The password problem

Ask a hundred people what their digital estate plan is and ninety of them will say some version of the same sentence. “My wife knows my passwords.” “It's all in a notebook in the desk.” “My son can get into everything.”

That is not a plan. It is three separate problems wearing one coat.

It fails technically, because the password is no longer the lock. It fails practically, because the thing that generates the second factor gets switched off in the first week. And it fails legally, because knowing a credential and being authorised to use it are different questions, and the second one is answered by a criminal statute.

The phone is the account now

For most of the accounts that matter, the password is one of two factors and it is the less important one.

The second factor is almost always tied to a physical device or a phone number: an SMS code, an authenticator app, a passkey held in a secure enclave, a hardware key on a keyring. A password without the device is a key without a keyhole.

Which produces the most common irreversible mistake families make in the month after a death. Somebody cancels the mobile line. It is a sensible-looking economy — the bill arrives, the person is gone, the account is closed. And with it goes every SMS verification code, every account-recovery route that runs through that number, and frequently the two-factor app itself if the phone is then wiped or sold.

Do not disconnect the number until the accounts are dealt with. Keep the phone charged, keep it unlocked if you lawfully can, and keep the line active. A few months of a mobile bill is the cheapest insurance in probate administration.

The other half of this is that the credential vault is usually excluded from the tools built for exactly this purpose. Apple's Legacy Contact documentation is explicit that a legacy contact does not receive “data stored in your iCloud Keychain (payment information, passwords, and passkeys).” Google's Inactive Account Manager releases an export of selected data, not credentials. A Facebook legacy contact never logs in at all. Every one of the online tools deliberately stops short of handing over the keys, which means the password problem survives all of them.

Three statutes, and one of them is a felony

This is the part that surprises people, and it should be said carefully: the ordinary case of a spouse logging into a dead partner's email is not one anybody is prosecuting. The risk here is not that a widow gets arrested. It is that the conduct sits on the wrong side of statutes that other parties — a hostile beneficiary, an employer, a litigation opponent, a platform's counsel — can point at, and that a fiduciary who does it has no defence if the access is later questioned.

Florida's chapter is Chapter 815, “Computer-Related Crimes.” §815.06 — “Offenses against users of computers, computer systems, computer networks, and electronic devices” — makes it an offence to willfully, knowingly, and without authorization or exceeding authorization access a computer, system, network or electronic device knowing that the access is unauthorised. The baseline violation is a third-degree felony, with second- and first-degree enhancements for damage above $5,000, fraud schemes, disruption of governmental or public services, or conduct endangering life.

Federally, the Computer Fraud and Abuse Act, 18 U.S.C. §1030, uses two phrases: acting “without authorization” and “exceeding authorized access.” In Van Buren v. United States, 593 U.S. 374 (2021) — decided June 3, 2021, 6–3, Barrett J. — the Supreme Court narrowed the second one. Exceeding authorised access means going into areas of a system that are off limits to you, not using access you legitimately have for a purpose the owner would dislike. That is a real and welcome narrowing. But the Court expressly did not resolve the “without authorization” clause, which is the clause that covers logging into an account that is not yours.

And on that clause the case law is less comfortable. In United States v. Nosal, No. 14-10037 (9th Cir., July 5, 2016), the Ninth Circuit held that a former employee who accessed a system using the password of a current employee — shared with her permission, but without the employer's — acted “without authorization.” The password was given freely. It was still unauthorised access, because the person entitled to authorise was not the person who handed over the credential.

Then the Stored Communications Act, 18 U.S.C. §2701, adds a separate offence for intentionally accessing without authorisation a facility through which an electronic communication service is provided, and thereby obtaining stored communications. This is the statute that made providers say no to grieving families for a decade, and it is why Chapter 740 is drafted as a consent mechanism rather than an override.

Put together: the credential is not the authority. The authority comes from the account holder's consent, or from a statute, or from a court.

What Chapter 740 does and does not bless

Florida's Fiduciary Access to Digital Assets Act contains one sentence that solves a meaningful slice of this, and one that closes the rest.

§740.05(5) provides that a fiduciary with authority over the tangible personal property of a decedent, ward, principal or settlor has the right to access the property and any digital asset stored in it, and is an authorized user for the purpose of computer fraud and unauthorized computer access laws, including under chapter 815. That is a genuine statutory safe harbour. The personal representative who takes the decedent's laptop under §733.607 and opens it is an authorised user by operation of law, and §815.06 does not reach them.

§740.05(2) then draws the line. A fiduciary's authority over a digital asset is subject to the terms-of-service agreement except as §740.003 provides, is subject to other applicable law including copyright law, is limited by the scope of the fiduciary's duties, and — the clause that matters here — “may not be used to impersonate the user.”

Logging in as the deceased is impersonating the user. Even with the correct password. Even with the best intentions. Even where the decedent would obviously have wanted it. The statute gives a route, and the route is a written request to the custodian under §740.006 or §740.007 — not the login screen.

• Opening the decedent's own device: authorised. §733.607 plus §740.05(5).
• Reading files stored on that device: authorised. §740.05(5) reaches digital assets stored in the tangible property.
• Logging into a remote account as the decedent: not authorised. §740.05(2)(d), and outside Chapter 740, the CFAA and the Stored Communications Act are in the frame.
• Asking the custodian, in writing, with a death certificate and certified letters: the actual mechanism. §740.007 for the catalogue, §740.006 for content, §740.06 for the 60-day clock and the route to a circuit court order.

What a properly drafted digital-assets clause says

The problem is solved by four things, and only one of them is a document.

• A password manager with emergency access, configured. This is the single highest-value step, and it is not legal work. A named recovery contact, a waiting period you choose, and a vault that opens to them if you do not respond. It reaches every account, not just the three big ecosystems, and it hands over credentials that the legacy tools deliberately withhold.
• The online tools set. Apple Legacy Contact, Google Inactive Account Manager, Facebook memorialisation. Under §740.003(1) an online-tool direction overrides a contrary instruction in a will, trust, or power of attorney. Ten minutes, and it outranks the rest of the plan.
• Express consent in the will and the trust. Not “my executor may deal with my digital assets.” The clause has to give the personal representative express consent to disclosure of the content of electronic communications, because that is the specific thing §740.006 requires before a custodian will release content. Without those words the estate gets the catalogue under §740.007 and nothing more.
• The express grant in the durable power of attorney. §740.008 requires the power of attorney to expressly grant the agent authority over the content of electronic communications. Florida's power-of-attorney statute does not supply that authority by default — it comes from Chapter 740, not Chapter 709 — so it has to be written in. A superb durable power of attorney drafted for banking does not reach the email unless somebody put the sentence in.

And one thing the clause must not do: contain the passwords. A Florida will is deposited with the clerk within 10 days of death under §732.901, and the probate file is a public court record. (The inventory under §733.604(1) is confidential and exempt; the will is not.) Credentials go in the password manager and the seed phrases go in a safe. The documents say that they exist and where, never what they are.

The honest summary of this entire entry: the password is the least durable part of the plan and the most dangerous part to rely on. Replace it with consent — recorded in a settings page, in a will, in a trust, and in a power of attorney — and the family never has to decide whether to guess.