The password was never the lock
Most people who try to plan for their own absence stop at the password. They write the long, gnarly string of characters into a notebook, or export it from a password manager, and feel the quiet relief of a job done. The accounts are documented. Someone could get in.
Except they probably can't. Because for almost everything that matters — your bank, your domain registrar, your email, the payment processor that quietly funds your business — the password is only the first of two doors. The second door is two-factor authentication, and it does not open for whoever is holding your notebook. It opens for whoever is holding your phone, awake and unlocked, at the exact moment the code is needed.
That is the gap nobody plans for. Not because it's exotic, but because the security industry spent a decade teaching us, correctly, that a password alone is dangerous. We learned the lesson so well that we forgot to ask the obvious follow-up: if even I can't log in without my phone, how is anyone else supposed to?
Where the second factor actually lives
To see why this is so stubborn, it helps to know where the second factor physically resides — because it is almost never written down anywhere, by design.
When you set up an authenticator app (Google Authenticator, Authy, 1Password's built-in codes), the service shows you a QR code once. Behind that QR code is a secret seed. Your app stores that seed on the device and uses it, plus the current time, to generate the rotating six-digit codes. The seed never appears again. It is not in your password list. It is not emailed to you. It is a value that exists on one phone and, unless you deliberately backed it up, nowhere else. The codes you see are derived from a secret your heirs will never find, because you were never shown it either.
SMS-based 2FA is tied to your phone number, which is tied to a SIM, which is tied to a carrier account — and carriers will not simply hand a grieving relative your line without a death certificate, a probate document, and often a phone store visit. Hardware keys like a YubiKey are a physical object; if no one knows it's the key, it's a USB stick in a drawer. And backup recovery codes — the one mechanism actually meant for this — are usually generated once, glanced at, and closed, because saving them felt like paperwork on a day you were trying to get something else done.
So the real architecture of your digital life is this: a pile of passwords that feel like the keys, sitting in front of a second lock whose key is a secret on a single, biometrically-sealed device that powers off, runs out of battery, and eventually gets wiped or returned to the carrier.
The illusion that writing it down makes it reachable
There's a quiet cognitive move underneath all of this worth naming, because it's the thing that fools careful, competent people. We tend to treat recorded and accessible as the same thing. They are not even close.
Writing your password in a binder is recording. Whether anyone can actually act on it — get past the second factor, receive the SMS, unlock the authenticator — is accessibility, and accessibility is a chain. A chain fails at its weakest link, and a single point of failure that everything else depends on is, in security terms, exactly what you're supposed to eliminate. Your phone has quietly become that single point of failure for your entire identity. Engineers spend their careers designing redundancy into systems so no one component can take the whole thing down. Then they go home and route their bank, their email, and their company's Stripe account through one handset with a fingerprint sensor and tell no one the passcode.
The binder gives a feeling of completion that isn't matched by the underlying reality. That mismatch — feeling done because you recorded something, while the thing remains unreachable — is precisely why this gap survives in households full of smart, organized people.
What "getting in" really requires
Walk the chain forward for a single critical account, your primary email, and the problem becomes concrete. Email is the master key, because nearly every other reset flows through it.
To get into your email, someone needs the password — fine, it's in the binder. Then they need the second factor. If it's an authenticator app, they need the seed, which is gone with your phone. If it's SMS, they need your phone number live and a device that can receive texts, which means an unlocked phone or a carrier transfer that takes weeks. If they somehow reach the "try another way" recovery flow, the provider may demand a recovery code (never saved), a backup email (also locked), or a trusted-device confirmation (the locked phone again). Every fork in the road loops back to the same device.
This is why estates stall for months on things that look trivial from the outside. It is not that the family lacks the password. It is that the entire recovery architecture was built, deliberately and for good reason, to resist exactly the kind of access a grieving person needs — someone trying to get into an account that isn't, on paper, theirs.
What actually closes the gap
The fix is not to weaken your security. It's to make the second factor survivable — to give it the redundancy you'd give any critical system.
Generate and store backup codes for every important account. Almost every serious service offers them. They are the official, provider-blessed way to get in without the device. Generating them takes two minutes per account and converts an impossible problem into a sealed envelope.
Use an authenticator that backs up its seeds. Some apps and password managers can sync your 2FA seeds into the same encrypted vault as your passwords, so the second factor lives wherever the first factor does — not stranded on one phone.
Write down the chain, not just the credentials. For your two or three master accounts — email, password manager, registrar, payment processor — note how the second factor works and where its backup lives. "Password in vault; 2FA backup codes in the envelope labeled X" is worth more than ten documented passwords with no way through the second door.
Make sure someone can unlock the vault itself. A password manager protected by its own 2FA is the same trap one level up. Its recovery path — an emergency kit, a recovery code, a designated emergency contact — has to be reachable too, or the whole carefully-built vault becomes another locked phone.
Notice what all four have in common: they move the second factor off the single device and into something a specific, named person can actually reach. That's the whole job. Not more security. Survivable security.
Where this leaves the people you'd leave behind
If you run something alone — a business, a side project, a household's whole digital life — you are the redundancy that doesn't exist. There is no co-founder with duplicate access, no IT department holding a master key. The second factor that protects you so well every ordinary day becomes, on the one day you're not there, the thing that locks everyone out of the work you spent years building.
This is the quiet problem Heirloom was built around. It's a death-binder for solo founders that treats the second factor as a first-class citizen: a vault for credentials and their recovery paths, a structured handoff so a named person knows which account is the master key and how to actually get through its second door, and beneficiaries who receive not just a password list but a working route in. It doesn't ask you to lower your defenses. It asks you to make them survivable — to give one trusted person a way through, on the day the rest of the chain depends on a phone no one can unlock.
If you've already documented your passwords and felt that small relief of being done, it may be worth checking the second door. You can see how Heirloom closes that gap at heirloom.lumenlabs.works.