Protecting Your Digital Legacy: Plain-English Guide

When someone dies or becomes seriously ill, their family is often locked out of the photos, messages and accounts that matter most. Your digital legacy is everything you leave behind online: photos in the cloud, email, social media profiles, saved passwords and online accounts. Big tech companies will not hand over passwords, even to grieving relatives, but most now offer tools you can set up in advance to choose who gets access. This guide explains those tools in plain English, how to set them up in an afternoon without weakening your security, and what your family can do if nothing was arranged. It is written for individuals, families, older people and very small business owners. App menus change from time to time, so if a setting has moved, search for its name in the company's own help pages.

Key takeaways

Use the official tools, not shared passwords. Apple Legacy Contact, Google Inactive Account Manager and Facebook legacy contacts let you choose who gets access, without giving anyone your password today.
Companies will not give out passwords. Google says it cannot provide passwords or login details for a deceased person's account, so planning ahead saves your family a long process.
Your password manager is the master key. Set up its emergency access feature or store its emergency sheet with your will, so one person can reach everything else.
Write a simple digital list. A list of your important accounts and what you want done with each one, kept with your will, guides your family without exposing secrets.
Review it once a year. People, phones and accounts change. Check your legacy contacts at the same time as your other annual paperwork.

Why planning ahead matters

Most online accounts are protected by passwords and two-step checks, such as a code sent to your phone. That protection is exactly what you want while you are alive, but it means a partner or child cannot simply log in after you have gone. Companies treat requests from relatives very carefully, because criminals also pretend to be bereaved family members to steal accounts.

Without a plan, families can face:

Lost photos and memories stored only in a cloud account nobody can open.
Bills and subscriptions that keep charging a bank card, and online accounts nobody knows exist.
Profiles left open to misuse. An unattended social media or email account can be taken over and used to scam friends.
Accounts deleted for inactivity. Google says that if no plan is set up, it may delete an account that has been inactive across Google for at least two years.
Slow, uncertain requests. Each company has its own forms and evidence, usually including a death certificate, and some decisions are final.

Sharing your passwords on a sticky note is not the answer. It weakens your security today, the passwords go out of date, and logging in as someone else can break a company's terms. The tools below are designed for this job.

The main legacy tools compared

The details below come from each company's own help pages, checked in October 2026.

Service	Tool name	Where to set it up	What your chosen person gets
Apple (iPhone, iPad, Mac, iCloud)	Legacy Contact	Settings, then your name, then Sign-In & Security, then Legacy Contact	Photos, messages, notes, files and device backups, after sending Apple an access key and a death certificate. Not saved passwords, passkeys or payment details, and not films, music or books you bought.
Google (Gmail, Photos, Drive, YouTube)	Inactive Account Manager	myaccount.google.com/inactive	Up to 10 people can be emailed and, if you choose, download the types of data you pick, once your account has been inactive for the period you set.
Facebook	Legacy contact and memorialisation	Facebook settings, under memorialisation settings	The person can look after a memorialised profile, for example changing the profile photo, pinning a post about the funeral and managing tributes. They cannot log in as you or read your messages.
Password managers	Emergency access or emergency kit (names vary)	Inside the password manager's settings or account page	Depends on the product: some let a trusted person request access after a waiting time, others rely on a printed emergency sheet.

Set it up in an afternoon

Apple Legacy Contact

Make sure your device runs iOS 15.2, iPadOS 15.2 or macOS Monterey 12.1 or later.
Open Settings, tap your name, then Sign-In & Security, then Legacy Contact, then Add Legacy Contact. On a Mac, use System Settings.
Choose the person. They do not need an Apple device or Apple Account, but Apple says they must be over the age limit in their country (13 in many places) to request access. You can add more than one, and each can make decisions on their own, including deleting your data permanently, so choose people who will agree.
Share the access key Apple creates. You can send it by iMessage, or print it and keep it with your will. Apple calls this key extremely important, because your contact needs it, together with your death certificate, to request access.
If you lose track of the key, you can view it again from the same Legacy Contact screen.

Google Inactive Account Manager

Go to myaccount.google.com/inactive while signed in.
Choose how long Google should wait without any sign of activity before it acts. Google judges activity from things like your recent sign-ins, your My Activity history, Gmail use and Android phone check-ins.
Add up to 10 trusted people and their phone numbers. Google uses the phone number to check that only that person can download your data.
Pick which data each person can download (for example only Google Photos for one person, everything for another) and write the message they will receive.
Decide whether your account should be deleted after it is shared. Your contacts are not told when you set this up; Google only emails them once your account has been inactive for the period you chose.

Facebook

In Facebook settings, find the memorialisation settings and choose a legacy contact, a family member or friend who will look after your profile.
Tell that person you have chosen them.
Think about whether you would rather your account were memorialised (kept as a place for friends to share memories) or removed, and write your wish in your digital list. Facebook's help pages explain the current options.

Meta says only friends and family can ask for an account to be memorialised, and that people under 18 cannot choose a legacy contact, although parents who lose a child can ask to become that child's legacy contact.

Your password manager

A password manager is an app that stores all your passwords behind one main password. See the Password Managers Explained for Everyone Guide. Because it opens everything else, plan for it carefully.

Emergency access with a waiting time: Bitwarden, for example, lets premium users invite a trusted contact who can later request access. If you do not reject the request within the waiting time you set, access is granted automatically. You choose between View (read-only) and Takeover (the contact sets a new main password and gets full control). View is the safer choice for most families.
Emergency kit: 1Password, for example, gives you an Emergency Kit, a document with your sign-in address, email and Secret Key, and a space to write your password. 1Password suggests keeping a printed copy somewhere safe, such as with your passport or birth certificate, and giving a copy to someone you trust, such as a person named in your will.

Whatever product you use, make sure the waiting time is long enough that you would notice a request you did not expect, and that your trusted person knows the feature exists.

Write a simple digital list

Official tools cover a few big companies. A short written list fills the gaps. Keep it with your will or with the person who will deal with your affairs, and do not put passwords in it unless it is stored as securely as your will.

Important accounts: email, cloud photos, banking apps, pensions, shopping and utility accounts, domain names and any business accounts.
Subscriptions: streaming, software, cloud storage and anything else that takes regular payments.
Your wishes: for each account, keep, download, memorialise or close.
Where the keys are: which password manager you use, who has emergency access and where the printed emergency sheet is kept.
Devices: where your phone and computer are and who knows the passcodes, if you choose to share them.
Crypto assets: if you hold cryptocurrency, note where the wallet and recovery details are kept, because these usually cannot be recovered by anyone else. See the Cryptocurrency Scam Awareness Guide.

If you keep important photos only in one cloud account, consider a second copy as well. See the Backing Up Personal Data Guide.

If nothing was set up

Families can still ask companies for help, but expect forms, a death certificate and waiting.

Google: immediate family and representatives can ask Google to close the account, ask about funds held in it, or ask for some of its content. Google reviews each request carefully, cannot give out passwords and says closure is final: it cannot hand over the contents later.
Apple and Facebook: both have request processes for relatives, explained on their help pages. Apple's Legacy Contact, if it was set up, is the quickest route.
Do not log in using the person's password, even if you know it. It can lock the account, trigger security alarms and break the company's terms.
Watch for scams. Criminals target bereaved families with fake debt demands and offers to "unlock" accounts. Check any request through the company's official website.

The accounts of someone who has died can also be misused for identity fraud. See the Identity Theft Recovery Guide.

Where to get help

Company help pages: Apple: How to add a Legacy Contact and Google: About Inactive Account Manager. For a Google account where no plan was set up, use Google's deceased user request page.
UK: if a dead relative's account has been taken over or used to scam people, follow the NCSC guidance on recovering a hacked account, and report any money lost to your bank and to Report Fraud, which the NCSC describes as the UK's reporting centre for cyber crime. In Scotland, contact Police Scotland on 101.
Legal advice: for wills and estates, speak to a solicitor or will writer. This guide is not legal advice.

Common failure patterns

Setting up a legacy contact but losing the key. Apple's access key is essential. Print it and keep it with your will.
Choosing people who disagree. Each Apple Legacy Contact can act alone, including deleting everything. Choose people you trust to agree, or just one.
Passwords written in the will itself. Wills may be read by many people and can become public records after probate in some countries. Keep secrets in a separate, secure place.
A too-short waiting time on emergency access. If a request is approved automatically before you notice, a trusted person, or anyone who has taken over their account, gets in early. Pick a waiting time of days, not hours.
Old contacts never updated. An ex-partner or a phone number you no longer use can still be listed years later.
Asking Google to close an account too fast. Closure is final, so download what the family wants first.

Practitioner checklist

Add at least one Apple Legacy Contact and print the access key.
Set up Google Inactive Account Manager and choose what each person gets.
Choose a Facebook legacy contact and tell them.
Set up emergency access or store an emergency kit for your password manager.
Write a simple list of important accounts and your wishes for each.
Keep the list and printed keys with your will, not in it.
Tell your chosen people where everything is.
Make a second backup of irreplaceable photos.
Review all of this once a year, or after a big life change.

Protecting Your Digital Legacy Guide: Plain-English Steps to Stay Safe