Your Password List Is Paperwork Now, and Your State Decides Who Can Read It

Technology, December 18, 2025: January is when the lockouts arrive. New phone over the holidays, a carrier switch, a laptop replaced with money that had to be spent before year end, and suddenly the authenticator app that lived on the old device is gone along with the codes it held. I get these calls in the first three weeks of the year more than any other stretch, and the pattern almost never varies: the passwords themselves were fine, and the paperwork around them was the thing nobody built. That gap is what turns a ten minute reset into a two week correspondence.

The inventory is the job, not the password

Start with a written list of accounts rather than a list of passwords, because the accounts are what you forget and the passwords are what a manager already holds. Bank and brokerage, the email address each one sends recovery mail to, the phone number on file, the employer portal, the insurance login, the utility autopay, the domain registrar if you own one, and the two or three subscriptions that renew annually and quietly. Write the recovery email beside each entry. That single column is the thing professionals check first, because an account is only as reachable as the mailbox it reports to.

Keep the inventory somewhere separate from the vault holding the credentials. A printed page in the same folder as the deed and the auto titles works, and so does a second file in a different service, provided the two are not locked behind each other. The awkward version of this client stores everything in one place, protected by one passphrase, known to one person, and then travels. The manageable version costs an hour in January and gets updated whenever an account changes hands, which for most households is two or three times a year.

Recovery codes are the part that actually saves you

Every service that offers two factor authentication also issues one time recovery codes, usually at setup, usually on a screen people click past. Those codes are the only route back in when the phone is gone and the carrier is mid transfer. Print them. Put them with the inventory, not in the vault, because a vault that requires a second factor to open is a circle you cannot break from inside. Hardware keys solve the same problem in a sturdier way, and the standing professional advice is to own two, one carried and one left at home in the same folder as everything else.

The National Institute of Standards and Technology is responsible for the federal digital identity guidance that most of these practices trace back to, and the modern version of that guidance leans on length, on checking credentials against known breached lists, and on phishing resistant second factors, rather than on the character rules and forced rotations that were drilled into office workers for two decades. If your household still changes passwords on a calendar, that effort is better spent building the inventory and printing the codes.

Where you live changes who can open the account when you cannot

Nearly every state has adopted some version of the uniform law on fiduciary access to digital assets, but the adoptions are not identical and the practical consequences differ by a lot. In most states the order of authority runs the same way: whatever online tool the provider offers takes precedence, then the instructions in a will, trust, or power of attorney, then the provider's own terms of service. That first item matters more than people expect, because Google's inactive account manager and Apple's legacy contact are settings, not documents, and a setting toggled in an afternoon can override a will drafted by an attorney.

Where the state variation bites is in what an executor or agent must produce, how much of a decedent's email content can be disclosed as opposed to a catalog of who wrote to whom, and whether a power of attorney has to say so explicitly before an agent may touch accounts at all. Some states require a court order for content; some let the provider insist on one anyway. Ask the attorney who drafts your documents to name the digital asset powers in the instrument rather than leaving them implied, and set the provider tools the same week, so the two agree.

Your state also decides what you can demand from a company

The other regional split is consumer side. California, Colorado, Virginia, Connecticut, Texas and a growing number of other states have comprehensive privacy statutes that give residents the right to see what a company holds, to correct it, and to have it deleted, with different thresholds and different response windows. Breach notification is a separate patchwork, and the deadlines and triggers vary state to state. Practically, this means a deletion request that closes an abandoned account in one state may get a polite refusal in another, and it is worth checking your own attorney general's consumer page before assuming a company is stonewalling.

Set a reminder for the first weekend in January, alongside the tax folder you are already assembling. One pass through the inventory, one check that the recovery codes still match the accounts, one look at the legacy contact settings, and the year's worst phone call never happens.