Digital Estate Planning: Why a Password List Isn't Enough
Most people think they've handled their digital assets once they've written their passwords down somewhere safe. It's a reasonable instinct — and it's not enough.
Here's why: almost every financial account, email provider, and investment platform now requires two steps to log in. The first is your password. The second is a verification code sent to a specific phone or email at the exact moment someone tries to access the account. That second step is called two-factor authentication, and it's become the standard for good reason — it's one of the best protections we have against fraud and identity theft.
It's also one of the most common reasons families get stuck after a death. Your executor can have the correct password and still not get in, because the verification code has nowhere to go. The phone is locked. The number's been disconnected. The recovery email hasn't been used in a decade.
The password was never the whole picture. The plan has to account for where the second step goes.
The Accounts That Actually Cause Problems
When people picture "digital assets," they usually think of social media or old email. In practice, the accounts that create the most headaches after a death are the ones we all rely on daily: online-only banks and investment platforms, email (which quietly holds years of financial statements and account-recovery links for everything else), cloud storage, and increasingly, things like cryptocurrency or online business accounts that hold real value but leave no paper trail if no one knows they exist.
Why Your Will Isn't the Right Place for This
I sometimes see clients want to list account credentials directly in their will. It feels practical — it's actually the opposite of secure. A will becomes a public record once it's filed for probate, and anyone can request a copy. Passwords listed in a will are, effectively, published.
What belongs in a will is an instruction, not a list: who has legal authority to manage your digital assets, and where the access information itself is kept — safely, and separately.
What a Real Digital Estate Plan Looks Like
It's a system, not a document you fill out once. A solid plan includes an inventory of the accounts that matter, a record of how each one verifies identity (which phone, which email, which app), backup codes generated and stored offline, and a person named with clear legal authority to act. And it gets updated — when you change your phone number, when you open a new account, when an old email address gets retired.
In many states, a framework called the Revised Uniform Fiduciary Access to Digital Assets Act governs what your executor can actually access and under what conditions. Whether your plan gives them real authority — or leaves them facing the same locked door your family would otherwise hit — often comes down to whether that language was built in ahead of time.
Where to Start
You don't need to overhaul everything this weekend. Start with an inventory: go through your accounts and note which phone number or email receives the verification code for each. Check the recovery contacts on your email — many of us have an old number or address attached that we forgot to update years ago. And generate backup codes where the platform allows it; print them and store them somewhere secure.
If that feels like more than you want to sort through alone, that's exactly the kind of thing we work through together in a Life & Legacy Planning Session — mapping your specific accounts and access points so the plan actually works for the people who'll need to use it.