Who Gets Into Your Vault If You Cannot?

Everything good about a password manager comes from one property: nobody except you can open it. Not a hacker, not an employee of the company, not someone with a subpoena. The provider genuinely cannot read your vault, and that is the entire security model.

It is also a design with an obvious consequence that almost nobody plans for.

If you cannot open it, nobody can.

What this looks like in practice

Consider what is actually in there after a few years of good habits: the bank, the mortgage provider, the pension, the domain registrar, the email account every other reset flows through, the photo library, the utility accounts, the subscriptions still billing a card.

Now consider a family trying to settle affairs without any of it, or a business partner trying to keep a company running after an accident. Every individual account has its own recovery process, most of those processes send a code to an email address nobody can reach, and the thing that would have untangled all of it in ten minutes is sitting right there, encrypted, permanently.

The better your password hygiene, the worse this problem is. Unique, strong, unmemorable passwords on everything is exactly the behaviour the software encourages, and it is precisely what makes the vault irreplaceable.

Where emergency access sits

Not one free tier we checked includes it.

That is a consistent industry position rather than a quirk of one vendor, and it is worth naming plainly: every free password manager produces a vault that dies with its owner.

NordPass is the one unresolved row — its pricing page lists Emergency Access without marking the free column. We are not going to infer an answer on this of all subjects, so if you are on NordPass Free, ask them.

How it generally works

Implementations differ, and you should read your own provider's documentation rather than trust a summary, but the common shape is:

1. You nominate a trusted contact.
2. They can request access at any time.
3. A waiting period starts, and you are notified.
4. If you decline during that window, nothing happens.
5. If you do not respond, access is granted.

The waiting period is the clever part. It means you are not handing someone a key today — you are handing them a key that only works if you are unable to object, which is exactly the condition you are planning for.

The alternatives, honestly

If upgrading is not something you want to do, there are two other defensible arrangements.

A written copy, stored properly. Master password and recovery details on paper, in a safe, with a will, or with a solicitor. This works, it has worked for centuries, and its weakness is that it is a permanent key with no waiting period and no way to revoke it if the relationship changes.

A deliberate decision that nobody gets in. Entirely legitimate. Some people would rather their accounts die with them than create any route in. The important word is deliberate — the problem is not choosing this, it is arriving at it by accident because nobody read a pricing table.

What does not work is assuming the provider can help. They cannot, and the architecture that makes them unable to is the reason you chose them.

While you are thinking about it

Two adjacent things worth checking at the same time, because they fail the same way.

Your recovery email. If the recovery address on your important accounts is one you no longer read, it is as unreachable as the vault. Google deletes accounts after two years of inactivity, which can quietly remove the route back into everything else.

Your two-factor codes. A vault someone can open is no use if every account then demands a code from a phone that is locked or lost. Whatever arrangement you make for the vault needs to cover the second factor too.

For which tier of which product gives you what, start with what happens to your passwords when you stop paying — the same table from the other direction.