The Executor Without a Key: Planning for Digital Assets in a UK Estate

A will is often described as the document that speaks for the dead. In law, it disposes of property and appoints personal representatives to administer the estate. In practice, however, an executor may find that the deceased’s most important records are held behind a password, a two-factor authentication prompt or a provider’s own account-recovery process. The will may give the executor authority over the estate, but it does not necessarily give them the practical means to reach a digital asset.

That gap is becoming more consequential. Email accounts hold correspondence and recovery links. Cloud storage contains invoices, contracts and family records. Social media profiles carry sentimental and commercial value. Cryptocurrency may exist only as a private key. For a small business owner, domain names, payment processor accounts, SaaS subscriptions and customer databases can be essential to keeping the enterprise running after a death. A will alone is rarely enough.

Why a will is not a master key

A will operates on property. It can dispose of shares, money, intellectual property and physical items. Digital accounts are different because they are also governed by contracts between the account holder and the service provider. Those terms and conditions often say who may access an account, what happens on death and whether a transfer is permitted at all. Many providers reserve access to the account holder personally, or offer only a limited legacy, memorialisation or deletion process.

The executor’s legal authority is therefore only part of the picture. A provider may ask for a grant of probate, identification and an indemnity before releasing data. Some will cooperate; others will not. Data protection law and privacy expectations also make providers cautious about handing over inboxes or cloud drives that may contain third-party information. The result is an administrative dead end that can be costly, slow and distressing.

Cryptocurrency illustrates the point most starkly. If the deceased held coins in a self-custodied wallet, the estate may own them in principle, but nobody can move them without the private key or seed phrase. No court order can recreate a lost key. An exchange account may have a bereavement process, but the estate still needs to identify the account and satisfy the exchange’s requirements.

The digital assets that cause the most difficulty

Email and cloud storage are often the first blockage. An executor may need the inbox to find contracts, bills and contacts, but the provider may permit only a data export or a limited account closure. Social media accounts raise separate issues: some platforms allow memorialisation, some allow deletion, and some permit a legacy contact to manage limited features. The rules vary and change.

Crypto requires its own plan. A wallet address is not enough; the estate needs the means to sign transactions or recover the account. Seed phrases should never be placed in a will, because a will can become a public document once probate is granted. They need a secure, documented route that is available to the right person at the right time.

Business systems are the fourth category, and the one most often overlooked. Domain names, hosting, accounting software, payment gateways, e-commerce platforms and social advertising accounts may be held in the name of the company or the individual. If access depends on one person’s email address or mobile phone, the business can stall. Customer data, payroll records and supplier logins may be locked behind that same gate.

What providers actually offer

Many large providers now offer some form of inactivity setting, legacy contact or bereavement request. These tools are useful, but they are not a substitute for planning. They differ in scope, may require setup years in advance and can be withdrawn or changed. A legacy contact may be able to download data but not manage the account; another provider may allow memorialisation but not access. An executor should not assume that a grant of probate will be treated as a universal key.

The safer route: an inventory and clear authority

The practical answer is to separate the legal will from the operational plan. The will can include a clause authorising executors to deal with digital assets and to consent to the release of data, but it should not contain passwords or seed phrases. A separate digital asset schedule, stored securely and reviewed regularly, can list the accounts, the providers, the associated email addresses, the recovery methods and the location of any keys. It should say who should be contacted and what should happen to each asset.

A letter of wishes can sit alongside the will. It is not usually binding, but it can give executors and family members a clear explanation of the deceased’s intentions. For business owners, a written continuity plan is equally important. It should identify who can access critical systems, how domains and subscriptions are renewed, and who can speak to key customers and suppliers.

Practical steps for individuals

Begin with a simple inventory. List email accounts, cloud storage, social media, online banking, investment platforms, crypto wallets and any digital subscriptions. Record the provider, the account identifier and the recovery email or phone number, but do not record passwords in the will. Use a reputable password manager with an emergency-access feature, or store sealed instructions with a solicitor or trusted person.

Review the legacy and inactivity tools offered by major providers. Appoint a digital executor or trusted contact where the provider allows it. Keep two-factor authentication recovery codes in a secure place. Make sure at least one trusted person knows that the inventory exists and how to reach it after death. Update the schedule when accounts change, because an outdated inventory can be worse than none.

Practical steps for small business owners

Business owners should distinguish between personal and company assets. Shares in a company can pass under a will, but the company’s domain name, software licences and payment accounts may be governed by separate contracts. Check who is the named account holder and whether the terms permit transfer on death. Ensure that at least two appropriate people can administer critical systems, with proper authorisation and audit trails.

Document the business’s digital supply chain: hosting, domain registrar, payment processor, payroll provider, accountant and key customers. Put renewal dates and account ownership in the continuity plan. If customer data is held, consider how the estate or successor can comply with data protection obligations without giving unnecessary access to personal information.

The trap of informal password sharing

Sharing a password may seem like a simple solution, but it is fragile. It may breach the provider’s terms, fail after a password change or leave the estate dependent on someone who is not authorised to act. It also creates security risks if the wrong person obtains the credentials. The better approach is documented authority, secure storage and provider processes that the executor can actually use.

A will remains the foundation of estate planning. But for digital assets, it needs support. An executor without a key is not a failure of the will; it is a failure of the practical plan around it. In 2026, individuals and business owners should treat digital access as part of the estate, not an afterthought.