Building a digital accounts and passwords inventory for your parent

What an inventory is, and what it is not

An inventory answers one question: what accounts exist, and where would somebody find them?

That is a different question from who is allowed to use them. Knowing a password is not the same as having authority to access an account, and the two get muddled constantly. Providers have their own rules, and the legal side depends on documents your parent may or may not have. Ask an attorney what authority your parent's documents actually give you, and ask each provider what they accept. Write both answers down next to the relevant accounts.

So the inventory is administrative. It records that an account exists, which provider holds it, which email address it is tied to, whether it bills automatically, and where the credential is kept. It does not need to contain the credential itself, and mostly should not.

Build it with your parent, not about them. Sit down together with a laptop and a printed sheet, and treat it as household admin, which is what it is. Most people find it far less uncomfortable than the conversation they were dreading, because it is concrete: accounts, providers, renewal dates.

The seven categories to sweep

Work through these in order rather than trying to remember accounts at random. Each one has a reliable place to look.

Financial: banks, credit unions, cards, brokerage, pension, annuity. Find them from paper statements and the bank's own list of direct debits.

Bills and utilities: power, water, gas, phone, internet, insurance, property tax, HOA. Find them from the last twelve months of bank statements.

Government: Social Security, Medicare, the state DMV, the county tax portal, the VA if it applies.

Email and phone: the recovery layer, and the most important two entries on the whole list.

Health portals: each practice, the hospital system, the pharmacy, the plan.

Subscriptions: streaming, delivery, memberships, storage, antivirus, anything renewing annually.

Social, photo and cloud: the accounts holding photographs, which are often the ones the family cares about most.

To find what you have forgotten, search your parent's email for the words welcome, receipt, invoice, renewal and verify, then read a full year of bank statements line by line.

• Financial: banks, cards, brokerage, pension
• Bills and utilities
• Government: Social Security, Medicare, DMV, county, VA
• Email and phone: the recovery layer
• Health portals: practices, hospital, pharmacy, plan
• Subscriptions and annual renewals
• Social, photo and cloud storage

The columns the list actually needs

One row per account, and these columns. Keep it deliberately boring.

Account name. Provider. Website or app. Username or the email address used to log in. Where the password is kept rather than the password itself. Which email address and which phone number receive the recovery codes. What the second factor is: a text message, an app, a physical key, a security question. Auto-pay yes or no. Which card or account it bills to. Approximate amount and renewal date. And a notes column for anything odd.

The column people leave out and later need is the recovery one. Everything else can be reconstructed. The recovery route usually cannot.

Do not put the passwords in the sheet. Put them in a password manager and record in the sheet that they are there. If your parent will not use a password manager, write the credentials on paper, keep the paper in one known place, and record in the sheet where that place is.

Mark each row with the date you last verified it. An inventory nobody dates rots quietly.

• Account, provider, website
• Username or login email
• Where the password is kept, not the password
• Recovery email and recovery phone number
• Second factor: text, app, key, question
• Auto-pay, billing card, amount, renewal date
• Date last verified

The recovery layer is the whole game

Two entries matter more than the other hundred: the email address and the phone number that everything else resets through.

Write down which email address is the recovery address for each account, who can get into that inbox, and what happens if the provider stops it. Then write down which phone number receives the verification codes, which physical phone that is, who pays that bill, and what happens if the number is disconnected.

This is the failure people run into most often. A phone contract gets canceled after a move or a bereavement, and every account tied to it becomes unreachable at once. Canceling a phone line is a small, sensible-looking piece of admin with a very long tail.

So add three lines to the inventory. Which number gets the codes. Who pays for it. Do not cancel it until every account has been moved, and here is the date that was completed.

If your parent uses a landline for verification calls, note that too, along with what happens to it if the house is sold or the line is moved.

What the providers themselves offer

Several large providers have a built-in setting for exactly this, and it has to be set by the account holder, not by a family member afterwards. Doing this together, now, is worth more than any spreadsheet.

Apple has a Legacy Contact setting. Google has an Inactive Account Manager, which lets the account holder choose who is notified and what is shared after a period of inactivity. Facebook has a legacy contact. Microsoft, LinkedIn and most large services have their own processes. Password managers usually offer an emergency access feature with a waiting period.

What these forms generally ask for is the same: the name and contact details of the person, what they may see, and how long a delay applies. Your parent fills them in, sitting next to you, in about twenty minutes for all of them.

Record in the inventory which of these has been set up, for whom, and on what date. Then ask an attorney how these settings sit alongside your parent's other documents, because that is a legal question and it varies. The setting is administrative; its effect is not.

Where the master record lives

Decide this deliberately, because a badly stored inventory is worse than none.

The reasonable options. A password manager with emergency access configured, which handles the credentials and the sharing properly. A printed copy in a fireproof box or a safe at your parent's home, with one duplicate held by one other named person. A safe deposit box, provided somebody can actually get to it, which is worth checking with the bank rather than assuming.

What not to do: email it to yourself, put it in a shared cloud folder with a family group, keep it in a note on a phone, or write passwords on the inside cover of the address book.

Write down in the binder where the master record is and who holds the second copy. Not the contents. The location. That single line is what makes the whole system work when somebody else has to use it.

Then tell the people who need to know that it exists and where. A perfect record nobody knows about is not a record.

The review rhythm

Twice a year, and after four specific events. Put it in the same calendar entry as something else you already do, such as the insurance review in October, and add a second date in the spring.

What the review covers: any new account since last time, anything closed, any change of email address or phone number, any card that has been reissued and now breaks an auto-pay, subscriptions nobody uses, and the date column.

The four events that always trigger an early review: a change of phone number or carrier, a change of bank or card, a house move, and any change in who is helping with the admin.

One more thing worth doing once a year: try a recovery. Pick one low-stakes account and go through the password reset, with your parent, to check that the recovery email and phone are what the inventory says they are. It takes five minutes and it is the only way to know whether the record is true.

Write the date of the review at the top of the sheet and initial it.

Questions