A dead man’s switch releases access to your crypto if you stop checking in. The appeal is obvious: no trusted person, no sealed envelope, no lawyer — the system simply notices you are gone and acts.
The appeal is also where the trouble starts, because every implementation has to answer a question that has no clean answer: how does a machine tell “dead” from “on holiday with a broken phone”?
The two failure directions
Every design trades one against the other, and you cannot have neither.
- False positive — it fires while you are alive. You miss check-ins because you are in hospital, travelling, or the reminder went to an abandoned inbox. Your keys are now with someone who was not supposed to have them yet. Depending on the relationship, that ranges from awkward to catastrophic, and it is irreversible.
- False negative — it never fires. The service shut down, the domain lapsed, the contract had a bug, or nobody knew to look. Your heirs get nothing and never learn why.
Tuning the timer trades one for the other. Short intervals mean frequent false positives. Long ones mean months of your estate sitting in limbo while everyone waits for a countdown.
Service-based switches
A company emails you periodically; if you stop replying, it releases stored information to named recipients.
The fatal question is what they store. If the service holds your recovery phrase — encrypted or not — you have handed your wallet to a third party whose security you cannot inspect and whose staff you have never met. Every breach of that company is a breach of your funds, and these are small companies.
There is also a longevity problem that people consistently under-weight. This mechanism may need to work in twenty or thirty years. Most startups do not last five. A dead man’s switch that quietly dies before you do is worse than none, because you stopped making other arrangements.
If you use one at all, use it to deliver instructions — where things are, who to contact — and never the phrase itself. That is the map, not the keys, and a leak costs you nothing.
On-chain timelocks
The technically elegant version: funds that become spendable by a second key only after a period of inactivity. Bitcoin supports this natively through timelock opcodes; smart-contract chains can express it directly.
A common pattern: your key can spend at any time, and your heir’s key can spend after a year of no movement. You reset the clock by moving the funds to yourself periodically. No company, no trust, no expiry.
Real limitations:
- You must remember to reset it, forever. The mechanism whose whole purpose is surviving your incapacity requires your continued attention to not fire.
- Complexity is the enemy. A bespoke script or contract is a bespoke bug surface, and on a smart-contract chain a flaw can be drained by anyone who finds it.
- Your heir needs the wallet configuration, not just a key — the same trap that catches multisig inheritance plans. Keys without the descriptor recover nothing.
- The reset is public. Regular movements advertise an active, valuable wallet.
The version that mostly works
Legal and boring: a sealed envelope with a solicitor, released on production of a death certificate.
It is a dead man’s switch where the trigger is a legal fact rather than a missed email, and it has properties no technical design matches. Death certificates are hard to forge. Solicitors are regulated, insured, and long-lived. There is no timer to accidentally trip, and no countdown running while you are in hospital.
Its weakness is honest and worth naming: you are trusting a firm not to open the envelope. Mitigations exist — a passphrase held elsewhere, so the envelope alone is insufficient, or Shamir shares split across two professionals. Both convert a single trusted party into a threshold, which is the same instinct that makes multisig attractive without the technical overhead.
What to actually do
For most people, in this order:
- Write the instructions and make sure a named person knows they exist. This single step recovers more crypto than every automated switch combined, because the dominant failure is nobody knowing there was anything to find.
- Store the secret with a professional, released on death.
- Split it if the amount justifies it — Shamir shares or a 2-of-3 multisig, so no single party can act alone.
- Rehearse it with the people involved, on a wallet holding almost nothing.
- Consider a timelock only if you are technically confident, have tested it end to end, and have documented it well enough for someone else to use under stress.
The uncomfortable summary: the automated solutions are the interesting ones and the boring ones are what work. A dead man’s switch is a clever answer to a problem that is usually not technical — the problem is almost always that nobody was told.