The FIRM Guide

The Passwords and Passkeys Module

How the family's passwords and passkeys are managed — the password manager, MFA methods, backup codes, and passkeys. One entry per mechanism; not a list of accounts.

Where this Module fits

S-05 Module 5 of 6 in the System area — step 1 of 4 on the dependency ladder (System → At-Home → Financial → Estate).

Fifth — the key ring for your entire FIRM System; the master credential gets the most deliberate friction of all.

Adds to The Secure Guide: One entry per credential/password tool or method — managers, passkeys, hardware keys, backup codes by reference.

Adds to The Family Guide: That the manager holds the credentials — and that in a lockout or a crisis, recovery starts with its emergency access, not account-by-account resets.

Every Module adds one section to each guide — that is how the two guides assemble as you work. See what you're building.

Download Text File Nothing is entered on this page — you fill the template in privately.

Text file — the flexible one. Use it as-is, paste it into a spreadsheet, open it in any editor, or paste it into an AI tool to reshape the blank form to fit your family: rename a field, add a row, drop one you don't need.

Print / PDF — the ready-to-use one. Print it and fill it in by hand, or choose Save as PDF and complete it in your own offline PDF app. Either way it stays with you — the finished Secure Guide template goes inside your Vault.

One rule: only ever give an AI tool the blank template. Never paste your real information — passwords, account numbers, anything you'd keep secret — into an AI tool, an online service, or anywhere outside your own Vault. Customizing an empty form is fine; filling it in happens privately, offline. That's the same rule this site follows: nothing sensitive ever leaves your hands.

Secure Guide Starter Template — Passwords and Passkeys

One Secure Guide entry per credential/password tool or method — the goal is to document each method, not each account. A household may run more than one password manager (one entry each), and passkeys count as a method of their own. Store this inside your Vault; update at the semi-annual review.

This Module documents how your passwords and passkeys are managed — the mechanisms and how they work together. It is not a list of accounts; those are documented in later Modules. The mental model is simple: every critical password lives in the password manager, and the password manager opens only with The Vault Key. The Vault Key may be a master password, a combination, a physical key — and may combine something you know, something you have, and something you are. The implementation differs from family to family. What matters is that this section holds the instructions, and the Family Guide gives your loved ones the high-level picture.

The Vault Key gets the most deliberate friction in the whole FIRM System — memorized or physically secured, with a recovery copy sealed in the physical Vault and an emergency-access path someone you trust has actually tested. Two modern cautions belong here too. Accounts are now lost through the recovery path more often than the password — walk your reset options deliberately. And an “I'm locked out, help me get back in” request, even in a familiar voice, gets a callback on a known number before anyone acts.

The tool or method, one entry each — e.g., "password manager — Family", "password manager — Sarah's business", "Passkeys (as a method)", "Hardware Key — Primary". A second manager gets its own entry; passkeys are documented as a method even though there is no password to write down.
Password manager, hardware key, authenticator app, passkey inventory.
Which accounts or systems this mechanism protects — broad strokes; the account inventory itself comes in later Modules.
The fallback if this fails — or an explicit NONE, recorded deliberately.
Where recovery codes live, by reference. The codes themselves are high-friction — password manager or sealed with recovery materials.
Optional, for hardware tokens.
Yes/No + location for anything physical.
The steps a trusted person follows — or a plain statement that no recovery exists.
Semi-annual review date.
Passwords and Passkeys; secure-guide; family-guide; System

Family Guide Starter Template — Passwords and Passkeys

This template contains no sensitive information. It can be stored with household documents.

In the matching Secure Guide section: one entry per credential/password tool or method — managers, passkeys, hardware keys, backup codes by reference.

That detail is what makes recovery possible — and it is protected in the Vault, which opens with The Vault Key. The key is never written here, by design. The people listed on this page know how it is kept, and the steward's job is to keep that path current, so this page never leads to a locked door.

The model, in a sentence or two your heirs can absorb: all of our critical passwords are in the password manager, and the password manager opens only with The Vault Key (say what kind of thing it is — a memorized password, a combination, a key — never the thing itself).
Day to day, in plain terms: new logins go into the manager and the phones fill them in; some accounts open with a fingerprint or face instead of a password — those are passkeys, and they are part of the same system; if more than one manager is in use, say which is whose.
Useful on its own, no secrets: the password manager service BY NAME, that emergency access is configured and for whom, where the backup hardware key lives by place-name (“the fire safe”), and that a sealed recovery copy exists. The step-by-step instructions are in The Secure Guide.
Owner and review cadence; whether a trusted person has emergency access configured — a built-in feature of reputable password managers; the service runs the process.
What not to do, then the path — don't reset accounts one by one; start with emergency access.

Anything this page's reader should know that the sections above didn't ask for — the exceptions, the house quirks, the thing you would say out loud while handing this page over.

For more information on how to use these templates, see The Recoverable Family book.

Worked example — Frank's family

Frank runs the two-container pattern: credentials live in the password manager while the structured records live in his encrypted volume. The manager's master password is The Vault Key — memorized, sealed in one envelope, and backed by two hardware keys and Sarah's tested emergency access. Notice what these entries are not: none of them lists accounts. They document the machinery — the account inventory comes in later Modules. Four of his entries:

All details are fictional and illustrative. The assembled example guides live at the example Secure Guide and the example Family Guide.

Secure Guide — Frank's entry

One entry per security mechanism. Master passwords and recovery codes are referenced by location, never written here.

Entry 1 — The password manager (the key ring)

FrankFamily Bitwarden Account — its master password is The Vault Key
Password manager (reputable, open standards; holds passwords and passkeys)
Every credential in the household — logins, passkeys, backup codes, container keys. It is also the map of what exists.
Sarah's emergency access — a built-in feature of the password manager; the service runs the request-and-grant process, so it works whether Frank is gone or just locked out. Tested, not just configured. Beyond that: the sealed written copy in the fire safe.
Printed and sealed with the written master-password copy, fire safe
n/a — see the two hardware-key entries; both are registered to the manager
The written recovery copy: yes — sealed envelope, fire safe
Do not reset accounts one by one. Start with emergency access: Sarah requests it through the password manager and the service walks her through. Only if that fails: the sealed envelope.
2026-03 semi-annual review — emergency access exercised end to end
Passwords and Passkeys; secure-guide; family-guide; System

Entry 2 — Hardware key, primary

Hardware key — primary (Frank's keychain)
Hardware security key (USB-C + NFC; touch to confirm)
Second factor on the highest-value accounts: primary email, the password manager, the main bank
The backup hardware key (Entry 3). Two services offer no backup codes — losing both keys loses that access, which is why both keys are registered everywhere.
Per account, in the password manager → Security folder
Recorded on the card sealed with the recovery materials
Yes — Frank's keychain
If lost: sign in with the backup key, remove the lost key from every account the same day, order a replacement
2026-03 semi-annual review
Passwords and Passkeys; secure-guide; family-guide; System

Entry 3 — Hardware key, backup

Hardware key — backup (fire safe)
Hardware security key (same model as primary)
Registered on every account the primary is — kept for recovery, not daily use. Heirs: this is the key you will use.
NONE beyond this pair on two services — recorded deliberately
Per account, in the password manager → Security folder
Recorded on the card sealed with the recovery materials
Yes — fire safe, in the recovery envelope
Used when the primary is lost, or by whoever administers the estate — with the password manager open first, so you know which accounts expect it
2026-03 — tested on the primary email account
Passwords and Passkeys; secure-guide; family-guide; System

Entry 4 — Passkeys, master list

Passkeys — master list
Passkey inventory (the map, not a device)
Tracks which accounts are passkey-enabled, which device holds each passkey, and whether it is synced through the manager or bound to one device
Legacy passwords stay in the manager until each passkey is proven on two devices
Per account, in the password manager
n/a
No — passkeys live on the devices; this list lives in the manager
Lost device: synced passkeys restore with the manager; device-bound ones re-enroll from the second device on the list
2026-03 semi-annual review — two new passkey-enabled accounts added
Passwords and Passkeys; secure-guide; family-guide; System

Family Guide — Frank's entry

This entry sits in the household reference binder. It says where things are — never what they are.

All of our critical passwords are in the password manager, and the password manager opens only with The Vault Key — for us, a memorized master password backed by a hardware key. If an account matters, its key is in there, and so is the map of what exists.
New logins go into the password manager and the phones fill them in automatically. The email accounts and the manager itself also want a hardware key — the two YubiKeys, keyring and fire safe. A growing set of accounts opens by fingerprint instead of a password — those are passkeys, and they're on the master list in the manager.
The manager is Bitwarden (family plan). Sarah holds configured emergency access. The backup hardware key and a sealed recovery copy are in the fire safe. Nothing here says what the master password is — only where every door lives.
Frank; semi-annual review. Sarah holds emergency access — a built-in feature of the password manager. Tested, not just configured.
Don't reset accounts one by one — the recovery path is where accounts get lost. Start with the password manager's emergency access (Sarah). And a locked-out plea, even in a familiar voice, gets a callback on a known number before anyone acts.

← Back to System modules