Planning Access to Digital Accounts and Online Records

Most people now hold key parts of life online. Bank accounts, email, photos, health portals, and benefit accounts all sit behind passwords. If you get sick or die, your family may need access to some of those accounts. This guide shows how to plan that access now, in a safe way, so the right person can get in and the wrong person cannot.

Key takeaways

• Make a list of your key accounts. Do not list passwords in the same place.
• Use a password manager to hold strong, unique passwords.
• Turn on two-factor authentication for email and money accounts first.
• Set up legacy contacts and account tools where sites offer them.
• Tell your executor where the list lives and how to get access.

Why digital access needs a plan

Think about what sits online for you. Your email holds reset links for most other accounts. Your bank and benefit accounts hold money and key records. Your phone holds photos and contacts. If no one can get into your email, they may not be able to reset other passwords or even find bills that need to be paid.

At the same time, sharing passwords too widely is a risk. Older adults reported $2.4 billion in losses to fraud in 2024 (Federal Trade Commission, Protecting Older Consumers 2024, via the hub statistics table). A plan must give access to one or two trusted people, and keep access away from all others.

State laws also matter. Most states have laws that let a named fiduciary, such as an executor or an agent under a power of attorney, ask a company for access to some digital records. The company may still require proof, such as a death certificate or court papers. A clear plan and the right forms make that process much faster.

Step 1: List your key accounts

Write down the accounts that matter most. Keep the list short and focused at first.

For each account, write the site name, your user name, and what the account is for. Do not write the password next to it on paper. Store passwords in a password manager, as the next step shows. Keep the list with your will or with your important document organizer. See our guide on creating an important-document organizer.

• Email accounts.
• Bank, credit card, and investment accounts.
• Social Security, Medicare, and other benefit accounts.
• Health portal accounts.
• Phone, cloud photo, and cloud storage accounts.
• Bills you pay online, such as power, water, and phone.
• Social media accounts.

Step 2: Use a password manager

A password manager is an app that stores your passwords in a locked vault. You recall one strong master password. The app recalls the rest for you. Browsers and phones have built-in managers. Standalone apps exist too.

The Federal Trade Commission advises you to make passwords long, at least 12 characters, and to use a passphrase made of random words if that helps you recall it (FTC, Creating Strong Passwords, checked 2026-11-08). Let the manager create a unique password for each account. Do not reuse the same password on more than one site. If one site loses your password in a breach, a reused password can open your other accounts too.

Pick a manager from expert reviews. Set a strong master password that you use for no other account. Write that master password down and store it in a sealed envelope in a safe place, such as a home safe or a locked file, and tell your executor where it is. Do not store it on a note stuck to your screen.

Step 3: Turn on two-factor authentication

Two-factor authentication means a site asks for a second proof in addition to your password. The most common form is a code sent by text or email. The code is most often six digits and expires fast (FTC, checked 2026-11-08). A thief who steals your password still cannot get in without that second proof.

Turn this feature on first for your email, your bank, and your password manager. The FTC notes that an authenticator app or a security key gives more protection than a text code, if the site offers those options. Pick the strongest option you can use with ease.

Plan for backup too. Save the backup codes a site gives you in the same safe place as your master password. If you lose your phone, those codes are how you, or your trusted person, can still get in.

Step 4: Set up legacy and trusted contacts

Many large sites let you name a person who can act after your death or if you cannot act. Apple, Google, and Facebook all offer a form of this tool, under names such as legacy contact or inactive account manager. Set these up while you can log in yourself. Tell the person you named that you named them.

Also check your bank and investment firms. Some let you name a trusted contact. That person does not gain access to your money. The firm can call that person if it fears fraud or cannot reach you.

Talk with your family about social media too. Say if you want an account closed, kept as a memorial, or left alone. Write that wish down with your account list. Our sibling guides on preparing a will and on wills, trusts, and beneficiary designations can help you fit digital wishes into your wider plan.

Step 5: Tell your executor how this works

Your executor or agent needs to know three things.

Walk them through it once in person. Show them the envelope and the list, but do not hand out passwords to a wide group. One or two trusted people is enough. Update the list when you open a new key account or close an old one.

• That an account list exists and where it is kept.
• Where the sealed master password is kept.
• Who you named as legacy contacts and what you want done with social media and photos.

Who covers what

Coverage note: this topic is not a health care service, so Medicare and Medicaid do not pay for it.

• Medicare: Medicare does not pay for password managers, phones, or digital planning help.
• Medicaid: Medicaid does not pay for these tools either.
• Private pay: Many password managers built into your phone or browser cost nothing. Paid manager apps charge a fee if you choose one. Any lawyer fee to add digital access terms to a will or power of attorney is private pay. Ask about the fee first.

Sample Situation

Robert is 76 and pays all his bills online. His wife, Anne, does not know his passwords. Robert makes a list of his email, bank, benefit, and bill accounts, with user names but no passwords. He moves all his passwords into the password manager on his phone and lets it create new, unique passwords for his email and bank. He turns on two-factor authentication for both accounts and saves the backup codes in a sealed envelope in their home safe. He names Anne as his legacy contact on his phone and email accounts. He then shows Anne where the list and the envelope are kept and tells his executor, his son, the same facts. When Robert has surgery the next year and stays in the hospital for two weeks, Anne can pay the bills on time with the access Robert set up for her.

Keep the plan up to date

Review your list once a year. Delete accounts you closed. Add new ones. Check that your legacy contacts are still the right people. Check that the sealed envelope still holds the current master password and backup codes. A short review keeps the plan useful when your family needs it most.

Your next step

Digital access is one part of estate planning. See our main section on paying for care for how care costs and benefits fit into your wider plan, and keep your will and account list together so your executor can find both fast.

Sources

• https://www.uniformlaws.org/committees/community-home?CommunityKey=f7237fc4-74c2-4728-81c6-b39a91ecdf22:
• https://support.apple.com/en-us/102631
• https://support.google.com/accounts/answer/3036546:
• https://www.facebook.com/help/1568013990080948/.
• https://www.finra.org/rules-guidance/guidance/faqs/frequently-asked-questions-regarding-finra-rules-relating-financial-exploitation-seniors: