Deal with Passwords

When I turn on my computer, it asks me for my password; without it, no one would be able to access any of my files. The same goes for my smartphone and tablet (although mobile devices typically use shorter, numeric passcodes). And in the course of my work and play, I use (at least occasionally) hundreds of Web sites, apps, and cloud services, each of which requires an account with a username and password, and most of which contain at least some information that would be interesting or useful to my family and friends when I’m no longer around.

In fact, “useful” is an understatement: without access to certain accounts, no one will be able to carry out my wishes—whether that means shutting them down, preserving them for posterity, or keeping them going under new ownership.

You should already have a list of your most important accounts (see Inventory Online Accounts). Whether you have just a handful of accounts or thousands, and whether you consider the information in them to be trivial or essential, you should take steps to ensure that the accounts are accessible to your digital executor—and that you’ve clearly stated what you want to be done with them. In this chapter, I discuss how to go about doing that.

Use a Password Manager

I’ve spent much of my writing career urging readers to protect themselves, their data, and their online privacy in various ways—backups, encryption, secure Web browsing, and so on. One of my most important recommendations, which I’ve come back to time and time again in books, articles, presentations, and courses, is to be smart about the way you use passwords.

If you’d like all the details on improving your password security, you can read my book Take Control of Your Passwords. But let me just offer a few key pieces of advice from that book here:

• Don’t reuse the same password for more than one site or service, no matter how inconsequential you think the account is.
• Choose passwords that are long, random, and contain a mix of uppercase and lowercase letters, digits, and punctuation.
• Use a password manager app (such as 1Password, LastPass, or Dashlane) to generate, store, and fill in passwords for you.

Password managers don’t solve every password problem, but they do make it incredibly easy to be safe. You choose a single, strong master password that will unlock your password manager, and that becomes the only password (or, realistically, one of just a few) that you need to remember.

So, if you don’t already have excellent (strong and unique) passwords, this is a good time to think about changing your habits to protect your data for yourself and for your heirs—and a password manager makes that process as painless as it can be.

For the purpose of this book, a password manager serves another essential function: It provides a repository of all your accounts and their credentials, so your digital executor knows what accounts you have and how to access them. In other words, it simplifies your digital will; you need not provide a long list of accounts and passwords, but rather just access to your password file and the master password that unlocks it. (In fact, there may be an even better way to give your digital executor access to your password manager, as I discuss ahead in Give Your Digital Executor Access to Your Passwords.)

If you have hundreds of accounts that all use the same password—or that use different but weak passwords—the process of changing your passwords and moving all that information into a password manager could take a while. In my personal and professional opinion, it’s well worth the time and effort. But in the meantime, at least create a simple password list (see the following sidebar) to include in your digital will; something is better than nothing.

Highlight Key Accounts

Of the nearly 900 accounts in my own password manager, only a handful contain (or provide access to) information that would be crucial to my digital executor in the days after my death. For example, my bank accounts, insurance accounts, email accounts, Dropbox account, and social media accounts might all require immediate attention for one reason or another, whereas there’s no urgency for my accounts for frequent flyer programs and online discussion forums to be shut down.

You will know better than anyone else which accounts are likely to require timely action, and you can reduce your digital executor’s stress considerably by making a note of which accounts those are. So, take a few minutes to scroll through your list of accounts and identify those that fall into these categories:

• Email: Access to your email accounts is crucial if your digital executor is to manage your other accounts and handle a variety of other details for you. (See Deal with Email.)
• Social media: You may want your digital executor to take action of some kind with your Facebook, Twitter, and other social media accounts—posting a final message, for example. (See Deal with Social Media.)
• Money: Any account that involves money—banking, investments, insurance, utilities, PayPal, and so on—may be important for both your digital executor and the executor of your conventional will (if they’re two different people).
• Key documents: Medical, financial, and other records that exist only in online accounts may need special treatment, and the accounts themselves will usually need to be closed (although in some cases it may be better for ownership to be transferred to someone else).
• Cloud storage and backups: Services that store your files in the cloud in one form or another (Amazon Cloud Drive, Backblaze, CrashPlan, Dropbox, Google Drive, and many others) should be readily available to your digital executor. (See Handle Other Cloud Data and Handle Backups.)

Most password managers offer one or more ways to label or categorize accounts. For example, 1Password lets you apply user-defined tags to any item, and LastPass lets you organize logins into folders. Whether you use the tools built into your password manager or even write a simple list, make it obvious which accounts your digital executor needs to pay attention to, and include in your digital will a note about how you’ve identified those items.

Also include in your digital will detailed instructions for any accounts that need special consideration. Your digital executor will probably close most of them eventually, but if you want to pass an account on to someone else or take some other action that wouldn’t otherwise be obvious, be sure to write it down.

Give Your Digital Executor Access to Your Passwords

I said earlier that you could simply provide your digital executor with access to your password file and your master password. For example, you could include your master password in your digital will along with the location (on your computer or elsewhere) of the file containing your passwords. Although that will usually work, I’d like to suggest two alternatives that are both safer and more flexible:

• Emergency access: A number of password managers, including LastPass and Dashlane, enable you to set up emergency access to your passwords for one or more specified people. When a person on your designated list requests access and a predetermined length of time passes, they’re granted access to your passwords (or a selected list of passwords).
• Shared folders or vaults: LastPass lets you set up a folder, put whatever passwords you like in it, and share it with up to five people. 1Password provides a number of methods by which you can securely share a vault (1Password’s term for its secure storage files) with someone else—you can either put a vault in a shared Dropbox folder or use a 1Password Families account (if your digital executor is in your family) or a 1Password Teams account (if your digital executor is in your company). A number of other password managers offer comparable features.

In all these cases, if you change a password, the people with whom you’re sharing your passwords always see the latest version, which is obviously not the case if you simply write your current password on a list—and they never need to know your master password. The other nice thing about shared folders or vaults in particular is that you can give a family member access to certain passwords now—that can be handy for accounts you and your spouse need to access, for example.

Regardless of how you choose to give your digital executor access to your passwords, make sure there’s a “Passwords” heading in your digital will and, underneath it, spell out exactly what your digital executor needs to do to get in to your accounts.

Whether or not access to your password manager’s data file also requires access to your computer or mobile device, make sure you include the password or passcode to all your computer(s) and mobile device(s) in your digital will. They might be redundant if they’re also in your password manager, but because they’re so important, it doesn’t hurt to have that extra insurance.