not necessarily constitute lawful authorisation, and a will becomes a public document in probate anyway — which is a terrible place to publish credentials.

Most US states have adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA), which lets an executor access digital assets — but it gives priority to any online tool the provider offers. In plain terms: what you configure inside the platform beats what your will says. That single fact is the reason the steps below matter more than legal paperwork alone.

What Counts as a Digital Asset

Broader than most people assume. Break it into four buckets:

• Financial — online banking, brokerage, PayPal, Wise, crypto wallets and exchanges, payment apps, invoicing and payout accounts, subscriptions that keep charging
• Sentimental — photo libraries, cloud drives, message archives, social media, personal blogs, journals
• Operational — email accounts, domain names, web hosting, password manager, phone carrier account, two-factor devices
• Income-producing — a YouTube channel, an online store, ad revenue, affiliate accounts, digital products, freelance platforms

That last bucket is the one people forget and the one that causes the most damage. A monetised channel with nobody able to log in stops paying out and eventually gets reclaimed.

Warning Signs You Have No Real Plan

• Nobody knows the passcode to your phone — the device that receives every 2FA code you own.
• Your password manager master password exists only in your head.
• Your two-factor authenticator app is on one device with no exported backup.
• You have never set a legacy contact on Apple, Google, or Meta.
• Your crypto seed phrase is written down somewhere nobody else can find or would recognise.
• Your spouse could not name your primary email address, let alone access it.
• You run a business online and no one else has administrator rights to anything.

How to Build a Digital Estate Plan

1. Inventory what exists

Open your password manager and export a list of account names — names only, not passwords. Add anything not in there: crypto, domains, business logins, loyalty programmes with real balances. Note for each one what it is, whether it holds money, and what you want to happen to it: transfer, memorialise, delete, or archive.

Keep this list separate from any credentials. It is a map, not a key.

2. Turn on the platform legacy tools

This is the highest-value step and takes fifteen minutes.

• Apple — Legacy Contact. Settings → your name → Sign-In & Security → Legacy Contact. Add one or two people. Apple generates an access key; give them a copy and keep one with your documents. With that key and a death certificate, they can access your iCloud data.
• Google — Inactive Account Manager. Search Google Account settings for it. Set a waiting period (three to eighteen months of inactivity), choose up to ten people to notify, select which data they receive, and optionally have the account deleted afterward. This is the only officially supported route into a Google account.
• Facebook and Instagram — Legacy Contact. Under settings, choose someone who can memorialise the profile, pin a post, and respond to friend requests. Alternatively, set the account to delete on death.
• Microsoft, LinkedIn, X and others generally have no legacy tool — they require next-of-kin documentation submitted after the fact, and outcomes vary.

3. Solve the password manager handover

The manager is the master key, so it needs the most thought. Options, from best to acceptable:

• Built-in emergency access. Several major password managers offer this: you nominate a trusted contact who can request access, and if you do not decline within a waiting period, they get in. This is the cleanest solution because it is designed for exactly this scenario.
• Sealed envelope with a solicitor or in a safe deposit box, containing the master password and 2FA recovery codes, with written instructions on when it may be opened.
• Split the secret. Give half the master password to two different trusted people who must cooperate. Reduces single-point risk but adds fragility.

Whatever you choose, do not put the master password in the will itself.

4. Do not forget the phone and the authenticator

The phone passcode is arguably as important as the password manager, because it receives verification codes. Store it with your sealed instructions. Also make sure your authenticator app either syncs to an account your executor can reach, or that its backup codes are printed and stored with the rest.

5. Handle crypto separately and carefully

Self-custodied crypto is unforgiving: no seed phrase means the funds are gone permanently, and there is no support line. Write the seed phrase on paper or steel, store it somewhere physically secure, and leave clear instructions describing what it is and how to use it — many heirs would not recognise twelve random words as money. For exchange accounts, note the exchange name so the executor knows to file a claim.

6. Write instructions your family can actually follow

A one-page document, in plain language, covering:

• Where the credentials are and who is authorised to retrieve them
• Which accounts to close immediately (subscriptions, payments)
• Which to preserve and how (photos, messages)
• Which to memorialise or delete (social media)
• Who to contact about the business, if there is one

Assume the reader is grieving and not technical. Number the steps.

7. Give the will the right language

Ask your solicitor to include an explicit clause authorising your executor to access, manage, and close your digital accounts, and to name a digital executor if that person differs from your main executor. This provides the legal authorisation that platform terms and computer-misuse laws require — without ever containing a password.

8. Review it once a year

Accounts change, people change, and a plan pointing at an email you closed is worse than no plan. Tie the review to something you already do annually.

If It Already Happened

If you are the one sorting out someone else's digital life right now, work in this order:

1. Secure the phone before the battery dies. If it is unlocked or you have the passcode, plug it in, disable auto-lock, and do not let it factory reset. It is the master key to most 2FA.
2. Get multiple certified copies of the death certificate. Every platform and bank will demand its own original.
3. Check for a legacy contact on Apple, Google, and Meta before anything else — this is the fast, legitimate path.
4. Stop the bleeding. Cancel subscriptions and recurring charges. Contact the bank and card issuers. Notify the mobile carrier, but consider keeping the number active for a while, since it may be needed for verification.
5. Notify credit bureaus and request a deceased alert. Identity theft against the recently deceased is common and often goes unnoticed for months.
6. Submit formal requests to platforms without legacy tools, with the death certificate and proof of executorship. Expect weeks, and expect some refusals.
7. Preserve before you delete. Download photos and important data first. Deletion is permanent and grief makes people rush.
8. Do not guess passwords repeatedly on locked accounts — you may trigger a permanent lock or, on some devices, data erasure.

The Bottom Line

Your digital life will outlive you, and by default it will outlive you in a locked state that helps nobody except identity thieves. The fix is not complicated: an inventory, the platform legacy tools, a safe handover path for your password manager and phone passcode, and one page of plain instructions.

Set the legacy contacts today — that part genuinely takes fifteen minutes. Do the rest over a weekend. The people who will one day be looking for your photos will not know to thank you, but they will find them.