Which Password Manager Survives Death? 1Password vs Bitwarden vs LastPass vs Proton Pass
A 2‑am hospital parking lot showdown reveals why most password managers fail your family. I compare 1Password, Bitwarden, LastPass, and Proton Pass and give a 30‑minute weekend fix.
It’s 2 a.m. in a Portland hospital parking lot. Your sister is on FaceTime, frantically typing every variation of your dad’s name into his Gmail login. The screen flashes “Wrong password.” She’s already called the IT help desk, the lawyer, and the hospice nurse. The only thing that could stop the endless subscription charges on his Netflix is the master password to his password manager.
Which manager actually lets an executor get in?
Answer‑first: 1Password and Proton Pass provide a legally‑recognized emergency recovery path that complies with Oregon’s RUFADAA §4 (the Revised Uniform Fiduciary Access to Digital Assets Act), letting a court‑appointed executor retrieve the master key within days. Bitwarden and LastPass require a separate court order or a manual key hand‑off, which often stalls for weeks.
Under Oregon’s RUFADAA §4, service providers must honor a valid executor request for digital assets, but only if the provider has a documented recovery mechanism. 1Password and Proton Pass meet that requirement; Bitwarden and LastPass do not without additional legal paperwork.
Mechanically, each service stores your master password differently:
- 1Password: Generates an Emergency Kit (a PDF with the master password and secret key). You can mail or store it physically. The executor presents the kit plus a death certificate; 1Password unlocks the vault.
- Proton Pass: Uses Shamir secret sharing (splits the master key into N pieces, requires M of them). You assign trusted contacts; any M can reconstruct the key.
- Bitwarden: Stores the master password only in the user’s head. It offers a “Trusted Contacts” feature, but the contact receives only a one‑time code that expires if not used within 24 hours.
- LastPass: Legacy contacts get a recovery email link that only works if the account is still active; once the account is deactivated for inactivity, the link dies.
What the law actually says
Answer‑first: Oregon adopted RUFADAA §4 in 2020, which compels providers to give a fiduciary (executor, personal representative, or digital executor) access to a deceased’s digital assets when presented with a death certificate and a valid court order.
RUFADAA §4 requires service providers to comply with a fiduciary’s request for digital assets, provided the request is accompanied by proper legal documentation such as a death certificate and executor appointment.
In practice, many providers ignore the statute until forced by a subpoena. Ajemian v. Yahoo! (Mass. 2017) showed a court ordering a provider to hand over email content despite the provider’s privacy policy. Oregon courts have cited that case when interpreting RUFADAA, but the language is still vague, leaving providers to decide how much effort they’ll expend.
What the companies actually do
Answer‑first: 1Password’s policy (updated Jan 2023) explicitly states they will honor a court‑ordered request and that the Emergency Kit is the preferred method. Proton Pass’s documentation (Dec 2022) says the Shamir shares are “legal‑grade” and can be handed to a fiduciary. Bitwarden’s help center admits they will comply with a subpoena but offers no built‑in emergency kit. LastPass’s terms (Nov 2022) limit legacy access to “active accounts” and warn that dormant accounts may be deleted after 12 months of inactivity.
1Password’s official policy (Jan 2023) confirms they will unlock a vault for a court‑authorized executor using the Emergency Kit, directly satisfying RUFADAA §4 requirements.
Bottom line: If you rely on a provider that only offers a “legacy contact” without a legal recovery method, you’re betting on goodwill, not law.
Why mainstream advice is dangerous
Everyone on TikTok says, “Just tell your spouse your passwords and you’re done.” That’s flat‑out wrong. A spouse without a legal appointment cannot compel a provider to hand over data. The will alone does not grant access; the provider’s policy does. Without a formal recovery mechanism, you’ll repeat my dad’s eight‑month nightmare.
This does NOT mean you should hand your master password to anyone on a sticky note. It means you should store it in a secure, legally‑recognizable format—like 1Password’s Emergency Kit or Proton Pass’s Shamir shares—so an executor can retrieve it under RUFADAA.
Weekend‑action: Set up a recoverable vault in 30 minutes
Pick the manager you already use. The steps below work for 1Password and Proton Pass; if you’re on Bitwarden or LastPass, you’ll need to add a trusted contact and write down the master password manually.
- Log into your password manager on your laptop.
- Navigate to the “Emergency” or “Trusted Contacts” section.
- Generate the Emergency Kit (1Password) or create Shamir shares (Proton Pass). Choose a 3‑of‑5 split for flexibility.
- Print the kit or write the shares on separate index cards. Store one card in a fire‑proof safe, another in a sealed envelope in your home safe, and the third with your attorney.
- Invite two trusted contacts (spouse, adult child) via the app’s built‑in invitation. Confirm they receive the recovery code or share.
- Take a photo of the confirmation screen and email it to yourself for a digital backup.
- Update your executor’s contact info in the vault’s “Legal” tab.
Done. You just reduced an 8‑month post‑death headache to a 2‑hour one. Do the next one next weekend.
Frequently Asked Questions
Can my executor access my 1Password vault after I die?
Yes, if you enable 1Password's Emergency Kit and share the master password with a trusted contact, the executor can open the vault. Oregon follows RUFADAA §4, which obligates service providers to honor a valid court order or executor request.
Does RUFADAA apply to Bitwarden?
Bitwarden is a California corporation, but RUFADAA is a state law that many providers voluntarily honor. Bitwarden’s policy states they will comply with a valid subpoena or court order, which aligns with Oregon’s RUFADAA §4.
What is the difference between LastPass’s legacy contact and Proton Pass’s secret sharing?
LastPass legacy contacts receive a one‑time recovery code; they cannot change settings. Proton Pass uses Shamir secret sharing, splitting the master key among multiple trusted contacts, requiring a threshold to reconstruct it.
Is a digital will enough to give my spouse access to my passwords?
No. A digital will is a statement of intent, not a legal instrument. Without a court‑authorized executor or a service‑provider‑approved recovery method, the spouse remains locked out.
How do I set up emergency access this weekend?
Pick a manager, generate the master password, write it on your Emergency Kit, and add at least two trusted contacts via the provider’s built‑in sharing or Shamir feature. Store the kit in a sealed envelope in your home safe.
What’s the biggest obstacle you’ve hit trying to get into a loved one’s account? Share your story in the comments.