An inheritance plan should locate the secret without becoming it

Practical guide · prepared 19 September 2026. Sources were checked for this workflow; linked interfaces and policies can change. Research scope.

An heir can know that bitcoin exists and still be unable to recover it. The opposite failure is worse: a convenient “inheritance letter” contains a seed phrase, passphrase and instructions in one place, so anyone who finds it can spend immediately. A safer operational design separates authority, discovery, instructions and secrets. This is not legal advice; wills, trusts, probate, tax and fiduciary duties vary by jurisdiction and require a qualified professional.

Make four layers with different readers

The legal layer identifies the asset category, the person or role authorized to act, and the governing estate document. It should not contain a seed phrase. The locator layer tells the authorized person that wallets exist, where the current procedure is stored, and whom to contact. The instruction layer explains the wallet type, devices, software, account structure and verification steps without containing enough secret material to spend. The secret layer holds the recovery backup and any separately managed passphrase or credentials.

Bitcoin.org's wallet-security guide explicitly warns that funds may be unrecoverable if family cannot locate wallets or passwords, while also recommending multiple secure backup locations. The tension is the design problem: discoverable enough for an authorized successor, fragmented enough that one document is not a bearer instrument.

Write instructions for a cold reader

Assume the reader has never used the wallet and you are unavailable. State the wallet's public fingerprint, device model, network, account types, whether a passphrase-derived wallet exists, where the public descriptor packet is held, and how to verify a receive address. Define unfamiliar terms. Include the official vendor and software URLs as text plus the date last checked; tell the reader not to follow links from unsolicited email or search ads.

Give a sequence with stopping rules: inventory devices without connecting them; verify software provenance; locate but do not photograph the backup; reconstruct a watch-only view first; compare known addresses; then engage named professional help if the plan requires it. The descriptor portability checklist can make the account visible without exposing spending keys.

Keep secrets out of routine circulation

A recovery phrase provides spending control. Trezor's backup guidance says not to share it, keep digital copies, or enter it anywhere except when the device prompts. Vendor wording is not estate law, but it accurately describes the technical power of the secret.

Do not put the phrase in the will if that document may become public or widely handled. Do not email it to an executor, attach it to a cloud note, or give a lawyer or family member more technical authority than the plan intends. If separate locations or people are used, document the dependency: secrecy gained by separation can become permanent loss if one component disappears.

Rehearse the handoff without revealing the key

Ask the intended operator to walk through the locator and instruction layers using a watch-only wallet or an unfunded training wallet. They should be able to identify the authentic device, explain which materials are secrets, derive or verify known public addresses, and state when to stop. Do not have them type the production seed into a practice computer. Record ambiguities and revise the instructions.

Review after a move, relationship change, device or firmware replacement, wallet migration, major balance change, or change in applicable law. Date every copy and define which copy controls. The technical plan should then be reconciled with an estate lawyer and tax professional in the relevant jurisdiction.

State the limitation plainly

No document design eliminates theft, coercion, family conflict, legal challenge or obsolete software. A plan that depends on one expert, one device vendor or one unlabeled envelope is fragile. The goal is narrower: an authorized person can discover and verify the recovery path, while no routine reader receives the entire spending secret by accident. Link the operational plan to a periodic recovery rehearsal, and never treat a passed rehearsal as a substitute for legal validity.