An emergency binder your family can actually open

The idea

A small self-hosted service where one person stores everything a household would need if they suddenly could not answer questions: where the insurance policy lives, which bank holds the mortgage, the boiler service contract, the passwords that are not in the shared password manager, instructions for the dog. It stays encrypted and unreadable to everyone, including the server, until either the owner grants access or the owner stops checking in. Release requires two things at once: a timer that has run out, and enough named recipients showing up together to reassemble the key.

Why build this

Most households have this information in exactly one head, or in a password manager whose master password is also in exactly one head. The advice — write it down, put it in a fireproof box, tell your partner where the box is — fails quietly, because the document goes stale six weeks after it is written and nobody notices. Password managers have emergency access features, but they only cover credentials, they assume every family member is already a paying user of the same product, and they are the wrong shape for "the plumber we actually trust" or "the mortgage is with a broker, not the bank on the statements."

The primitives to do this properly are now boring and available: age for file encryption, Shamir's Secret Sharing implementations in every language, passkeys for owner login, and a $5 VPS. And the trust argument favours self-hosting hard. Handing a startup the single document that unlocks your entire life is a genuinely bad trade; running it yourself, on a box your executor also has a recovery path into, is defensible.

Stack sketch

• Go service, single binary, SQLite for metadata (recipients, check-in history, release state) and files on disk.
• Encryption with filippo.io/age: each vault entry is encrypted to a vault key; the vault key is never stored whole.
• Key splitting with Shamir over the vault key — hashicorp/vault/shamir is the obvious pick — into N shares with a threshold of K. Each recipient's share is handed to them out of band at setup as a printable card with a QR code.
• Owner auth via WebAuthn passkeys (go-webauthn/webauthn), no password to forget.
• Check-in and escalation over SMTP (Resend or Postmark) plus Twilio SMS for the last stage, because email alone gets filtered.
• Web UI server-rendered with html/template and htmx — no SPA, this thing must still work in five years with no build step.
• Docker Compose deployment behind a reverse proxy, plus a binder export CLI that writes an encrypted tarball for offsite backup.

Scope for v1

• In: entries with a title, markdown body, and file attachments; recipient list with shares; a weekly check-in email with a one-click "still here" link; a configurable dead-man timer (miss three check-ins, then a 14-day grace period with escalating notices); a release page where K recipients paste their shares to decrypt; an audit log of every check-in, release attempt, and view.
• In: a printable setup pack — the share cards, the URL, and one page of instructions written for someone who has never heard of encryption.
• Out: multi-owner vaults, mobile apps, any legal document generation, sharing individual entries with individual people, and integrations that pull balances from banks. All of those are v2 arguments dressed as v1 features.

Where it could go

The obvious next step is scheduled partial disclosure — a household operations entry (bin day, alarm code, vet) that a partner can see today, separate from the sealed material that only releases on the timer. That turns the tool from a morbid one-off into something opened monthly, which is the only way its contents stay accurate.

After that, staleness is the product. Attach a review interval to each entry and nag on it; an insurance policy entry that has not been touched in three years is worse than useless because it is confidently wrong. A third path is a hosted version for people who will never run Docker, priced per year and deliberately built so the operator cannot decrypt anything — the shares live with the family, and the business is uptime and reminders rather than custody.

Watch out for

The failure mode that matters is not a breach, it is a false release: a bereaved-looking group of recipients triggering disclosure while the owner is on a two-week hike with no signal. Make the grace period long, make cancellation possible from any device with a passkey, and make every escalation notice loud enough that a living owner cannot miss it.