The account list nobody has made yet — and where to keep it

Three different things, and you need all three

An account inventory. A list of what exists: institution, what the account is for, the login name, and where the account confirms identity. No passwords in it. This is the piece almost nobody has and the piece that matters most, because you cannot manage accounts you do not know about.

A password manager. Software that stores credentials encrypted behind one master password, fills them in, and can share specific items with specific people. It replaces the notebook and the sticky label.

An emergency-access plan. A defined route by which a nominated person can reach the credentials when your parent cannot. Most password managers have a feature for this, and it has to be switched on deliberately.

The order matters. The inventory can be made this weekend on paper and is useful immediately. The password manager takes an evening and requires your parent's cooperation. The emergency access takes ten minutes and is the one people skip.

Some links on this page are affiliate links and we may earn a commission if you subscribe through one. Everything here works equally well with the free tiers of most products.

The permission question, first

Using someone else's login, even with their spoken permission, is not automatically the same as being authorised to act for them, and many providers' terms treat it as a breach.

So do these two things before you set anything up.

Ask your parent, explicitly, and write down what they agreed to and when. A dated note signed by them is not a legal instrument, but it is a great deal better than nothing and it settles disagreements between siblings.

Ask an attorney what authority is appropriate for your parent's situation and what documents establish it. This is a short appointment with a clear answer, and it is not something to work out from a comparison article.

Then ask each institution what they offer. Banks, health systems, utilities and government agencies often have a formal route — an authorised representative, a proxy, a trusted contact, a legacy contact — that is designed for exactly this and does not require sharing a password at all. These routes are underused because nobody asks. Ask.

The practical position for most families: use the formal route wherever one exists, and use shared credentials only where the institution offers nothing and your parent has agreed.

Make the inventory first

One page, or one spreadsheet, and it is worth more than any subscription.

For each account record: the institution, what it is for, the login name or email used, the phone number attached to it, whether two-factor authentication is on and what form it takes, whether paperless billing is on, and the renewal or payment date if there is one. No passwords, no PINs, no full account numbers.

Work through these categories to find them all:

- Email accounts, all of them, including the old one that still receives things
- Bank, credit card, brokerage, pension
- Insurance — health, home, auto, life, long-term care
- Utilities, phone, internet, television
- Government and health portals
- Pharmacy and health system logins
- Subscriptions and memberships, including the ones charging quietly
- Shopping accounts with a card stored
- Social media and photo storage
- The mobile phone account itself, and the phone's own passcode

A fast way to find what has been forgotten: look at twelve months of bank and card statements and write down every recurring charge. Almost every family finds two or three accounts nobody remembered.

Choosing and setting up a password manager

The differences between reputable products are smaller than the marketing suggests. Compare on these.

- Family or shared plan, how many people it covers, and the annual price
- Shared vaults or collections, so specific items can be shared with specific people rather than everything with everyone
- Emergency access, and how it works — usually a request followed by a waiting period during which the owner can decline. Check the length of that period and whether it is adjustable
- Recovery. With most, if the master password is lost, nobody can recover the data. Ask what recovery routes exist and write down the recovery key on paper
- Ease of use for your parent, which outweighs every feature above. Sit with them and try it before committing
- Export, in a standard format, so you are not locked in

Setting up, in order: install it on your parent's phone and computer with them present. Set the master password together and write it, plus any recovery key, on paper kept in a home safe or another sensible physical place. Move the twenty accounts that matter, not all sixty. Switch on emergency access the same evening and nominate someone. Then, over following visits, add the rest.

Two-factor authentication and the phone number problem

Two-factor authentication is the single biggest security improvement available, and it is also the thing most likely to lock a family out at the worst moment. Both are true and both need planning.

The issue is that the second factor is usually tied to a device or a phone number. If your parent's phone is lost, replaced, cancelled, or sitting on a bedside table in a hospital, every account protected by it becomes unreachable — including the email account that is the recovery route for the others.

What to do about it, while everything is working:

- Turn on two-factor authentication for the email account first. It is the master key to everything else.
- Generate and print the backup or recovery codes for every account that offers them, and store the printout physically with the master password sheet.
- Where the option exists, use an authenticator app rather than SMS, and set it up on more than one device so a lost phone is not a lockout.
- Do not cancel your parent's phone number without first working through the inventory and moving the second factor on every account attached to it.
- Record who else is on the mobile phone account and whether they can make changes.
- Write down the phone's own passcode and keep it with the master password sheet.

That last line has saved more families more time than any subscription on this page.

Where the paper copy lives

Every digital system needs a physical anchor, and here it is a single sheet: the master password, the recovery key, the phone passcode, printed backup codes, and a note of who is nominated for emergency access on which service.

That sheet goes in a home safe or another deliberate physical place. Exactly one other person knows where. Not a drawer, not the back of a photograph, and not a note on a phone.

Alongside it sits the account inventory, which contains no secrets and can therefore be copied freely to whoever is helping.

Our Caregiver Binder holds both halves of that. Tab 9 is the document index — what exists, where it is kept, who has a copy. Tab 8 is the accounts and paperwork tracker, laid out for exactly the inventory described above. Tab 10 is the family handover sheet, which is where you record who has been given what and when.

Every page is blank and printable, with a filled-in example so you can see what finished looks like. It does not tell you what authority you need over your parent's accounts — that answer comes from an attorney and from each institution. It gives you the place to write it all down so that the answer is not only in your head.

Questions