The Digital Legacy Blueprint

The problem

It is Sunday afternoon and the phone rings. Mom died Wednesday. The funeral is Tuesday. And the iPhone on her nightstand is locked, the iPad is locked, the laptop wants a fingerprint nobody alive can produce, and the family has just realized that twelve years of photos, the password to the joint checking account, the renewal date on the website domain that runs Dad’s small business, and the autopay information for the mortgage are all sitting behind credentials nobody documented. Apple says the recovery process needs a court order. The court order takes four to eight weeks and several thousand dollars in attorney fees. The grandkids will not see the voicemails she left them. The mortgage might miss a payment before the family can stop it. This call is happening, somewhere in North America, roughly two thousand times a day.

The average adult in 2026 has between one hundred thirty and one hundred eighty password-protected accounts. The average family that experiences a death has documented credentials for fewer than ten of them. Research aggregating post-death account recovery rates estimates that 73% of digital assets become permanently inaccessible within one year of the account holder’s death. That number is not made up of dramatic crypto fortunes — most of the loss is family photos, voice memos with a grandmother’s last birthday, ongoing royalty payments on a self-published book, the small Substack with two hundred paying subscribers, the domain name the family business has used for fifteen years. The dramatic crypto stories are real but rare. The quiet, painful losses are the default outcome. They happen because the work to prevent them takes one afternoon, and almost nobody does that afternoon.

What most people get wrong

They keep a handwritten password list in a desk drawer. The handwritten list feels responsible because it is tangible — a piece of paper in the drawer, updated occasionally, containing the credentials that matter. The list fails in four ways at once. It is out of date within months because passwords change but the list does not. It cannot encode two-factor authentication, so even with the correct password the executor is locked out at the SMS code step. It is a catastrophic security hole during life because anyone who finds the drawer has full access to the bank account. And it is invisible to the executor in death because nobody knows the drawer exists. The handwritten list optimizes for the wrong failure mode — it solves “I might forget my own password” instead of “my family will need access in a crisis.”

They share the master password with a spouse and consider it solved. One-person delegation works as long as exactly one assumption holds: the spouse outlives the account holder, the marriage stays intact, and the spouse remembers and can use the password during a moment of grief and exhaustion. Each of those assumptions has a meaningful failure rate. Shared accidents kill both spouses together. Divorces sever the delegation. A grieving spouse with the master password in her head and a locked phone in her hand still cannot get into the password manager if she does not remember the exact URL, the exact email, or the Secret Key required for first-device sign-in. Single-point-of-failure delegation produces single-point-of-failure recovery. The book treats this as the most common pattern that needs to be replaced.

They believe “the will covers it.” A will names heirs and an executor. It does not unlock an iPhone, does not transfer an Apple ID, does not retrieve photos from iCloud, does not stop a domain from expiring, and does not move cryptocurrency out of a hardware wallet. RUFADAA — the Revised Uniform Fiduciary Access to Digital Assets Act, adopted in some form across 47 US states and the District of Columbia — gives executors limited authority over digital assets, but only when the platform has implemented compliant tools and the account holder has used them. Most platforms have not. Most account holders have not. The EU’s GDPR Article 17 right-to-be-forgotten further complicates inheritance by potentially overriding the account holder’s preferences with the deceased’s privacy rights as a former data subject. The will gets you to the courthouse door. It does not get you past the lock screen.

A working approach

The book is structured around the actual sequence of work an account holder needs to do once and an executor needs to do under crisis conditions. Each chapter has the inventory step, the technical setup step, and the family-conversation step that activates it.

STAGE 1 - Four-tier account audit
  Tier 1: Financial - money or moves money (first 7 days)
  Tier 2: Identity  - prove who they were  (first 30 days)
  Tier 3: Communication - close affairs    (first 90 days)
  Tier 4: Sentimental - photos, voices     (forever lost if missed)

STAGE 2 - Native password-manager delegation
  1Password Emergency Kit + Bitwarden Emergency Access
  Apple Legacy Contact + Google Inactive Account Manager

STAGE 3 - Shamir Secret Sharing for irreversible secrets
  3-of-5 split for master passwords and crypto seed phrases
  Custodian distribution and briefing pack

STAGE 4 - Cryptocurrency and creator-account handoff
  Exchange custodial vs cold storage vs multisig vault
  Substack, Stripe Connect, YouTube, Etsy death policies

STAGE 5 - The Executor Handoff Pack
  One physical envelope, one known location, one annual refresh
  Cover letter, inventory, recovery playbooks, beneficiary map

STAGE 6 - The 30-day family conversation
  Week 1 opening, Week 2 inventory, Week 3 decisions, Week 4 docs

The four-tier audit is the chapter that makes the rest of the book usable. The instinct of every first-time account holder writing a digital inventory is to brain-dump every login they can remember in one undifferentiated list. Within an hour the list reaches eighty entries and stalls. The exhaustive list approach fails because it gives the executor no priority signal — every account looks equally important, which means none of them get attention in the first urgent week after the death. The four-tier model fixes this by sorting accounts by what happens if access is lost: financial accounts (where money disappears), identity accounts (where heirs cannot prove who they were), communication accounts (where contacts cannot be reached), sentimental accounts (where photos and voices are permanently lost). Tier 1 gets attention in the first 7 days. Tier 2 in the first 30. Tier 3 in the first 90. Tier 4 as time allows, but only if the documentation exists. The bonus digital-asset-inventory.csv is the worksheet — one row per account, the six columns are the priority signal an executor can actually act on.

1Password, Bitwarden, Apple, and Google: the four native delegations

The good news embedded in the book is that for the average household, four widely available consumer tools handle 80% of the inheritance problem without any cryptographic complexity. 1Password’s Emergency Kit is a single PDF containing the sign-in address, the email, the Secret Key, and a blank line for the master password. Print two copies, handwrite the master password on each, and place one in a fireproof safe and one in the Executor Handoff Pack. Anyone holding the kit plus the master password can sign in from any computer and access the entire vault. The mechanism is brutally simple, which is also its weakness — never email the kit, never store it in cloud, never combine the kit and the master password in a single digital location.

Bitwarden’s Emergency Access is the free-tier alternative built around a delay rather than a printed kit. You designate trusted contacts who already have Bitwarden accounts, set a waiting period (typically 7 days), and choose whether they get View access or Takeover access. A trusted contact can initiate an emergency access request at any time. You receive a notification, and if you do not deny it within the waiting period, access is granted automatically. The dead-man’s-switch model is elegant — if you are alive and active, you simply deny unauthorized requests; if you are dead or incapacitated, the request proceeds.

Apple’s Legacy Contact, introduced in iOS 15.2 in December 2021, is the first formal mechanism for transferring Apple ID access after death. Settings, then your name, then Sign-In and Security, then Legacy Contact. Apple generates a unique Access Key, the contact stores it, and at the time of need they submit the Access Key plus a death certificate to Apple. Verification takes 1 to 7 business days. The catch: Legacy Contact does not grant access to iCloud Keychain, Apple Cash balances, or end-to-end encrypted data — for Keychain inheritance, the trusted person needs the device passcode plus the iCloud master password, not just the Access Key. As of 2024, only about 8% of eligible iCloud accounts have configured a Legacy Contact, even though setup takes under five minutes.

Google’s Inactive Account Manager is the most flexible of the four and predates Apple’s Legacy Contact by nearly a decade. At myaccount.google.com, under Data and Privacy, you set an inactivity period (3, 6, 12, 15, or 18 months), designate up to 10 trusted contacts, choose which data each contact receives (Gmail, Drive, Photos, YouTube), and optionally configure a Gmail autoresponder and account deletion. After the inactivity period elapses with no Google login, no Gmail receipts, and no Android sign-in, Google sends warnings, then if there is no response, the configured workflow triggers automatically. A 6-month inactivity period is the right middle ground for most households; 12 months reduces accidental triggers for solo or elderly users.

Shamir Secret Sharing for non-cryptographers

The four native delegations all rely on one person holding one secret. That works when you trust one person completely and the person outlives you. It fails when the spouse dies in the same accident, when a marriage ends adversarially, or when the trusted person loses their copy. The mathematical solution is threshold cryptography, and its most accessible version is Shamir’s Secret Sharing — published by Adi Shamir (one of the inventors of RSA encryption) in 1979. The algorithm splits a single secret into multiple shares such that any combination of shares at or above a configurable threshold reconstructs the secret perfectly, and any combination below the threshold reveals nothing.

The book recommends a 3-of-5 split as the default: five shares exist, any three can reconstruct, and the configuration tolerates two lost or destroyed shares. Hold one share back as your own panic copy in a fireproof safe. Distribute the other four among trusted people — typically a spouse, two adult children or siblings, and a long-term trusted friend or attorney — chosen for likely longevity, geographic dispersion (so one fire or flood does not destroy multiple shares), and the ability to coordinate with each other in a crisis. The most important property of Shamir for inheritance is not the cryptography but the social structure: requiring three relatives to talk to each other before accessing the estate prevents the family conflicts that destroy estates more often than any technical failure does.

You do not need to implement the algorithm yourself. The book recommends ssss-js, an offline browser-based tool you download as a single HTML file and run with no network connection. For cryptocurrency seed phrases specifically, Trezor’s built-in Shamir Backup (also called SLIP-39) is the cleanest option — the split happens on-device during wallet setup, and recovery happens on-device by entering shares one at a time. Each share is written by hand on archival paper in two copies, placed in tamper-evident envelopes labeled with the share identifier but not the secret it reconstructs, and distributed with a one-page custodian briefing explaining that they hold a share, how many other custodians exist, what the threshold is, who the executor is, and what the recovery procedure looks like in plain language.

Crypto cold-storage handoff: Casa, Trezor, Ledger

Cryptocurrency is the one category where lost keys are mathematically unrecoverable. No court order recovers a forgotten Bitcoin seed phrase. No customer-service desk resets access to a self-custodied wallet. Chainalysis estimates that roughly 20% of all Bitcoin in circulation — about 3.7 million BTC — is permanently inaccessible due to lost keys, dead owners, and other inheritance failures. The unforgiving mathematics that make cryptocurrency censorship-resistant also make it inheritance-resistant when handled poorly.

The book sorts crypto storage along a security-versus-heir-recovery axis. Exchange-custodial holdings on Coinbase, Kraken, Gemini, or Binance.US are the easiest to inherit — heirs submit a death certificate, will or probate documents, and government ID, the exchange opens an inheritance case taking 30 to 90 days, and the assets transfer to a destination of the heir’s choosing. The trade-off is that you do not control your keys while alive. Most regulated US exchanges in 2026 carry insurance against operational loss but not against custodial failure. A reasonable hybrid: hold 5–10% of crypto holdings on a regulated exchange as emergency liquidity for heirs while keeping the bulk in cold storage, so the family has an easy path to immediate expenses while the more complex recovery proceeds.

For hardware cold storage — Trezor, Ledger, Coldcard — the handoff packet must include the device itself, the PIN code (separate from the device, in the Executor Handoff Pack), the 24-word recovery seed phrase (backup), the list of which cryptocurrencies are on the device, and a step-by-step recovery playbook written for someone with no crypto experience. The device, the PIN, and the seed phrase should never be stored together. The cleanest configuration: device in one location, PIN in the Handoff Pack, seed split via Shamir across multiple trustees. For larger holdings (typically $50,000 or more in a single wallet), multisignature configurations like Casa’s 2-of-3 or 3-of-5 vaults provide built-in inheritance workflows that have processed hundreds of estate transfers without permanent loss. Casa’s plans range from $10/month (2-of-3 with one user-held key) to $250+/month (3-of-5 with high-touch inheritance services). Unchained Capital, Nunchuk, and Sparrow Wallet are alternatives at different points on the cost-control spectrum.

For any meaningful amount of cryptocurrency, engraved steel is the floor for seed storage. Paper degrades, paper burns, paper gets thrown out in a basement cleanup. Cryptosteel, Blockplate, and SteelWallet plates survive fires, floods, and 50 years in a safe deposit box without legibility loss. Default to 24-word seeds rather than 12-word seeds for anything you expect to outlive you — the additional bits of entropy provide meaningful security against future cryptographic advances at the cost of a few more cells engraved on the plate.

Creator account death policies: Substack, Stripe, YouTube, Etsy

The book’s sixth chapter is the one most small-business operators read twice. Domains, hosting, and creator accounts are the income-generating estate — assets that do not just hold value but actively produce it, month after month, as long as someone is paying the renewal fee and answering the support emails. When the account holder dies, these income streams have three possible fates: continuation (heir takes over, income continues), wind-down (heir liquidates the asset responsibly), or loss (account expires or locks and the income stops). Most creator accounts default to loss when no plan exists.

Domain names are the quietest asset class. A domain registered for $15/year that hosts a $200K/year business will quietly expire 45 days after the renewal notice goes to an inaccessible email. The typical .com expiration timeline: days 1–45 grace period (renewable at standard cost), days 45–75 redemption period ($80–$200 fee), days 75–90 pending delete, day 90+ returns to public registration and is often grabbed by squatters within hours. GoDaddy, Namecheap, and Network Solutions have no Legacy Contact equivalent in 2026 — the handoff is generally accomplished by the executor logging in as the deceased and renewing or transferring, which requires the credentials being in the password manager or Handoff Pack. Set auto-renew on a payment method that will not expire for many years (or use a registrar that offers 10-year prepayment), configure renewal notifications to multiple email addresses including the executor’s, and annotate the domain registrar row in your inventory with explicit “DO NOT LET LAPSE” language.

Substack does not publish a formal death policy as of 2026 — handling is case-by-case, but documented executor requests with death certificate and probate documents typically resolve in 1 to 4 weeks. Substack’s payouts run through Stripe Connect, which is a separate inheritance problem: if the Stripe Connect account is registered under the deceased’s individual tax ID, payouts can be frozen until the estate provides updated tax information. Stripe Standard accounts linked to a business entity follow the entity’s structure; Stripe Connect accounts linked to individuals can be paid out to the estate after probate verification; sole-proprietor Stripe accounts have roughly 90 days from notification to provide updated tax documentation before suspension. Notify Stripe within 30 days of death and request guidance on the specific account type.

YouTube has two relevant policies: memorialization (preserving the channel as-is or removing it entirely) and monetization handoff (continuing AdSense revenue). AdSense payouts go through the underlying Google account, which is why configuring Google Inactive Account Manager with AdSense as designated recipient data is the cleanest path. Without IAM, the executor works directly with AdSense support, typically 60 to 90 days to resolve. Etsy is more responsive than most platforms — the death policy allows shop transfer to a designated heir or closure with final sales paid to the estate, requiring death certificate, executor authority documentation, and the heir’s Etsy account (or willingness to create one). Most Etsy cases resolve within 30 to 60 days. For shops with physical inventory or print-on-demand integrations, the executor also needs documentation on where inventory is stored, what integrations are connected, and what active orders are pending fulfillment at the time of death. The bonus family-conversation-scripts.md includes eight rehearsed openers for raising any of these topics in different family contexts, and the executor-handoff-checklist.md is the printable contents-verification list that tapes inside the lid of the physical envelope.

Where this scales

The book proposes a one-afternoon initial pass, an annual refresh, and a 30-day family conversation that turns the documentation from a sealed envelope into an activated plan. The afternoon does the four-tier audit and configures the four native delegations. The annual refresh — anchored to tax day weekend, when you are already reviewing financial records — re-verifies that Apple Legacy Contacts and Google IAM recipients are still valid, updates the inventory for new and closed accounts, refreshes the password manager Emergency Kit if the master password has changed, and signs and dates the Update Log. Five years of dated signatures on the Update Log is itself evidence to your executor that the envelope is current and trustworthy.

The 30-day family conversation is the activation step that turns documentation into a working system. Week 1 opens the topic without envelopes or passwords — just establishing that the discussion is normal and a weekly time to continue. Week 2 walks the four-tier inventory structure (not actual credentials, just the categories). Week 3 makes the decisions about roles: executor, technical assistant, Shamir share holders, Apple Legacy Contact, Google IAM recipients, and backup roles for each. Week 4 closes the loop by showing the family the existence and location of the Executor Handoff Pack, agreeing on the annual update cadence, and walking through the first-three-actions sequence if death occurs. The most important outcome of the 30 days is not perfect documentation but normalization — once a family has talked about this for four weekends, the topic is no longer taboo, and future updates can be handled in five-minute mentions at the dinner table rather than requiring another 30-day arc.

Included with the book

• Digital Asset Inventory Worksheet (CSV) — the four-tier inventory template with the six-column structure (tier, platform, account type, recovery method, delegated to, last updated). Drop directly into a spreadsheet and start filling rows.
• Executor Handoff Checklist (markdown) — the printable contents-verification list you tape inside the envelope lid and use for the annual refresh.
• Family Conversation Scripts (markdown) — eight rehearsed openers for raising the digital legacy topic in different family contexts: road trip, holiday meal, after a friend’s medical scare, during financial planning, with aging parents, with adult children, in a blended family, in a recently bereaved family.

Get the full picture

Readers of this also chose

Questions readers ask

Is this only for older people or people with serious assets?

No. The 73% asset-loss number applies across age brackets — a 35-year-old freelancer with an active iPhone, a Substack, and a small crypto position has more digital handoff exposure than a 70-year-old retiree whose accounts are mostly traditional financial institutions. Younger account holders typically have more concentrated digital risk because more of their life is in cloud services that lock on death. The book is written for anyone who has a smartphone, a primary email, and someone they would want to inherit access to their photos. That is most working adults.

Does any of this replace a will?

No. The Executor Handoff Pack is the operational companion to a will, not a substitute. The will handles legal authority (who inherits what, who is named executor). The Pack handles operational execution (how the executor actually gets in to do the work). You need both. The book explicitly recommends coordinating with an estate attorney licensed in your jurisdiction before implementing the technical workflows.

What if I do not own any cryptocurrency?

Skip Chapter 5 and the book still works. Cryptocurrency is the most dramatic loss category but not the most common — the typical inheritance failure is locked photos, an expired domain, or an unclosed creator account, not lost Bitcoin. Roughly 70% of the book applies to any household with a smartphone and a few cloud accounts. The remaining 30% (Shamir splits, multisig vaults, cold-storage handoffs) is for households with concentrated crypto holdings or other irreversible secrets.

How long does the initial setup take?

One focused afternoon for the core four-tier audit plus the four native delegations (1Password Emergency Kit or Bitwarden Emergency Access, Apple Legacy Contact, Google Inactive Account Manager). Add another afternoon if you are setting up Shamir splits for irreversible secrets. The 30-day family conversation runs in parallel as four weekly check-ins of 30 to 60 minutes each. Total active time across the first month is about 6 to 10 hours.

What if I need a refund?

Checkout runs on Lemon Squeezy. The standard refund window applies. You keep the PDF and the bonus inventory worksheet either way.