Who can access online accounts after someone passes away?

The short, uncomfortable answer

In most cases, the legal right to access a deceased person's online accounts is narrow and difficult to exercise. The platforms that hold the accounts are bound by their own terms of service, federal privacy law, and in some cases state legislation. A death certificate and a lot of patience get a family further than a password — but often not as far as they need.

What varies by account type

Different categories of account are treated very differently after a death.

• Financial accounts (bank, brokerage, retirement): These pass through the estate or directly to named beneficiaries, not through your login. The executor presents a death certificate and letters testamentary to the institution, which then transfers or releases the assets — often without ever touching the login credentials.
• Email: Most major providers will not hand over the contents of an inbox to a family member without a court order. Some, like Google, have legacy settings that let you name someone in advance. Without those settings, the path is slow and may not succeed.
• Social media: Platforms vary widely. Many now offer a memorialization option (the account is locked and preserved) or a deletion request. Some require legal documentation. A few have explicit legacy-contact features that let you name someone while you are alive.
• Cloud storage (photos, documents): Providers treat these similarly to email — the data is often inaccessible to family without a court order, or else the account simply closes when it lapses. Legacy settings, where they exist, are the simplest solution.
• Subscription services: These generally stop when the billing card is cancelled or the subscription lapses. There is usually nothing to inherit, and nothing to access.

The executor's authority — and its limits

An executor has broad authority over the estate, but online platforms do not always recognize it. The executor can instruct a financial institution to transfer assets; they may not be able to log into a deceased person's email on their behalf. Several jurisdictions have passed laws granting an executor or authorized fiduciary the right to access digital accounts, but the law varies and the platforms' practical cooperation varies even more.

What actually works in practice

For most families, the practical tools are these, in order of how well they tend to work:

1. Legacy settings set up in advance. Google Inactive Account Manager, Apple Legacy Contact, Facebook Memorialization Request — these are the cleanest tools because they use the platform's own system. If the person set them up before they passed, the process is nearly frictionless.
2. A death certificate and a formal request through the platform's bereavement process. Most major platforms have one, and some will provide limited access or close the account on request. Response times vary widely.
3. Written records of accounts. Even without credentials, a list of what accounts existed helps the executor notify institutions, stop billing, and locate assets.
4. Legal process. A court order can compel disclosure in some circumstances, but this is slow, expensive, and not guaranteed to work.

Accounts that hold real value

Some online accounts hold money that can be claimed: PayPal balances, Venmo accounts, gift card wallets, airline miles, and loyalty points. These are often overlooked in an estate. The executor can typically request transfer or payout by contacting the platform directly with a death certificate and proof of authority. Cryptocurrency is a different matter entirely — if the private keys are not left behind, the assets may be unrecoverable.

The simplest answer is to plan ahead

The families who navigate this most smoothly are the ones whose loved one planned for it. They set up legacy contacts, left a record of their accounts, and used a secure vault to make their digital estate visible to the right people at the right time. Legatus Vault lets you store an account inventory alongside your estate documents, designate who should receive access, and release that information only when the time comes — so the people you trust are handed a map, not a locked door.