Dead Man's Switch: How Digital Ones Actually Work

A dead man’s switch is a mechanism that triggers automatically once a person stops interacting with it, on the assumption that silence means something happened to them. In digital form, that usually means: stop checking in for a set number of days, and a system releases passwords, documents, or messages to people you’ve designated in advance.

It sounds morbid. It’s also one of the most practical pieces of infrastructure you can set up for your family, and almost nobody does it correctly.

Where the term comes from

The name isn’t a marketing invention. Dead man’s switches (sometimes called dead man’s handles) were built into railway and industrial equipment starting in the early 20th century. An operator had to keep active pressure on a control — a pedal, a handle, a lever — for the machine to keep running. Let go, and the equipment would stop on its own.

The push for wider adoption in the US came after a 1918 subway derailment in Brooklyn that killed 93 people when the operator lost control of the train. Afterward, transit systems began installing switches that would automatically brake a train if the driver became unresponsive. The same logic now runs elevators, lawnmowers, jet skis, and treadmills: no ongoing input, no continued operation.

The digital version flips the mechanism. Instead of stopping something, it starts something — usually the release of information the owner wanted kept private while alive.

How digital dead man’s switches actually work

Every implementation, from a free email script to a full platform, is built on three parts.

A check-in mechanism. This is how the system confirms you’re still active. It might be clicking a link in a periodic email, logging into an app, or a passive signal like continued account activity.

A trigger threshold. The length of inactivity that counts as “something’s wrong.” This can range from a few days on a bare-bones service to 18 months on Google’s Inactive Account Manager.

A release action. What happens once the threshold is crossed: sending a pre-written email, unlocking a file, notifying a contact, or handing over credentials.

That’s the whole concept. The differences between a good implementation and a dangerous one come down to what happens around those three parts, not the parts themselves.

The design problems that actually matter

Most people who search for a dead man’s switch focus on whether one exists, not on whether it’s designed well. It should be the other way around.

False triggers are the most common failure. You go on a two-week trek with no signal. You’re in the hospital, unconscious, but recovering. You lose your phone and can’t remember your recovery email. A poorly designed switch can’t tell the difference between “dead” and “distracted,” so it fires anyway — and once a plaintext email goes out, there’s no taking it back.

Single-recipient risk turns a safety net into a liability. If a switch sends everything to one person the moment it triggers, that person now has unilateral, unverified access to your entire digital life, indefinitely. That’s true even if the trigger was accurate. One inbox compromise, one bad actor, one well-meaning but careless relative, and there’s no second check.

Plaintext delivery defeats the purpose of keeping the information secret in the first place. Emailing a list of banking passwords and private keys means that information sits, unencrypted, in your outbox and your recipient’s inbox from that point forward — a permanent target for anyone who later compromises either account.

Service shutdown is a risk nobody accounts for. A dead man’s switch is only useful if it’s still operating when you need it, which could be years or decades after you set it up. Small, single-purpose services shut down, get acquired, or quietly stop sending renewal reminders. If you haven’t verified the service is still active recently, you don’t actually have a working switch — you have the memory of one.

Comparing the real options

Simple email-based switches, like deadmansswitch.email, work by asking you to write a message, set a check-in interval, and click a link periodically to delay it. They’re inexpensive and easy to set up, but they inherit every problem above: one recipient gets a plaintext message the instant the timer runs out, with no verification step and no encryption on the content in transit or at rest.

Google’s Inactive Account Manager is the built-in option for anyone whose digital life runs through Gmail, Photos, or Drive. You set an inactivity window of 3, 6, 12, or 18 months, choose which Google products to share, and name up to 10 contacts. It’s free and reasonably well designed for what it covers, but it only handles Google’s own products — it does nothing for your bank logins, your password manager, or documents that live outside Google. We cover the mechanics in more detail in what happens to your Google account when you die.

Password manager emergency access, offered by tools like Bitwarden and 1Password, lets a designated contact request access to your vault, which you can approve, deny, or let auto-approve after a waiting period if you don’t respond. It’s a genuinely good middle step, but it’s scoped to that one password manager and typically supports only a single emergency contact per request.

Purpose-built digital legacy vaults combine the check-in mechanism with encrypted storage and structured, multi-party release, which is the only combination that solves all four design problems at once. This is the category Eternal Vault sits in, and it’s worth being specific about how it handles each failure point rather than just asserting it does.

How Eternal Vault implements the mechanism

Eternal Vault’s version of a dead man’s switch is called Legacy Access, and it’s built around an Inactivity Threshold rather than a single fixed timer.

Check-ins happen the way that fits your life. You can confirm you’re active manually inside the app, automatically through the API if you want to script it into something you already use, or passively through a connected Google Fit integration that logs a heartbeat when it sees activity like daily steps. You’re not stuck with one fragile check-in method.

The Inactivity Threshold is yours to set. Instead of a single default for everyone, you configure how many days of silence should count as a trigger, based on your own life — someone who travels for work needs a longer window than someone who’s home every day.

A false-alarm recovery window exists before anything is released. Crossing the threshold doesn’t instantly unlock your vault. There’s a recovery period built in specifically for the hospital-stay, lost-phone, no-signal scenario, so a missed check-in doesn’t become an irreversible event.

Practice Run lets you test the whole flow without risking your real vault. You can run through what your trusted contacts would experience during an actual trigger, see what the check-in reminders look like, and confirm the timing works for your situation, all before you’re relying on it for real.

Release doesn’t hand everything to one person. Access uses Shamir’s Secret Sharing across your verified trusted contacts, meaning the vault only opens when a required subset of them act together — no single contact, however well-intentioned, can unlock your information alone. We’ve written a deeper explanation of how that math works in Shamir’s Secret Sharing explained.

Nothing is readable by Eternal Vault itself. Encryption happens client-side with a zero-knowledge model, so the contents of your vault aren’t exposed to the service that’s storing it. You can upload encrypted files directly or connect your own storage — Google Drive, Dropbox, or Box — if you’d rather keep files where they already live.

If you want to see how this stacks up against other platforms doing something similar, our roundup of the best digital legacy planning tools compares several head to head. Eternal Vault has a free plan to start with, and you can see the paid tiers on the pricing page; the underlying encryption approach is detailed on the security page.

Who actually needs one

Not everyone needs to formalize this, but a specific set of people clearly do:

• People living alone, where there may be no one nearby to notice something’s wrong for days.
• Solo business owners, where a single person holding every login means the business itself is exposed if that person becomes unreachable.
• Cryptocurrency holders, where a lost recovery phrase isn’t an inconvenience — it’s permanent, unrecoverable loss with no customer support line to call.
• Caretakers of family information, the person who ends up as the default keeper of passwords, account numbers, and instructions for aging parents or a spouse.

If any of those describes you, the honest first step isn’t picking a service — it’s figuring out what you’re actually trying to protect. Our digital legacy assessment tool walks through that in a few minutes and tells you where the real gaps are.

Setting one up properly

A dead man’s switch is a good idea implemented badly more often than it’s a bad idea. The mechanism itself — inactivity triggers a release — is sound. What determines whether it protects your family or creates a new liability is whether it accounts for false triggers, avoids single-recipient risk, encrypts what it’s holding, and is built by something likely to still exist when it’s actually needed.

If you want the check-in, the threshold, the recovery window, and the encrypted, multi-contact release handled together instead of stitched from three separate tools, set up your free Eternal Vault account and run a Practice Run to see exactly what your trusted contacts would experience.