The Dead Man’s Switch: notes that know when to let go

A dead man’s switch is a mechanism that acts when it stops hearing from you. Scrinium’s version watches for inactivity and, after a threshold and a grace period you choose, releases your notes to a trustee you nominate — without the server ever being able to read them.

The idea, and why it is hard

The concept comes from safety engineering: a switch that stays closed only while a person keeps pressing it. Applied to a notebook, it answers a question encryption usually makes unanswerable — if something happens to me, how does anyone else get in? A service that cannot read your notes cannot hand them over either, so the naive version of this feature is impossible.

Copying your password into an email to a solicitor, or storing it in a shared vault, both solve the problem by giving up the property that made the notes worth protecting. That trade is usually made silently, years before it matters.

The fix: split the key so nobody holds all of it

Scrinium splits a Legacy Key into two shares using Shamir’s Secret Sharing with a threshold of two. Mathematically, one share reveals nothing about the secret — the information simply is not there. Two shares reconstruct it exactly.

  • Share A stays on the server, together with an encrypted bundle that holds your vault key. The server cannot open the bundle: it has half a key and no way to complete it.
  • Share B is given to you once — shown a single time when you set the switch up and never stored on the server. You hand it to your trustee by whatever route you trust.
  • The two only meet in the trustee’s browser after the release is triggered, which is also the point at which the server’s share stops being inert.

How to set it up

  1. 1. Choose an inactivity threshold — from 30 days to a year. This is how long you can be silent before the switch arms.
  2. 2. Choose a grace period — 7 to 30 days after the threshold. Any sign-in during this window cancels the release, which is what makes the feature survivable: a long trip should not cost you your notes.
  3. 3. Name a trustee and give their email. They receive the release link when, and only when, the switch fires.
  4. 4. Save the recovery share and give it to that person by a route that does not travel with the email address. A shared password-manager entry, a sealed envelope, or an in-person handover all work.

What happens when it fires

After the inactivity threshold passes, the switch enters a grace period rather than acting immediately. Signing in cancels it. If the grace period expires, your trustee is emailed a link to a recovery page, which releases the server’s share and the encrypted bundle. The trustee enters the share they were given, the browser reconstructs the Legacy Key, unwraps the vault key, and their notes appear — decrypted locally, in their browser, by the same code path that decrypts them in yours.

At no point does anyone receive your password, and at no point does the server hold a key it can use alone.

Who this is for

Journalists and researchers

Source material, notes, and drafts that someone else may need to reach if you cannot reach them.

Solo operators

A one-person business is one point of failure. The operational notes, account inventory, and handover instructions live somewhere only you can currently open.

Anyone with a “just in case” note

Where things are, who to tell, what to do first. The note is useless if it is locked behind the password of the person who is unavailable.

Families and estates

Not a substitute for a will or a lawyer — a supplement, for the digital half of your life that a will has no vocabulary for.

What it does not do

It does not replace a will or an executor

A dead man’s switch is about access, not distribution. Legal instructions, probate, and who is entitled to what are a different conversation with a different professional.

The trustee has to actually hold their share

You are given the recovery share once, when you set the switch up. If it is never handed over, or it is lost, the released data stays unreadable — the correct failure mode, but it needs to be said out loud.

Logging in cancels it

The clock resets every time you sign in. If you keep using Scrinium, the switch never fires, no matter how the timer is configured.

The trustee gets the vault, not a selection from it

The released material reconstructs the vault key, so whoever holds the trustee share can read your notes. If that is more than you intend to share, keep the sensitive material in a separate vault — or leave it out.

It is a Pro feature

The Dead Man’s Switch is part of Scrinium Pro ($5/mo), alongside burner notes, encrypted attachments, version history, graph view, and templates.

Questions people ask

What is a dead man’s switch in a notes app?

A mechanism that waits for a signal which stops arriving — in practice, your logins — and then releases something to a person you nominated. In Scrinium, if you do not sign in for the inactivity period you chose, and you do not return during the grace period after that, your trustee is emailed a link that lets them recover your notes.

How can a zero-knowledge app release notes if it cannot read them?

By splitting the key. Scrinium uses Shamir’s Secret Sharing with a threshold of two: one share is stored on the server and the other is given to your trustee. Neither share reveals anything on its own, and the server can only ever release its own half.

What stops the server from abusing its share?

Mathematics. One share of a 2-of-2 split carries no information about the secret, so the server cannot reconstruct the key at any point — not on the timer, not under subpoena, not if the database is stolen. The release email tells the trustee that their half can now be combined with the server’s, and the combining happens in the trustee’s browser.

Can I cancel or change the switch?

Yes. Signing in resets the inactivity clock, and the switch can be disabled from settings at any time, which deletes the server’s share and the stored bundle.

Is emergency note delivery the same as sharing my account?

No. Your password is never involved. The trustee never receives your credentials, and you never hand over anything that would let them log in as you — they recover a separate copy of the vault using the share you gave them.

Set up access for the worst week

The Dead Man’s Switch is part of Pro. Free accounts keep unlimited notes and sync.

Open Scrinium