Digital Legacy & Vault Apps

The "my family can't get into my email / phone / password manager" disaster is preventable in 30 minutes. Set up the free big-three (Apple, Google, Bitwarden Emergency Access) today; layer on a vault app or a sealed envelope for the long tail. For the password-manager half see Self-Hosted Passwords; for vital-doc storage see Self-Hosted Vital Docs; for the broader index see Estate, Will & End-of-Life Planning; for the will see Wills & Online Will Services.

Free platform legacy features (★ ★ do these today)

• ★ ★ Apple Legacy Contact — free; iOS 15.2+ / macOS 12.1+ Apple ID feature; named contact gets access to your iCloud (photos, notes, files, mail) after presenting a death certificate + access key. Set this up under Settings → Apple ID → Sign-In & Security → Legacy Contact. Generates a printable PDF for your contact — print it, hand it over.
• ★ ★ Google Inactive Account Manager — free; configurable inactivity timer (3–18 months); on trigger, can notify trusted contacts, share specific Google services (Drive, Gmail, Photos), and optionally delete the account. Configure under myaccount.google.com → Data & Privacy → Make a plan for your account.
• ★ Facebook Memorialization / Legacy Contact — free; a named friend can pin a final post, accept friend requests, update profile photo. Or: choose to delete on death.
• ★ Instagram Memorialization — free; family can request memorialization or removal with a death certificate.
• LinkedIn / Twitter / Reddit / TikTok — varying processes; usually require a death certificate; memorialization or deletion only, no ongoing access. Document who handles each in your letter.
• Microsoft / Outlook — no formal legacy program; family must contact via the Microsoft Custodian of Records process and may be denied. Plan around this — keep important Outlook docs duplicated to a vault you can pass on.

Password-manager emergency access (★ ★)

• ★ ★ Bitwarden Emergency Access — free OSS; the most underused free legacy tool in 2026. Designate a trusted user; set a wait period (1–30 days). On request, they get read-only or full takeover unless you cancel within the window. The single most powerful free digital-legacy primitive. See Self-Hosted Passwords.
• ★ 1Password Family / Business — Recovery Kit + Family Organizer — paid; Family plan lets a family organizer reset another member's account. Print the Emergency Kit PDF and store it in your safe / safe-deposit box.
• Dashlane Emergency Contact — paid; similar wait-period mechanic.
• Self-host KeePass / KeePassXC — free OSS; legacy is "give your survivor the kdbx file + master password somehow." Sealed envelope works.
• gopass / pass — free OSS; legacy is "give your survivor your GPG key + the password store git repo." Engineer-flavored.

All-in-one estate vault apps (paid)

• ★ Everplans — paid (~$75/yr); the comprehensive estate vault; documents, account list, wishes, contacts; named deputies get access on trigger. The 2026 default for "I want one place for all of it." See also Insurance & Vital Documents.
• ★ Cake — free + paid; lighter; end-of-life-wishes-flavored.
• Trustworthy — paid; "family operating system" pivot; sharing + automations; nice UI.
• GoodTrust — paid; digital-only focus (social media, email, photos).
• Aftervault — paid; smaller player.

Self-host / OSS approach (★ free path)

The combo most self-hosters land on:

1. Bitwarden (free / Vaultwarden self-host) with Emergency Access configured.
2. Paperless-ngx (see Self-Hosted Vital Docs) for scanned vital docs; encrypted backups (see Backup & Disaster Recovery).
3. A family-only Joplin / Obsidian / Notion vault with the "if I die" letter and account inventory.
4. A physical sealed envelope in the home safe or safe-deposit box: master password (or recovery key for hardware-key 2FA), location of vault, instructions. Updated annually.
5. Apple Legacy Contact + Google Inactive Account Manager configured.

The account inventory (★)

Maintain a single file (in your password manager or vault) listing:

• Email accounts — primary, recovery, secondary; each with current 2FA method.
• Phone carrier — SIM PIN, account PIN, recovery contact.
• Financial — banks, brokerages, retirement, crypto exchanges, hardware-wallet recovery seed location (NOT the seed itself in software).
• Subscriptions — see Subscription Management; these otherwise auto-charge after death.
• Domains / hosting / cloud — DNS registrar, cloud accounts, repos.
• Photos / cloud storage — iCloud, Google Photos, Dropbox.
• Social / identity — what to memorialize vs delete.

2FA / hardware-key consideration

• Hardware security keys (YubiKey, etc.) are great for security and awful for legacy. Have at least one backup key stored in a safe / safe-deposit box with documented label.
• TOTP backup codes printed and sealed.
• SMS 2FA recovery — note that a survivor can usually get SIM access with a death certificate, but plan ahead.

License / pricing

• Apple Legacy Contact, Google Inactive Account Manager, Facebook / Instagram Memorialization: free.
• Bitwarden Emergency Access: free OSS (Bitwarden free + paid plans both include).
• 1Password, Dashlane Emergency: paid.
• KeePass, gopass, pass: free OSS.
• Everplans, Trustworthy, GoodTrust, Aftervault: paid.
• Cake: free + paid.

Pick this if…

• Free path, do today: Apple Legacy Contact + Google Inactive Account Manager + Bitwarden Emergency Access + sealed envelope.
• Want one paid vault for everything: Everplans.
• Lighter, end-of-life-wishes flavor: Cake.
• All-OSS self-hoster: Vaultwarden + Paperless-ngx + family Joplin/Obsidian + sealed envelope; configure Bitwarden Emergency Access.
• Digital-only worry: GoodTrust.
• Microsoft / Outlook household: plan around Microsoft's lack of legacy program — duplicate important data to a passable vault.