How to leave your passwords and crypto recovery phrase to your family, safely
A practical plan for making sure your family can reach your accounts and crypto if something happens to you, without writing everything on one piece of paper anyone could find.
If you died or ended up in hospital tomorrow, could your family get into your email, your phone, your bank accounts or your crypto wallet? For most people the honest answer is no. Everything is behind passwords that live only in their head or in a password manager nobody else can open.
The obvious fix, writing everything down and putting it in a drawer, creates the opposite problem. Anyone who finds the paper has everything. A good plan sits between the two: your family can get in when they need to, and nobody can get in before that.
Use the built-in options first
Several big services already have a way to hand over access, and they're the cleanest route because the service itself checks that the request is genuine:
- Google has Inactive Account Manager: if your account goes unused for a period you choose, it can notify people you've picked and share selected data with them.
- Apple lets you add a Legacy Contact, who can request access to your iCloud data with an access key and a death certificate.
- Facebook lets you choose a legacy contact to look after a memorialised account.
- Password managers often have emergency access. Bitwarden, for example, lets a trusted person request access, which is granted automatically if you don't decline within a waiting period you set.
Set these up first. They cover a lot, and they don't need you to write any password down.
What's left: the master keys
Some things have no recovery process at all. A crypto wallet's recovery phrase (the 12 or 24 words) is the clearest case: whoever has it has the money, and if it's lost, the money is gone. The same goes for a password manager's master password, a phone PIN, or the combination of a home safe.
These are the secrets worth planning properly, and the main choices are below.
A sealed letter with someone you trust
Simple, and fine for small amounts. The weakness is that one person, or anyone who gets to their drawer, holds everything. Don't put the secrets themselves in your will: in some places, such as England and Wales, a will becomes a public document after probate.
An encrypted file, with the password kept apart
Put the instructions and the secrets in an encrypted file, give copies of the file to family, and keep the password separately, for example with your lawyer. Neither half is useful on its own. Our encrypted document kit makes a single file that opens in any web browser with the password, so your family won't need special software.
Try it: Encrypted document kitLock files and notes with a password into one file that opens in any browser. Keep it, or send it safely.Split the secret into pieces
This is the most robust option. A method called Shamir's secret sharing, published by the cryptographer Adi Shamir in 1979, splits a secret into several pieces so that a chosen number of them, and no fewer, can rebuild it. For example: three pieces, any two needed.
- Give one piece to your partner, one to a sibling and one to your lawyer.
- Any one of them alone learns nothing at all, not even a hint of the secret.
- Any two together can recover it, so losing one piece is not a disaster.
Our secret splitter does exactly this, and prints each piece on its own page with a QR code and recovery instructions.
Try it: Secret splitterSplit a password, recovery phrase or code into pieces for family or friends. Any few of them bring it back.A note on typing a recovery phrase into a website
Normally you should never type a wallet's recovery phrase into any website, and that advice stands. If you use a browser tool like ours for this, open the page, then turn off Wi-Fi and mobile data before typing the phrase. The splitter works fully offline once loaded, and nothing is sent anywhere, but going offline means you don't have to take our word for it. Close the tab when you're done.
For a large amount of crypto, also look at what your hardware wallet offers. Some, such as Trezor's Shamir Backup, can create split recovery shares on the device itself, so the phrase never touches a computer.
Write the instructions, not just the secrets
A recovery phrase is useless to someone who doesn't know what it is. Alongside the secrets, leave a plain-language note:
- A list of accounts that matter: banks, pensions, insurance, crypto exchanges and wallets, email, the domain names and subscriptions that would keep charging.
- For each, what you'd want done: close it, transfer it, keep it running.
- Who holds which piece, how many pieces are needed and where to recover them.
- Who to call for help: your accountant, lawyer, or a technically minded friend.
Test it, then review it once a year
Before handing anything out, recover the secret yourself from two of the pieces. It takes a minute and it's the only way to be sure the plan works. Then put a yearly reminder in your calendar to check the list: accounts change, people move, and a plan that was right three years ago may point to a wallet you emptied long ago.
It isn't a cheerful job. But an evening spent on it now saves the people you care about months of locked accounts and lost savings later.