The Spare Key Question: Who Can Get In If You're Ill, Away or Offline This Christmas?

The week before Christmas is a bad time to discover that only one person knows how to get into the household password manager. The same goes for a micro-firm running on a skeleton staff between Boxing Day and New Year. If the one person with the keys is ill, travelling, or simply unreachable, the digital essentials can become a small but very annoying crisis.

That is where emergency access comes in. Not a shared master password in a WhatsApp group. Not a sticky note under the router. A proper spare key arrangement, set up calmly in advance, so someone trustworthy can get to the important things without turning your security into a guess-the-password game.

A spare key, not a spare password

Let's get the basic principle out of the way: nobody needs your master password. The whole point of a password manager is that the master password stays with you. Emergency access should be a controlled, time-limited route into the vault, not a permanent copy of the front-door key.

Most decent password managers include an emergency access feature. The exact name varies, but the idea is similar. You nominate a trusted contact. They request access if something happens. You approve it, or after a waiting period they get limited access. Some tools let you choose whether they can see everything or only certain items.

Use that. It is safer than emailing a backup file, and much safer than writing the master password on the back of a Christmas card list.

Pick a person, not a group chat

Choose one trusted contact for the household, and one named deputy for a small firm. Think about who is actually likely to be around, and who can handle a calm set of instructions without forwarding screenshots to the family group chat.

For a home, that might be a partner, an adult child, or a close friend who already helps with admin. For a micro-firm, it should be someone with a real operational reason to get in: a co-director, a senior staff member, or an outsourced IT contact who already has a proper support agreement.

The contact needs their own account and their own strong login. Do not create a shared login called "family admin" and pass it around. That just creates a new weak point and makes it harder to see who did what.

Recovery codes need a home that isn't your inbox

Emergency access is only half the job. The other half is recovery codes. Those are the one-time backup codes you get when you set up two-factor authentication. If your phone is lost, broken, or sitting in a hotel room in another country, those codes are often the difference between getting back in and starting a very long support conversation.

Print them. Put them in a sealed envelope. Write on the envelope what it is and when it was last checked. Store it somewhere physically sensible: a locked drawer, a home safe, or with a solicitor or accountant if that is already how you handle important documents.

Do not keep the only copy in your email inbox. If your email is the account you are locked out of, that is not a backup plan. Do not keep it in a shared notes app either. And do not take a photo of the codes and leave it in your camera roll, where it will sit next to pictures of the dog and the Christmas tree.

For a micro-firm, treat recovery codes like any other business continuity document. Note who holds the envelope, where it is kept, and when it was last reviewed. If you use a managed IT provider, check whether they hold recovery material on your behalf and under what agreement.

Do a dry run before the decorations go up

A spare key you have never tested is just a hopeful theory. Before the festive break, do a dry run.

First, check that your trusted contact can log in to their own account and see the emergency access request option. Second, confirm their email address and phone number are current. Third, walk through what happens if they request access. Does it need your approval? Is there a waiting period? What exactly can they see?

Then test the recovery side. Are the printed codes still valid? Is the envelope where you think it is? Can you find the backup email address and phone number tied to the account? This is not about creating a full-scale disaster rehearsal. It is a ten-minute check that stops a small problem becoming a festive saga.

If your password manager supports it, set a reminder to review the arrangement every few months. People change jobs, move house, and change phone numbers. Emergency access should change with them.

For micro-firms, name a deputy and write it down

A small business does not need an enterprise-style identity programme to get this right. It needs a named deputy, a short written procedure, and a clear rule about what the deputy can and cannot touch.

Write down which accounts are essential: email, banking, payroll, domain registrar, website admin, cloud storage, and the password manager itself. Note who the emergency contact is, how they request access, and who approves it if the usual approver is unavailable. Keep the procedure with your other business continuity notes, not in someone's head.

If you handle customer data, keep the principle of least privilege in mind. Emergency access should be enough to keep the business running, not a free pass to every file. Check your insurer's requirements and your GDPR obligations before handing over anything broad. A short conversation with your accountant or IT support is cheaper than an improvised workaround in January.

Don't build a new weak point

The irony of emergency access is that a badly set-up spare key can be less secure than no spare key at all. Avoid these easy mistakes:

• Don't share your master password, even with someone you trust.
• Don't disable two-factor authentication to make access "simpler".
• Don't put recovery codes in a shared spreadsheet or a group chat.
• Don't give emergency access to someone who has no reason to need it.
• Don't forget to revoke access when circumstances change.

Keep the arrangement boring. Boring is good. Boring means fewer people have keys, fewer copies exist, and there is a clear record of who can get in and why.

The two-minute festive check

Before the Christmas break, do this: nominate or confirm your trusted contact, check their details, print your recovery codes, seal them somewhere sensible, and do a quick dry run. If you run a small firm, add the arrangement to your continuity notes and tell the deputy where the procedure lives.

Then close the laptop and get on with the mince pies. The point of a digital spare key is not to think about it every day. It is to know that if you are out of action, the right person can get in, do what needs doing, and lock up again afterwards.