The phone is the keystone. Almost every other account in your life runs a verification code through it: the bank, the airline miles, the school portal, the password manager that holds the rest. When the phone is locked and the person who knew the passcode is no longer reachable, the rest of the keystone arch comes down with it.
This is not a flaw. Apple designed it this way. Face ID and a six-digit passcode were the right answer to a different problem: stolen phones. The unintended consequence is that the same wall that stops a thief stops a spouse.
What follows is what actually works, in the order you should try. None of these companies publishes a timeline, so none is promised here.
Did they name you as their Legacy Contact?
If not, do you need what is in the account?
Yes: option three No, only to close it or reuse the phone: option two
First, do no harm
Before you try anything, plug the phone in and leave it on the charger somewhere safe. A drained battery will, on most modern iPhones, force a passcode entry on next boot, even if Face ID was working before. Keep it powered.
Then, if you remember any of the passcode, write down what you remember. Do not start guessing yet. After five incorrect attempts in a row, the phone starts making you wait, and each wait is longer: first a minute, then five, then fifteen, then an hour. If the Erase Data setting is on, the tenth wrong attempt erases the phone. Even if it is off, enough wrong tries end at a screen whose only way forward is erasing it.
If you have any reason to believe you might know the code in time, save your guesses for when you have written down everything you remember.
Option one: Apple Legacy Contact
Apple introduced Legacy Contact in iOS 15.2. If the person set it up before they were gone, this is by far the fastest path: you receive an access key (a string of letters and numbers Apple gave them to share with you), and you submit it along with a death certificate to Apple. Once Apple has reviewed the request, it unlocks the iCloud account: photos, messages, notes, files, contacts, calendar events, and device backups.
It does not unlock the device itself, and it does not include saved passwords. The iCloud Keychain, where the iPhone keeps passwords, passkeys, and payment information, stays closed to a Legacy Contact, and so do purchased music, movies, books, and subscriptions. Apple says so plainly, and its security guide explains that the access key was built without what the keychain needs to open.
The passwords have to come from somewhere else. Look for a password manager with emergency access, if they used one and named you. Look for a written list: a desk drawer, a safe, a folder with the will. Failing both, most institutions will settle an account with you directly, no password needed. That path is below.
To check whether they set this up, on any iPhone open Settings → your name → Sign-In & Security → Legacy Contact. If you are listed there, the access key was either printed, saved to your own Apple account, or shared with you in a message.
Realistic timeline: Apple does not publish one. It reviews every request once the death certificate arrives.
Option two: Apple’s request for families
If there is no Legacy Contact, Apple has a separate request for relatives. You file it online with a death certificate. That is enough for two things: closing the account, or removing Activation Lock so the phone can be erased and used again. It is not enough to see what is in the account.
Removing Activation Lock means erasing the phone, and whatever lived only on the device goes with it. Ask for this only once you are sure nothing on the phone is still needed.
Realistic timeline: Apple does not publish one. Apple reviews each request.
Option three: court order
If there was no Legacy Contact and you need what the account holds (the photos, the messages, the files), Apple asks for a court order that names you as the rightful inheritor of the person’s personal information. That is the rule in the U.S. Some countries, including France, Germany, Japan, Australia, and New Zealand, accept other documentation instead. Apple complies when the paperwork is in order. It is also expensive (a probate attorney is usually involved) and slow.
Even then, the same limits hold: no device passcode, and no saved passwords. The iCloud Keychain is end-to-end encrypted, so Apple cannot open it for anyone.
You may not need to go this far. Most of what a household runs on (the bank, the mortgage, the insurance) can be settled with each institution directly, without going through Apple at all.
Realistic timeline: set by the court, not by Apple. Ask the probate attorney for the local estimate. Cost varies wildly by jurisdiction.
Option four: third-party recovery services
There are companies that advertise iPhone unlocking. The strongest tools, from forensics firms like Cellebrite and Grayshift, are sold to law enforcement, not to families. A few data-recovery firms offer passcode recovery to the public. Whether any method works depends on the iPhone model and its software, and it is never certain: in 2024, even the leading law-enforcement tool could only partially unlock iPhones running the newest iOS. Before you send a phone anywhere, ask for a written quote and what happens if it fails. Expect to prove you can act for the estate: typically the death certificate and letters testamentary. Be wary of anyone who promises success.
This is the last resort. Try it only if a specific piece of information genuinely lives only on the device and not in the iCloud account.
What the email providers will and won’t do
Most accounts in modern life use email as the recovery channel: the bank, the airline, the brokerage. It is natural to hope the email provider will hand over the inbox. Mostly, it will not, and none of them gives out the password.
- Gmail: If they set up Google’s Inactive Account Manager, the people they chose receive a download link once the account has been inactive for the period they picked, which is measured in months. Without it, you can file a request as family. Google reviews each one and may close the account or, in some circumstances, provide content. Decide before you ask: once the account is closed, Google cannot hand over its contents later.
- Outlook / Hotmail: Microsoft considers releasing account contents only after being formally served a subpoena or court order, and may still decline.
- Yahoo: Yahoo will close the account, but the account is not transferable. Releasing any content takes a U.S. court order.
In every case, you will need a death certificate and proof of your relationship: a marriage certificate, a probate document, or letters of administration.
What you can do in the meantime
The bank does not need the password. Neither does the brokerage, the insurer, or the utility. Each has its own process for an account holder who is gone, often run by a bereavement or estate team, and it works from a death certificate and proof that you can act for the estate: letters testamentary or letters of administration. It does not wait on Apple or on any email provider. One call at a time, this is how accounts actually get settled.
What the other side usually looks like
Often, the shape is this: the photos, the messages, and the files come back through Apple, if a Legacy Contact request or a court order opens the account. The bank, the brokerage, and the insurer are settled one call at a time, with a death certificate. Many of the passwords turn out not to be needed for that. The waiting is the hard part.
Plan for the wait, and make the other Week 1 calls in the meantime.
What the binder does with this
Sealed details are planned for the Family plan and are not available yet. When they are, the phone passcode will be one of three, each in an envelope addressed to one named person.
Three details, and only three: the phone passcode, the primary email password, and the password manager’s master password. Any more, and the binder would become a password manager. Any fewer, and the phone would still lock everyone out.
Rules vary by state; this is general information, not legal advice.