Legacy drawer checklist: the digital-life chapter

Why the digital chapter is different

Every other chapter of a legacy drawer points at something physical: a policy in a folder, a key on a hook, a will at the notary. The digital chapter points at things that are locked by design. Your phone, your email and your bank app are built so that nobody but you can get in, and they do not make an exception for grief.

That creates a trap. The obvious fix, writing the passwords down in the binder, turns the binder into the most dangerous document in the house. The right fix is to leave a map: which tools exist, which emergency features you have switched on, who the named contact is, and where the one master secret is kept.

What Apple Legacy Contact does and does not cover

Since iOS 15.2 you can name a Legacy Contact for your Apple Account. After your death, that person can request access using the access key you generated and a death certificate.

According to Apple's own description, the Legacy Contact gets:

• Photos, messages, notes, files, contacts, calendar entries, device backups and other data stored in your Apple Account.

The Legacy Contact does not get:

• Movies, music, books or subscriptions you bought with your Apple Account.
• Anything stored in iCloud Keychain: saved passwords, payment cards, passkeys.

That last point is the one people miss. If your bank, email and password-manager logins live in iCloud Keychain, the Legacy Contact cannot see them. The feature returns your photos to your family; it does not hand them your digital keys.

If you have not set a Legacy Contact at all, Apple requires legal documentation: generally a death certificate, and in the US, Israel and several other places a court order naming the heir and authorising Apple to grant access. Some countries accept alternative paperwork, but the process takes time and paperwork your family would rather not do.

For the binder: write whether a Legacy Contact is set, who it is, and where the access key is kept (it can be stored on the contact's device or printed). Remind the family that it covers Apple data only.

Google Inactive Account Manager

Google's equivalent works on inactivity rather than a death certificate. In Inactive Account Manager you choose how long Google should wait after you stop using the account, name up to ten trusted contacts, and decide which data (Gmail, Drive, Photos, YouTube and so on) each of them receives. You can also tell Google to delete the account afterwards. Google notes that an account left inactive for two years with no plan may be deleted.

For the binder: whether it is set up, the waiting period you chose, and who the trusted contacts are. If your Google account receives bank or government email, say so; that is the account your family needs first.

Password managers and the one master secret

A password manager reduces the digital chapter to a single sentence: "All passwords are in [manager]; the master password is in the sealed envelope in the safe; [name] has emergency access." Most managers offer some form of emergency or family access, where a named person can request access and gets it after a waiting period unless you decline. Set it up, and write in the binder that it exists.

If you do not use a manager, the honest alternative is a sealed envelope with the handful of passwords that matter (primary email, phone unlock, the manager itself if you later get one), kept apart from the binder, with the binder saying where the envelope is. Keep the list short. Thirty passwords in an envelope are thirty passwords that will be out of date in a year.

Whatever you do, the binder itself holds no passwords. If it is ever found by the wrong person, they learn that a password manager exists. They do not get in.

The rest of the digital checklist

Item	What to write in the binder
Phone unlock	Where the passcode is kept (envelope, trusted person), not the passcode. Which person has Face ID enrolled as an alternate, if anyone
Primary email	The address, which bank and government services write to it, where the password lives
Two-factor codes	Which app or device generates them; whether backup codes are printed and where
Online banking and brokers	Which banks have apps on your phone (the Banks chapter has the accounts); note that the family should contact the bank, not log in as you
Crypto	Which exchanges or wallets exist and where recovery phrases are stored. Never the phrases
Social media	Which accounts, and what you want: memorialised, deleted or left. Facebook and Instagram offer memorialisation; most others delete on request with a death certificate
Subscriptions and cloud storage	Where the family photo archive actually is (iCloud, Google Photos, a drive at home) and what will stop being paid when the card is cancelled
Domains, websites, side businesses	Registrar, hosting, who the technical contact is, renewal dates
Devices	Laptop, tablet, external drives: what is on them and whether they are encrypted

Three mistakes that undo the whole chapter

1. Setting up a Legacy Contact and telling nobody. The contact needs to know they were named and where the access key is.
2. Changing the master password and not updating the envelope. Put a date on the envelope and check it at every binder review.
3. Treating the phone as the binder. A locked phone is the problem the binder exists to solve. Print the binder, or hand a password-protected file to one person.

Keeping the chapter current

Review it every 6 to 12 months, and immediately after a new phone, a new password manager, a new email address or a new bank app. The digital chapter goes stale faster than any other, because services change and so do your habits.

Manila has this digital-life chapter built in as one of its eleven, with questions that ask where things are kept rather than for the secrets themselves. The app works offline on your iPhone, never stores a password, and produces a printed binder with tabs so the digital map sits next to the rest of your family's instructions.