Legacy Passage

A heart attack took an employee of mine, without warning. His son told me they'd had dinner together the night before — he was absolutely fine when they commuted in from JB for work that morning.

His family couldn't get into his phone. That sounds small until you sit with it. The phone was the key to everything — the accounts, the photos, the record of who to call and what he'd set up — all of it right there, six digits away, and the six digits died with him. They weren't locked out of a device. They were locked out of his life, at the moment they most needed a way in.

My own mother left the same kind of silence when she died. I've written about that already, so I won't again. The point is that it isn't rare. It's nearly universal, and we don't talk about it until we're standing in it.

The thing nobody names

There's a specific kind of information that behaves differently from everything else you own.

It's too sensitive to write down where anyone could find it — passwords, account numbers, where the deed actually is, who to call. But it's too important to let die with you, because the people you leave behind need exactly that information at the worst possible moment, on a deadline they didn't choose.

Every existing option handles half of this and drops the other. A password manager keeps the sensitive stuff safe — then it dies with you, because the whole point was that only you could open it. A note in a drawer passes it on — and sits there in plaintext for years, readable by anyone, stale the moment anything changes. A lawyer with a sealed envelope works, but it's only accessible to the affluent: the people who could afford the estate planning got the orderly handover, and everyone else would most likely get the locked phone and the opened drawers.

The gap in all of it is the passage itself — moving sensitive information from you to the right people, at the right moment, without it being exposed in between and without it going stale on the way. Nobody sells the passage. They sell the vault, or the envelope.

And the passage is the hard part precisely because of where the danger sits. The storing is close to solved — plenty of systems hold data they genuinely can't read, sealed so that even the people running the servers see only noise. It's the release that lives or dies. The instant the sealed thing opens and passes to someone else is the one moment it's exposed — and it's the moment worth attacking. Recent research made exactly this point: the dangerous instant for a whole class of secure systems isn't the vault sitting closed, it's the handover, the key changing hands. A system that behaves all year can betray you in the one second that matters.

So the real question was never "how do I store this safely." It was: how do you let a grieving family open a sealed box quickly, on a funeral's timeline, without opening a fast path that a dishonest relative — or a compromised server — could walk through while you're still alive.

That question has a shape, and that shape is what I set out to build. I call it Legacy Passage: a mechanism for the safe passing-on of the information that's otherwise too sensitive to store and too important to lose.

What Legacy Passage actually is

Here's the claim, plainly enough to argue with.

At its core it's a way to seal information on your own device and have it pass to the right people only when it should. From there, a few things make it different.

It isn't just one person handing down to their heirs. Everyone in the household enrols and gets their own sealed kit, and anyone enrolled can be named to hold and receive another's. It's not one-to-many; it's a household covering each other, everyone both a sealer and a keeper, with no single heir or custodian anyone has to trust. And a keeper needn't be a daily user: a sibling, a close friend, a lawyer holding it as executor can all be named as trusted receivers without ever logging in to run the thing.

It opens on a condition — confirmed by the trusted people you named, however many of them are left, or by your own genuine, prolonged silence — never by the operator's say-so. The silence does the heavy guarding; the human confirmation flexes to however many survivors there are, so a lone survivor of a bad accident is never locked out of their own family's legacy for lack of a second signature.

Each of those pieces exists somewhere in isolation. Crypto-inheritance tools do multi-party release — but only for wallets, and often the service can still see the secret. Password managers do emergency access — but one grantor to one grantee, while you're still reachable, not a group-confirmed release after you're gone. None do all of it at once: held by many, confirmed by trusted people or by genuine silence, and indifferent to what kind of information it's guarding.

That combination is Legacy Passage, and this post is me planting the flag on it — the concept and the name together. I'm not publishing the wiring; the exact choreography of how the box goes from sealed to open is the part worth keeping. The building blocks are public; the assembly is the work.

The two things I got stubborn about

Everything above is the shape. Two design choices underneath it are worth naming, because they're where the thing lives or dies — and they're principles, not mechanism.

I don't manufacture a heartbeat. Most systems that release on death nag you: check in, click the link, prove you're alive. That nagging is the source of every false alarm, and people hate it. Legacy Passage reads something truer instead — the ordinary things you actually do, by hand: a task you tick off, a document you file, a login that's really you. Living your normal digital life is the proof. The machine's own background ticking never counts; a cron firing or a scheduled job running proves nothing, because those run whether you're alive or dead. Only a real human act does.

And the window to cancel is the real safety feature — not a footnote, the load-bearing wall. When something trips, the system's whole job for the next stretch is to make it trivially easy for a living person to say "I'm here, stop." One action, on any channel, kills it. I built the cancel path with more care than the release path, because it's the one protecting the living.

Rather than tell you how it all moves, I made something you can watch it do — the walkthrough is here.

What it's really for

My employee's family got there in the end. They always do — with enough phone calls, enough sitting on hold reciting a death certificate number to someone who didn't know him. It wasn't impossible. It was just hard, at the exact moment they had the least to give.

Legacy Passage is my attempt to take that fence down — the one that's always kept the orderly handover behind lawyers, estate planners, and the kind of money that buys someone to handle it for you. To make the thing that a wealthy family gets — the clean, private, dignified handover — into something an ordinary one can simply have. Not a service you rent from me. A capability that lives in your own home and answers to no one but the people you chose.

That it can exist at all now, for a normal household and not just a well-lawyered one, is a story of its own — and it's really a story about what a home AI server is for. That's the next post.

The footnotes

• The primitive: a data key seals the information; that key is then wrapped once per authorised recipient, to each recipient's own public key, entirely client-side. The server stores only ciphertext and public keys. Standard multi-recipient envelope encryption — the known, boring, correct building block.
• A keeper needn't be a user (the "steward" role): a trusted receiver — a friend, a sibling, a lawyer holding it as executor — can be enrolled purely to hold and receive, with no day-to-day use of the system. Two consequences: they're never checked for signs of life, so their non-use can't fire a false death, and they carry no assistant access. But they keep full power to confirm a death, approve, and trigger release — being receiver-only limits what's watched, never what they're trusted to do.
• Why "blind" has to mean blind by construction: the research the piece alludes to is Zero Knowledge (About) Encryption (Scarlata, Torrisi, Backendal & Paterson, ETH Zurich — USENIX Security 2026), which showed the "zero-knowledge" promise of the major cloud password managers doesn't hold against a malicious server: a compromised backend, using nothing more than routine login and sync, could recover or alter vault contents. The lesson Legacy Passage takes from it — a blindness claim that depends on the operator behaving isn't a guarantee — is why the seal is client-side and multi-recipient, and why the only fully-private form is the one where you are the operator.
• Deliberately omitted: every threshold and timing value, the wiring of the release moment, the re-seal-on-membership-change mechanics, and the fast-trigger internals. Primitives are public; the assembly is not.