How to access a deceased person’s online accounts

Do not start by logging in with their password

It is natural to reach for a saved password or an unlocked phone, but possession of a deceased person’s credentials does not by itself establish the authority to use the account. Logging in may violate the provider’s terms of service or applicable law, so unless your authority is already confirmed, it is not the safe shortcut it looks like.

The correct path is the provider’s official process for a deceased user. It is slower, but it creates a documented, provider-authorized path and reduces the risk of a later dispute. Start there before you try any credential you happen to hold.

The law that decides who can direct access

Most U.S. states have adopted a law called the Revised Uniform Fiduciary Access to Digital Assets Act — RUFADAA. It sets a priority order for whose directions control the release of a deceased person’s digital data, and knowing that order tells you where to look first. It governs disclosure, not ownership — it does not by itself decide who inherits the value in an account or grant blanket control of it.

The order is: first, a qualifying online tool the person set up directly with the provider to say what should happen — one they could later change or delete; then, if there is no such tool, an express direction in a will, trust, power of attorney, or other record; and if neither exists, the provider’s terms of service, with the statute’s default rules applying where those terms are silent. A direction the person left inside the service itself outranks even the will.

• First: a qualifying online tool set with the provider (for example, a legacy contact)
• Second: an express direction in a will, trust, or power of attorney
• Third: the provider’s terms of service, with statutory defaults where they are silent

Email and cloud storage accounts

Email is often the master key to everything else, because password resets for banks, subscriptions, and social accounts run through it. Treat it as a priority, but reach it through the provider’s tool rather than the inbox itself.

Google offers a feature called Inactive Account Manager, set up inside a Google Account, that lets a person choose who receives a downloadable copy of their data after a period of inactivity — it shares that data, it does not hand over the password. Where nothing was set up in advance, Google has a separate request process for a deceased user’s family or representative.

Apple offers a Legacy Contact for an Apple Account. A Legacy Contact needs two things to gain access: the access key the person generated for them, and a certified death certificate. Even then, it cannot reach purchased movies, music, and books, or the passwords and payment data stored in the iCloud Keychain. Providers differ on what they allow: for a Microsoft consumer account, Microsoft says known credentials may be used to close the account, and otherwise the account eventually closes for inactivity — obtaining its content generally requires a valid subpoena or court order and is not guaranteed. Because these processes change, search the provider’s current help pages for “deceased” rather than relying on a remembered link.

Social media accounts

Social accounts usually offer two paths: memorialize the account so it stays visible as a remembrance, or delete it. On Facebook, a memorialized account shows “Remembering” beside the name and cannot be logged into by anyone; a Legacy Contact the person chose in advance can manage the memorialized profile — accept friend requests, update the profile photo, or request removal — but cannot read private messages or log in as the person.

If no legacy contact was set, someone with the right documentation can still ask Facebook to memorialize the account. Permanent removal is more restricted: it may be requested by a verified immediate family member or the estate’s executor, and Facebook requires its specified proof of death and of authority — an obituary alone does not establish that you may delete the account. The same general pattern — memorialize, or request removal as verified next of kin with documentation — applies across most major platforms, though the exact steps and the names of the settings differ and change over time.

Cryptocurrency and other blockchain assets

Cryptocurrency splits into two very different cases, and confusing them wastes time. Coins held on an exchange — a custodial account like a brokerage — can usually be claimed through that exchange’s estate process with the same probate documents a bank would want: a death certificate and court-issued letters or a small-estate affidavit.

Self-custody crypto is different and far less forgiving. Access depends on a valid signing or recovery route — most often a private key or written seed phrase, though some setups use a working wallet and PIN, an additional passphrase, multi-signature or social-recovery arrangements. If no valid route remains, the funds are effectively unreachable: no company, court, or executor can override the cryptography to recover them. A seed phrase is not itself the asset — it is a highly sensitive access credential. If the person left a hardware wallet, a written seed phrase, or a note about where the keys are, treat that document as the key to the asset: search for it as carefully as you would a stock certificate, and store anything you find securely.

Password managers and stored logins

A password manager can be the single most useful thing the person left behind, because it holds the keys to everything at once — which is exactly why it is locked hardest. Some password managers offer a designated emergency-access feature the person can set up in advance, so access passes to a chosen person after a waiting period. Distinguish that from ordinary owner-recovery material — a printed recovery kit or a master-password note — which lets whoever holds it unlock the vault but is not the same as an authorized, designated handoff.

Whether either was set up is a matter of the specific service and what the person configured before death. Check the password manager’s own help pages for its emergency-access or recovery process, and look among the person’s papers for a printed recovery kit or master-password note. Secure any credentials you find, and confirm your provider and legal authority before you use them rather than logging straight in.

Stop the recurring charges first

Separate from the question of access is a practical, time-sensitive one: subscriptions and recurring charges keep draining the estate until someone stops them. Streaming services, cloud storage, app subscriptions, memberships, and auto-renewing software can quietly bill a closed or frozen account and generate exactly the kind of small, repeated loss an executor is responsible for catching.

Work from the person’s recent bank and card statements to find recurring charges, then cancel each through the provider’s account-closure or bereavement process. Cancelling the payment card may stop the charge from going through, but it may not cancel the underlying subscription — and whether an unpaid balance becomes a claim against the estate depends on the contract and applicable law. Use the provider’s closure process rather than relying on the card alone.

What this cannot tell you, and where to confirm it

This is general guidance, not legal advice, and the digital-asset rules turn on your specific state’s version of the law and on each provider’s current process, both of which change. It does not decide who inherits the value in an account, how it is taxed, or whether a particular provider will accept a small-estate affidavit instead of court letters.

Where an online account holds real money or property — a bank or brokerage login, an exchange balance, a monetized channel — treat it like any other estate asset: confirm how it transfers before you rely on a login. Use the state comparison to open your jurisdiction’s reviewed route, and confirm any digital-asset question that carries legal or tax weight with a licensed attorney in the relevant state.