2026-08-03 · 17 min read

Dead man's switch email: how it works, and what breaks it

How a dead man's switch email works: check-in cadence, grace windows, accidental triggers, and where deadmansswitch.net, Killswitch and Gmail each fall short.

A dead man's switch email is a message that stays unsent for as long as you keep confirming you are reachable: the service pings you on a schedule you set, escalates through reminders when you go quiet, waits out a grace window, then emails your prepared message to the people you named. The most-cited service, Dead Man's Switch, ships a default of notifications at 30, 45 and 52 days and delivery at 60 days after your last checkin. The mechanism is four numbers; the failure modes — a missed ping during a normal trip, a spam filter eating the delivery, and your instructions sitting readable on someone else's server — decide whether it deserves your credentials.

How does a dead man's switch email actually work, step by step?#

Every hosted switch runs the same loop. You write messages and store instructions, the service periodically asks you to confirm you are okay, usually by clicking a link in an email or app notification, and if you fail to respond after a set number of attempts or a defined time window, it sends your prepared messages to the recipients you chose.

The clearest published example of the timing comes from Dead Man's Switch, in its section on premium intervals. If you enter 3, 19, 22, 50, it emails you 3 days after your last checkin, then 19 days after it, then 22, and finally sends all your emails 50 days after your last checkin. Check in at any point before day 50 and the timer resets from zero. That custom schedule is a premium feature; free accounts get the 30/45/52-then-60 default.

So four numbers decide everything, and most people only argue about the last one: the check-in cadence, the number of reminders, the grace window between the final reminder and delivery, and the reset rule.

The name comes from rail safety. A dead man's switch is designed to be activated or deactivated if the human operator becomes incapacitated — through abandonment, drowsiness, loss of consciousness, death, or being bodily removed from control — and the 1918 Malbone Street wreck on the Brooklyn Rapid Transit system, though not caused by driver incapacitation, spurred the need for universal deployment of such devices. The software version does the same thing with data: Wikipedia gives Vault 7 as an example of the pattern where sensitive information is encrypted and released in advance, and the "switch" is the release of the decryption key.

Is this different from a scheduled email?#

Yes, and the direction is reversed. Gmail's Schedule send is a timer you have to remember to cancel: you can have up to 100 scheduled emails, Google warns that scheduled emails may be sent a few minutes after the scheduled time, and cancelling means opening Menu, then Scheduled, then Cancel send, which turns the message back into a draft. Nothing in that flow checks whether you are reachable.

A dead man's switch holds the message back with your continued presence rather than your continued attention. If you have to do something to stop it, it is a switch. If you have to do something to start it, it is a reminder.

How do the named options compare?#

Option	Check-in cadence	Free tier	Encryption	Recipients and files	Price
deadmansswitch.net	Default 30/45/52 then send at 60 days; custom intervals are premium-only	Two-day intervals only, 1 message with up to 1 recipient — framed as a way to test the service	Stored securely on the servers and destroyed after they are sent; the operator tells you to add PGP or GPG yourself	Multiple messages on premium	Free tier plus paid upgrade (price not published on the pricing summary)
deadmansswitch.email	Weekly on free; daily, weekly, monthly plus SMS reminders on paid	$0: 1 email message, 1 recipient, 1 weekly reminder, expires after 1 year	Claims a zero-knowledge policy and that content stays private and encrypted until delivery, with TLS 1.3 in transit; the public page does not say whether encryption is client-side or server-side	Unlimited recipients on paid; unlimited attachments on both tiers	$10 per message ("Persevere"), marked forever valid
Killswitch	"Daily, weekly, monthly — whatever fits", with multi-stage email and SMS reminders	7-day free trial on every plan, no charge until day 8	AES-256-GCM, PBKDF2 with SHA-256 at 100,000 iterations, 12-byte IV, 16-byte salt — but files are encrypted server-side by default; browser-side encryption applies only to legacy "Sealed" files	Documents, video messages, stored passwords; different recipients get different content	Starter $7.99/mo or $79/yr (5 GB); Pro $19.99/mo or $199/yr (50 GB); Legacy $39.99/mo or $399/yr (100 GB)
Google Inactive Account Manager	Inactivity only: 3, 6, 12 or 18 months, no shorter option	Included with the account	Google-held; no message encryption of your own	Up to 10 people, all or specific Google data types	Free
DIY cron plus Healthchecks.io	Any Period you define, plus a configurable Grace Time	Self-hostable, with documented Docker deployment	Whatever you build	Whatever you build	Your time, indefinitely

Screens, onboarding and cancellation flows differ more than this grid can show, so each tool gets its own side-by-side rundown of dead man's switch apps.

What can Gmail alone do?#

Gmail's only conditional feature is Inactive Account Manager, and its limits are specific. You can select up to 10 people to receive this data and choose all or only specific data types. A phone number is mandatory — Google says it is used for the sole purpose of ensuring that only the trusted contact can actually download your data. If you pick notify-only, contacts receive an email with the subject line and body you wrote at setup — and contacts will only receive notification once your account has been inactive for the specified amount of time; they will not receive any notification during setup. Inactivity is judged from signals including your last sign-ins, your recent activity in My Activity, usage of Gmail, and Android check-ins.

One practitioner documented the escalation from observed behaviour: Google sent an alert by email and SMS a month before the account was going to enter the expired state, then another set of alerts 11 days later, then a week after that, and again 5 days after that. After it fired, the contact got a link and was told they had access to download the data over the next 3 months, with identity checked by SMS code or call.

Two behaviours catch people out. First, logging back in reactivates the account, but access does not vanish with it — the same test found the contact retained access to the expired account's data for about 24 hours after the account was reactivated, and there was no warning about the trusted contact having accessed the data. Assume anything shared was exported. Second, Google separately states it reserves the right to delete an inactive Google Account and its activity and data if you're inactive across Google for at least two years, which is a different clock from the one you configured.

Inactive Account Manager is better for account handoff than for carefully staged message delivery: it is not the right fit if you want separate messages for different people on different schedules, and it only knows about Google.

What actually breaks?#

A missed check-in is not evidence of anything. The most common failure is the accidental trigger — you're alive, but you miss check-ins because of travel, hospitalization, lost access to your email, or a spam filter problem. Going quiet and being unreachable for good are different states, and a timer cannot tell them apart. If the message carries passwords or financial instructions, an early release is not embarrassing, it is dangerous. Killswitch designs around exactly this, promising multi-stage email + SMS reminders before anything fires.

Someone has to be able to read it at the end. The operator of Dead Man's Switch says it plainly on Lobsters: no matter how much encryption the server has, ultimately it needs to send your message in plaintext, so there will be a way to read it. The same service warns you off high-stakes use directly — please don't use the service if you need strong guarantees of privacy, e.g. if you are a whistleblower or any similar life-and-death situation — and recommends encrypting with PGP or GPG before pasting anything in. Even Killswitch's stronger cryptography has seams: it documents that each share gets a unique encryption key encrypted with our server-side vault before being stored, and that on trigger access keys are decrypted (server-side) and unique links sent to each beneficiary. It also states there is no per-file "hide from AI" cryptographic tier — access follows your session, not individual files.

Concentration is its own risk. Because the core job is to store your messages until release, the switch becomes the one place where everything sensitive sits together.

The mail has to land. Practitioners on Lobsters raise deliverability: spam filters alone make me wonder about the reliability with so many free mail providers just quietly discarding messages they perceive as "too spammy".

The service has to outlast the need. The same discussion frames it as a compound bet: you're storing, presumably, some secret — hopefully encrypted — on a service that you hope will outlast you and also function reliably. Dead Man's Switch answers with a promise: if the service shuts down while you're alive, we'll send you an email well in advance so you can switch services, and it states the service has been running successfully since 2007.

Automatic release, or a person who confirms?#

This is the design decision that determines your worst-case outcome, because the trigger could be a period of inactivity, confirmation from designated contacts, or a pre-defined timeline. A human gate removes the single biggest source of wrong sends; Cipherwill describes the option as a trusted contact confirming your inability to manage affairs, or a designated period of account inactivity. LastSignal takes a version of the same idea, encrypting before upload so the server stores only ciphertext, and recipients decrypt in the browser with their own passphrases, while offering trusted contacts who can delay delivery if you are alive but temporarily unreachable.

Pick automatic release when the message is time-critical and a wrong send is survivable — a note to family, a blog post, a location. Pick a human confirmer when the payload includes credentials, payroll access, or anything a recipient could act on within the hour. Proceedly is built on the second model: you keep a check-in, and if you miss it past your grace window, a person you named confirms before your encrypted handoff plan reaches the people who depend on you. Silence alone never releases anything. The plan holds instructions and where the real credentials live, not the credentials themselves — the same separation Dead Man's Switch is pointing at when it tells you to bring your own encryption.

Can you build one yourself with cron?#

You can, and the pattern is four lines short. The canonical heartbeat is a success-only ping, where the && means the ping only fires if the work succeeded, and if the ping does not arrive inside a tolerance window, the monitor pages you:

generate-and-send-report.sh && curl -fsS "https://hc-ping.com/your-uuid"

Healthchecks.io is built for exactly this shape: it works as a dead man's switch for processes that need to run continuously or on a regular, known schedule, with a unique Ping URL per check plus a Period and a Grace Time. Grace Time is the extra wait before alerting — the docs give a worked example: Period = 1 hour, Grace Time = 5 minutes with the last ping at 12:00 means the check is declared late at 13:00 and down at 13:05. Self-hosting with Docker is documented.

Four things bite DIY builders:

Silent scheduler death. A scheduled job can stop without producing anything to alert on: the schedule was paused, deleted, or never ran, so there is no failed run to alert on.
Who watches the watcher. If your only pager is Slack and Slack is down, you may not see the dead-man alert. Route the alert somewhere that does not share infrastructure with the thing being watched.
Grace periods that are too tight. A five-minute grace on a daily job produces false positives the first time the job runs late; the guidance is 5-10 minute grace for hourly, 30-60 minutes for daily, and a few hours for weekly. Keep the scheduler and the monitor on the same IANA timezone, and treat heartbeat URLs like bearer tokens — do not commit them to public repos or log them in plaintext.
Deliverability rules you now inherit. Since February 1, 2024, Google requires all senders to set up SPF or DKIM email authentication, ensure sending domains or IPs have valid forward and reverse DNS records, use a TLS connection for transmitting email, and keep spam rates below 0.3% in Postmaster Tools. Messages must be formatted per RFC 5322, and sending to personal Gmail accounts requires a DKIM key of 1024 bits or longer. Send 5,000 or more messages a day to Gmail and you also need both SPF and DKIM, a DMARC record, a From: header aligned with the SPF or DKIM domain, and one-click unsubscribe for marketing and subscribed messages. Exceed the quotas and Gmail typically rejects with error 4.7.28.

Practitioners are blunt about the deeper problem: I wouldn't really trust something I ran to keep running after I died. As one reviewer puts it, a switch is supposed to still work when years have passed and nobody is thinking about it. Self-hosting is appealing, but it can quietly undermine the whole point.

How long does it last, and what happens if you stop paying?#

Read the expiry terms before the feature list. The free plan at deadmansswitch.email expires after 1 year, while its $10-per-message Persevere tier is marked forever valid and adds pause and resume. Killswitch publishes an always-fires guarantee: a set-up switch fires on schedule regardless of subscription status. Password managers do not always work that way: Lobsters commenters who preferred Bitwarden emergency access, Apple's Legacy Contact, or a physical safe with legal documentation still landed on the same unanswered question — what if you don't pay Bitwarden anymore, and they decide to close your vault?

How do you rehearse it before trusting it with anything real?#

Reviewers advise that with a product like this, I would want to test the reminder flow, read the policy pages carefully, and make sure I understand exactly what happens if the company changes direction or disappears, and practitioners suggest you maybe try portions of this out with some real but low-stakes thing first. Clear all eight before the payload becomes anything you would mind sending early:

Send a harmless test message to yourself and to one recipient on a different mail provider, then check the spam folder on both.
Deliberately miss one check-in cycle and time every reminder that arrives, including SMS if the plan offers it.
Confirm the reset rule by checking in one day before the final interval and watching the counter return to zero.
Add a second notification channel. Dead Man's Switch sends notifications by email, Telegram or browser push notification.
Encrypt the payload yourself if it names anything sensitive, and confirm exactly one named person can decrypt it.
Write down where the keys live, not the keys. The message should point at a location, not carry the credential.
Tell your recipient the message exists. Google notifies contacts only after the inactivity period elapses, never at setup.
Set a calendar reminder to repeat this rehearsal annually, on the same date you last rotated the payload.

Does this replace a will or an executor?#

No. A dead man's switch is not the same as an executor's authority, and it is not the same as a service's official process for handling a deceased person's account, and as one reviewer puts it, none of these tools is a substitute for legal estate planning. They can send instructions, messages, account maps, or recovery material. They cannot create legal authority by themselves. The switch is the operational layer — the instructions, the account map, the "call this person first" — sitting underneath whatever legal documents you already have. The uses vendors describe reflect that split: families ensuring loved ones can access critical documents, business owners transferring operational knowledge to partners or successors, journalists protecting sensitive sources, whistleblowers, and cryptocurrency holders transferring wallet access to heirs.

FAQ: what else comes up before you switch one on?#

What is the shortest check-in interval I can set?#

On a self-managed switch, minutes: Healthchecks.io lets you define any Period plus a Grace Time. Among hosted services, Killswitch offers daily, weekly or monthly, and Dead Man's Switch takes whatever intervals you type if you are a premium member, though free accounts are limited to two-day intervals. Google's Inactive Account Manager is the outlier: the shortest wait is three months.

Can I put passwords in the message?#

You can, and several tools support it — Killswitch stores documents, video messages and passwords. But the operator of Dead Man's Switch says the message ultimately goes out in plaintext, so anything you paste in must be assumed readable at delivery. The safer pattern is to encrypt with PGP or GPG before pasting, or to write instructions that point at where keys live rather than carrying the secret itself.

Is there a genuinely free option?#

Three, each with a sharp edge. Dead Man's Switch free is 1 message to 1 recipient on two-day intervals. deadmansswitch.email free is 1 message, 1 recipient, one weekly reminder, and it expires after a year. Google's Inactive Account Manager is free and supports up to 10 contacts, but only for Google data and only on a 3, 6, 12 or 18 month clock.

What happens if I trigger it by accident?#

Whatever you configured has already happened. With Google, signing back in reactivates the account, but one documented test found contact access lingered for roughly a day afterwards and there was no warning about the trusted contact having accessed the data, so assume they downloaded it and rotate anything sensitive. This is the strongest argument for a human confirmation step in front of delivery.

Can I use Gmail's Schedule send for this?#

Not for this job. It caps at 100 scheduled emails, sends based on the timezone you schedule them in, may go out a few minutes after the scheduled time, and requires you to open the Scheduled folder and cancel each message by hand. It has no check-in logic at all.

Will the service still be running in ten years?#

Nobody can promise that, which is why the terms matter more than the feature grid. Dead Man's Switch states it has run successfully since 2007 and commits to emailing users well in advance if it shuts down while you are alive. Weigh that against a self-built switch that nobody will notice has stopped.