Quick Answer
Set up password-manager emergency access before it is needed: appoint the intended person, choose the access scope and delay, and finish every confirmation. Use ordinary sharing for selected household logins. A timed vault-access request, your own account recovery and a printed sign-in kit have different consequences; none automatically authorises actions at the underlying service.
For everyday household logins, a limited shared vault is usually the better starting point. Emergency access can expose much more information. If you are already locked out, start with our forgotten master password guide to identify recovery options you may already have.
Choose the Right Kind of Backup
- Shared access: another person can already use selected household items. This is useful for routine tasks, not just emergencies.
- Emergency access: an appointed contact requests access, often subject to a waiting period and an opportunity for you to refuse.
- Account recovery: a supported process restores your own access. It may require saved recovery material, email verification or help from an organiser.
- Emergency documents: stored instructions and sign-in material can help a trusted person, but possession may allow immediate access if all required factors are included.
These options are not interchangeable. A recovery contact may only help you regain access rather than be able to read your vault. A shared folder may contain only a handful of items, while emergency access can cover your personal vault.
How Provider Options Differ
Bitwarden documents two access levels: view access to individual vault items, including passwords and attachments, or takeover access that replaces your master password and removes existing two-step login methods. Adding contacts requires premium access, including qualifying paid organisation membership; the contact can use a free account on the same server.
Choose takeover only when you intend to give that level of control. View access still reveals secrets that can be copied or used on the underlying websites. Neither setting should be treated as a limited household folder.
Keeper’s emergency access feature allows up to five trusted contacts and a configurable delay. Its documented access is read-only: contacts cannot edit, move, delete or export vault contents through that feature. Contacts need a Keeper account and an established sharing relationship. Read-only does not prevent someone remembering or manually recording information they can see.
1Password’s Emergency Kit is a different mechanism. It includes your sign-in details and Secret Key, plus a space for your account password. The password is not automatically filled in for you. A kit without the required password and additional authentication arrangements is not a complete emergency sign-in plan. Its family organiser recovery is also distinct from a timed request to read someone’s vault.
Set Up Bitwarden Emergency Access
The web-app sequence below follows Bitwarden’s current setup instructions. Both people must finish their part; sending an invitation alone is insufficient.
- Open the Bitwarden web app and go to Settings > Emergency access.
- Choose Add emergency contact, enter the intended person’s account email, and select the access level and waiting period. Verify the address directly with them.
- Ask the contact to accept the invitation using their own Bitwarden account on the same server.
- Return to Emergency access. When the contact needs confirmation, choose Confirm and compare the displayed fingerprint phrase with them.
- Check the completed contact entry and explain how they would request access. Confirm you can receive the notification emails.
An access request can be approved or denied by you. If you do not respond, the configured delay determines when access is granted. Choose a delay that balances urgent needs with the time you realistically need to notice and challenge an unexpected request.
Check the Plan Without Triggering a Takeover
Walk through the process together while you are both available. Verify the contact can find the correct account, understands the agreed circumstances and knows how to reach you independently. If you practise a request, read its consequences first and deny or cancel it before access is granted. Do not complete a takeover merely to test notifications.
- Review plan changes separately from permission changes. The billing section below explains why cancellation may leave an existing emergency arrangement active.
- Confirm whether shared or organisation-owned items are included. Do not assume personal-vault access covers everything.
- Keep the contact’s own account protected with a unique password and appropriate additional authentication.
- Review contacts after a change in relationships, email accounts or password-manager provider. Remove obsolete arrangements.
If someone has already viewed a password, removing emergency access cannot make them forget it. Where access should end, review the underlying service, change exposed credentials and revoke sessions or other sign-in methods as appropriate.
Prepare Instructions Your Contact Can Use
Keep a short account inventory with provider names, the location of the emergency instructions and priorities such as essential household bills. Keep that inventory separate from a broadly shared document full of passwords. A sealed copy in a secure location can be useful if the intended person knows how to obtain it.
Do not assume having a password authorises every action. For banking, work systems or a deceased person’s accounts, use the institution’s authorised representative or bereavement process and seek appropriate advice. Technical access does not replace those requirements.
For day-to-day arrangements, follow our family password-sharing guide. Separate ordinary shared logins from the broader information someone might need in an emergency.
Plan Changes Do Not Necessarily End Access
Bitwarden’s Premium renewal guidance says existing trusted emergency contacts can still request and obtain access after an individual account loses Premium. The account holder cannot add new contacts or edit existing ones until Premium is reinstated. Cancelling the subscription is therefore not a reliable way to terminate an emergency arrangement. Review the contact and its permissions directly through the supported controls.
Before a provider or plan change, check both people’s ability to sign in, any stored documents and the emergency workflow itself. A household plan ending can also affect ordinary shared items independently of emergency access. Do not extrapolate the rule for one provider or personal plan to another organisation’s account. Confirm the actual account type and keep essential permitted information available through a suitable separate arrangement.
End an Emergency Access Event Safely
In Bitwarden, stopping a pending request, revoking granted view access and undoing a completed takeover are different actions. Its request and revocation guide explains that granted view access can be revoked with Reject in the contact’s menu. After a contact has used takeover, the owner needs the new master password to sign in and then change it to one the contact does not know. A takeover is not reversed merely by dismissing a notification.
After regaining control, review sign-in protection and recovery arrangements. The takeover process changes the master password and removes existing two-step methods; re-establish the supported protection you intend to use. Review the emergency contact itself separately if future requests should no longer be permitted. A rejected request does not automatically delete that contact.
| What needs to end? | Act at the right level | Remaining concern |
|---|---|---|
| One pending request | Use the provider’s request decision. | The contact may remain eligible to request again. |
| The ongoing arrangement | Review or remove the trusted contact through its supported controls. | Previously viewed information may have been copied. |
| Access to an underlying service | Review that service’s credentials, sessions and recovery options. | Changing a vault permission does not revoke every website session. |
For sensitive accounts, identify what the person actually accessed and why. A legitimate helper may only have needed instructions for a household task; do not respond by resetting every account without considering ongoing access and recovery needs. If access was unexpected or the person is no longer trusted, prioritise the affected recovery email and financial accounts through their genuine support and security settings. Keep the response proportionate to what may have been exposed.
Make a Recovery Code Usable Before Relying on It
For 1Password individual and family accounts, a recovery code requires access to the account’s email address, and previously enabled two-factor authentication stays enabled during that recovery. Its current instructions also describe a 24-hour recovery-code block after a recent sign-in. Knowing that limit can prevent a planning exercise from being mistaken for a broken recovery code. Organiser-assisted recovery is a different route with different authentication consequences.
A handover note should identify the provider and account, the agreed task, where the protected instructions are held and whom to contact if the process fails. Keep the location of an emergency document separate from broadly shared household notes. Do not put every password, recovery code and device unlock code together in an ordinary email. Review the note with the intended helper while access is available, without completing a takeover or removing the owner’s only sign-in route.
Decide what the contact must actually do
Start with the smallest practical need. If a partner must pay a routine household bill, selected shared logins and clear instructions may be enough. If someone must help you recover your own account while you are available, use the provider’s recovery mechanism. A broad personal-vault handover is a different decision. List the task and intended information before choosing a takeover option simply because it sounds more complete.
Check whether the person could reach the account used to make a request if their own phone were lost. They need their own working sign-in and recovery arrangements. Avoid a circular plan where both people’s recovery details are available only inside the other person’s locked vault. Tell a second appropriate person where the instructions are held if your intended helper may be travelling or unavailable; this does not mean granting everyone the same vault access.
Choose a delay you can realistically monitor. Consider where request notifications arrive and whether the owner can normally check that mailbox during travel or illness. Do not put a universal number of days into the plan: a delay that is tolerable for one household may leave another without essential information. If an urgent need is narrower than the whole vault, prepare the permitted shared item in advance rather than relying solely on a future emergency request.
In Bitwarden, declining a request stops that request but does not remove the trusted contact or prevent future requests. Remove an obsolete contact separately when the arrangement itself should end. Its documentation also excludes accounts governed by the organisation’s Automatic confirmation policy from emergency access. Check the account and request rules for the exact setup, particularly when a work account is involved.
Keep recovery and emergency handover distinct
1Password’s family-organiser recovery and an individual recovery code both restore the member’s access, but their authentication consequences differ. Organiser-assisted recovery resets two-factor authentication; using a recovery code leaves existing two-factor authentication enabled. Both require completing the documented process and signing in again with the new account details. Follow the recovery-code instructions or the organiser workflow appropriate to the actual problem; do not treat a code as a timed request to read somebody else’s vault.
Review the arrangement after a new phone, changed email, provider move or relationship change. Confirm that the intended account and contact are still correct and that the instructions explain the current access level. If someone has already used the arrangement, review the underlying services separately: changing the contact entry does not revoke every website session or invalidate a password they previously saw. Keep the instructions concise enough that an authorised person can act without guessing.
Prepare a limited, usable emergency plan
Give the intended person only the access needed for the agreed task, finish all setup confirmations and keep a recovery route outside the locked vault. Use selected everyday sharing for routine needs and review broad emergency access when circumstances change. Technical access and an institution’s authority requirements remain separate.
Frequently Asked Questions
Does my emergency contact need my master password?
Not for a provider’s supported request-and-wait feature such as Bitwarden emergency access. A document-based sign-in plan is different and may require your account password and other authentication material.
Does accepting an invitation finish Bitwarden setup?
No. The account owner must also confirm the trusted contact. Check the final status before relying on the arrangement.
Can emergency access be set up after I am locked out?
Usually you need access to your account to configure it. If you are already locked out, check previously configured recovery options and the provider’s official recovery guidance.
Does cancelling Bitwarden Premium remove existing emergency contacts?
No. Bitwarden says existing trusted contacts can still request and obtain access after Premium lapses, although adding or editing contacts requires Premium. Review the contact permissions directly rather than using cancellation as a way to end access.
Does revoking emergency access sign someone out of every website?
Do not assume so. Vault permissions and sessions at the underlying services are separate. Review exposed credentials, active sessions and recovery methods at the affected services when access should end.
Sources and Image Credits
Sources: Bitwarden emergency-access scope; requests and revocation; Premium renewal consequences; Keeper emergency access; 1Password Emergency Kit; organiser recovery; recovery codes.
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.