Skip to main content
January 24, 2024

Feature Request: 1Password Access after Death, Legacy Contacts

  • January 24, 2024
  • 150 replies
  • 17576 views

I am not planning to die anytime soon, but sometimes things happen.

Beyond securing my 1Password details in an Escrow account, or with a lawyer, or in a bank lockbox, does 1Password offer any means of allowing one or more designated member of the 1Password Families account to access the 1Password account in case of the primary owner's passing?

Apple now offers the ability to add one or more https://support.apple.com/en-us/102631 so that in case of your untimely demise, an Access Key and a Death Certificate allows Apple to grant the holder of both of these to get a new Apple ID that has access to your Apple ID Account.

It may be something 1Password wants to consider, though I realize that reviewing Death Certificates may not be on the high list of priorities for the team!


1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided

Pinned Reply By 1P_Dave

Hello folks, 

It’s been a little while since our last update in this thread, and I just wanted to pop in to say that we’re still here and paying close attention to all the feedback being shared. While we don’t have anything new to share about an emergency access feature right now, please know that the feedback and discussion here aren’t going unnoticed.

With 1Password’s end-to-end encryption, there’s no simple “add a recovery email” solution: access requires the keys to unlock your account, and 1Password doesn’t have them. Securely storing those keys on behalf of customers would introduce significant risk and responsibility, so an emergency access feature needs an intuitive way to securely share or safeguard the necessary keys without compromising the security guarantees people rely on.

For the time being, we’ve published guidance for estate planning using 1Password’s current features: The complete guide to digital estate planning

For those exploring how 1Password’s existing features might fit into an emergency-access plan, one possible approach is to generate a recovery code and share it with a trusted family member who may need access in an emergency, and account for any two-factor authentication by making the authenticator app or physical security key available to that person as well. The recovery code should be stored securely, such as in the trusted family member’s 1Password vault or another location they can access independently: Generate and use recovery codes

To make this plan work, you’ll need to also set up your email account provider’s emergency-access or legacy-contact feature so the trusted person can access the email account associated with your 1Password account. Without access to that email account, they won’t be able to use the recovery code. It also prevents premature use of the recovery code, since someone with your recovery code cannot complete recovery without also entering a verification code that is sent to your email address.

I know this isn’t the most elegant solution, and the feature request for a built-in legacy manager or emergency access feature in 1Password remains open. For now, as the simplest option, we recommend storing your Emergency Kit alongside with your will in a secure place, along with clear instructions on how to use it for your executor or trusted contact.

-Dave

150 replies

1P_Tommy
1Password Employee
1Password Employee
May 17, 2024

Thank for sharing @thedean.

1P_Tommy
1Password Employee
1Password Employee
May 22, 2024

@MerryBit et al.

I wanted ensure you saw the recovery code announcement for families.

https://1password.community/discussion/145903/recovery-codes-for-families-beta#latest

May 27, 2024

@1P_Tommy It's not clear if if a family organizer uses the recovery code of a family members account to recover that members account, does it give them access to the vault items? I mean the whole point of "legacy access" is if they are not available to access their vault themselves, so if the family organizer can't see the contents of the other family members recovered vault, it doesn't solve the issue. thanks.

1P_Tommy
1Password Employee
1Password Employee
May 27, 2024

@lopinc

A recovery code would/could be used by you or your heir in that situation. Assisted recovery from a Family organizer would not need the code and would be one in which you or your heir actively participate. Both require access to the users email. The following may help.

Generate and use recovery codes

May 27, 2024

@1P_Tommy I'm talking about the new beta feature for 1P families that you posted about: https://1password.community/discussion/145903/recovery-codes-for-families-beta#latest

Nowhere on that page does it say if the family organizer would then have access to the other persons vault if the new recovery code method is used, that's what I'm trying to confirm.

The issue with the existing assisted recovery for Families is it requires the other persons involvement as you noted, which in an emergency situation (like death), may not be possible.

1P_Tommy
1Password Employee
1Password Employee
May 29, 2024

The recovery code would allow anyone to access the data in the users account. It is a way for you or anyone to recover the account. Typically the recovery code would be used by you.

Using a recovery code allows Family Organizers and Family Members to self-recover their accounts in case they forget their account password or lose their Secret Key/trusted devices.

Perhaps you're thinking the Organizer is creating a code for the family member? That is not the case, each member would need to to create their own from inside their account. When I create the code I am doing so for my account as the Family Organizer. You or the family member would need to print their own and keep it safe.

tl;dr Yes the Private/Personal vault woud be accessible using this method. The key is self-recover

May 30, 2024

@1P_Tommy No I realize the individual user is creating a recovery code for themselves, but I guess what isn't clear is if the family organizer can use that code without access to that family members email. According to https://support.1password.com/recovery-codes a verification email is part of the recovery flow, so that won't work if the family member is unavailable/incapacitated/etc.

Are you saying the recovery code process for families doesn't require email verification? If so is that recovery flow documented anywhere? Thanks!

1P_Tommy
1Password Employee
1Password Employee
May 30, 2024

Yes, you need to know the email account password and or have access to it no matter the method used. The email is one of the key details for the account.

https://support.1password.com/recovery-codes

When you use a recovery code:

You’ll need access to the email address associated with your 1Password account to verify it’s you.
...

https://1password.community/discussion/comment/711218/#Comment_711218

Both require access to the users email.

May 30, 2024

@1P_Tommy That's unfortunate, so even in the Family account context it doesn't eliminate the catch-22 of needing access to the family members email password that's in their vault which is inaccessible without the email password. :)

I was confused by the statement here: https://1password.community/discussion/145903/recovery-codes-for-families-beta#latest which said under the "Multiple Recovery Methods" section, "1. They won't need to wait on someone else to confirm their recovery" - I thought that could mean that as long as the family organizer doing the recovering verified the process, the family member being recovered wouldn't have to themselves verify. Thanks.

1P_Tommy
1Password Employee
1Password Employee
May 30, 2024

No worries! It can get confusing especially around recovery and adding a new method. Recovery is one thing we want to ensure everyone understands vs. being in a very bad situation.

The statement above would have been from the viewpoint of a user self-recovering their account with a recovery code. The recovery code would take the organizer out of the picture (using the code). They (the organizer) would never know a recovery took place. Again, with the code. To be clear with a recovery code you would not need to provide it to an organizer expect in legacy type situation. At least, that is the only time I can think of you'd provide it to them. Even then, the organizer may not be the heir/executor in charge of your estate. In such a situation, the organizer would likely not need to know the code. Only the executor or some other person you feel comfortable leaving the details to would need to access it.

In an estate-type situation, the executor would likely receive the code with the will and other essential papers. They would also need to know the password to the email account to complete the recovery process.

I would summarize it like this (My description as I might relay it to my children, who are my heirs.)

Recovery code - Self-recover or estate situation.
Recovery from a Family Organizer - assisted recovery or estate situation.

Both recovery options would require access to the email address/account.