Account Recovery Sheet
Where your important accounts are and who to contact — no passwords.
Details
account recovery sheetUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
| Prepared by | [name] |
| Date | October 14, 2026 |
| What | Provider | Account reference | Who to contact |
|---|---|---|---|
| [add one account per line] |
Keep this somewhere a trusted person could find it if you could not.
What is an Account Recovery Sheet?
An account recovery sheet lists where your important accounts are and who to contact about them — without recording a single password. It exists so that someone you trust can find and act on your accounts if you are in hospital, abroad or worse. Without it, the family of an incapacitated person often cannot even discover which bank holds the mortgage, let alone reach the right department to talk about it.
People write these for a spouse or executor, for elderly parents whose affairs someone else may have to pick up, and for themselves after the experience of losing a phone and finding that every recovery route ran through it. Small businesses keep an equivalent for accounts a single person controls — the domain registrar, the payment processor, the company email — because a sole administrator who leaves or falls ill can lock an organisation out of its own systems for weeks.
What anyone else may lawfully do with your accounts is a separate question from whether they can find them. Access to a deceased or incapacitated person's accounts is governed by succession, probate and mental capacity law, and by each provider's own terms — some offer a legacy contact or inactive account process, and some treat sharing credentials as a breach of contract regardless of intent. Rules differ by country and by provider, so check the position with a qualified adviser and with each provider's published policy rather than assuming.
This sheet is deliberately not a password list. It does not give anyone access, and it should not: writing passwords on paper defeats the security of every account at once and creates a document that is dangerous to lose. It is also not a will, not a power of attorney and not an authority to act — those are formal legal documents with their own requirements. Use this to point the right person at the right institution, and take the authority question to a qualified adviser.
What to put in an Account Recovery Sheet
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issued to (full name) | For example: James Whitfield |
| Accounts | One per line: What | Provider | Account reference | Who to contact |
| Note for whoever finds this optional | For example: The paper file in the desk drawer has the policy documents. The password manager is on my… |
How to write an Account Recovery Sheet
List institutions, not credentials
For each account, record the provider, what it is for, the last four digits or a partial reference, and the department and phone number to ring. ‘Building society — mortgage, account ending 4417, bereavement team on 0800 123 4567’ is what a family member needs. The username, the password and the security answers stay out of it entirely.
Name the accounts everything else depends on
One email address usually controls the recovery of every other account, and one phone number receives the codes. Say which email and which number those are, and who the providers are, because that is the first thing a helper has to work out. Do the same for a domain registrar or a business email account if you run anything online.
Point at where the passwords actually live
If you use a password manager, name it and say where the master password and recovery kit are held — a sealed envelope with a solicitor, a safe, a specific person — without writing either on this sheet. If you keep two-factor recovery codes, say where. The sheet's job is to tell someone where to go, not to be the thing they take.
Record subscriptions and anything that auto-renews
Streaming, storage, software, domains, insurance, gym membership and anything else charging a card monthly. Families of an incapacitated or deceased person routinely spend months cancelling charges they cannot identify from a statement line. Note the provider, roughly what it costs and how often, and the cancellation route. Include anything where lapsing would cause damage, such as a domain renewal.
Store it somewhere findable but secure
A safe, a locked drawer, or with a solicitor alongside your will — and tell exactly one or two people that it exists and where. A sheet nobody knows about achieves nothing; a sheet on the kitchen noticeboard is a map for a burglar. Date it and review it once a year, because accounts, phone numbers and the people you trust all change.
Common mistakes
- Writing passwords on the sheet turns one lost piece of paper into the compromise of every account you own.
- Leaving out the recovery email and phone number means the person helping cannot get past the first verification step on any account.
- Storing the only copy in an encrypted file that opens with a password only you know makes the sheet useless in exactly the situation it was written for.
- Never telling anyone the sheet exists means it is found while clearing the house, months after it would have helped.
- Treating the sheet as an authority to act leads people to log in as you, which many providers treat as a breach of their terms and which can complicate a probate application.
Frequently asked questions
Should I write my passwords down for my family?
No. Use a password manager and record where its master password and recovery kit are held, rather than the credentials themselves. A written password list is dangerous if lost and goes out of date quickly. It also does not solve the real problem, which is legal authority: being able to log in is not the same as being entitled to, and providers increasingly enforce that distinction.
What is a legacy contact?
Several large providers let you nominate someone in advance who can request limited access to your account after death, or who is notified when an account has been inactive for a set period. The names, scope and process differ by provider. Setting these up directly with each provider is more reliable than any paper arrangement, because it works through their own verified route.
Can my family access my accounts if I die?
It depends on succession law where you live, on whether a personal representative has been appointed, and on each provider's terms. Some providers have a bereavement process that releases data or closes an account; some will not release contents at all without a court order. This is a question for a qualified adviser alongside your will, not one to settle by leaving a login on paper.
Where should I keep an account recovery sheet?
Somewhere secure and findable: a home safe, a locked filing drawer, or with the solicitor holding your will. Tell one or two trusted people that it exists and where it is. If you keep a copy digitally, keep it encrypted and make sure at least one other person can open it — otherwise it fails in exactly the circumstances it was written for.
How often should I update it?
Once a year, and after anything that changes the picture: a new bank, a changed phone number, a new email address, a closed account, or a change in who you would want to hold it. Put the review date on the sheet itself. An out-of-date sheet sends a helper to a department that no longer exists and undermines trust in the rest of it.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.