Guide

A dead-man's switch, explained

The name comes from a physical control that stops a machine if the operator lets go. The digital version is a promise: if I do not press a button by a date I chose, do the thing I asked you to do. For a legacy vault, the thing is "let these people read this packet."

The timer is the weak part

A clock cannot tell death from a broken phone, a hospital stay, a spam folder, or a year in which you were simply tired of the ritual. Products that email your secrets the morning after a missed ping are optimising for drama. A usable switch has a reminder before the date, a grace period after it, and a way to cancel that does not require you to remember a second password while you are annoyed. Heemnota's cancel control is one click during grace and while verifiers are still confirming. That is the whole point of the delay: you get to say "I am here."

Who is allowed to finish the job

Some switches trust the company. The company holds the message in a form it can read, and it sends the message when the timer ends. That is simple, and it means a breach or a curious employee is the same as a release. Other switches encrypt to the recipient in advance. The company can hand over the file early, but it cannot read it. That is the model Heemnota uses when you do not add verifiers. It is access control, not a mathematical time-lock. Say that out loud before you rely on it.

A threshold asks more. The packet key is split. A chosen number of verifiers must each unlock their share and pass it on, re-encrypted to the recipient, before the recipient can open the file. The company still decides when to ask them. A dishonest operator can ask early. The verifiers are there to refuse. Pick people who will say no if you are merely on a flight, and who will say yes if you are not coming back. Do not pick the same person as the only recipient and the only verifier and then call it a control.

What "time-lock" usually is not

True time-lock encryption, where nobody including the operator can decrypt before a public clock ticks, exists in research systems and in a few specialised networks. It is a poor fit for a check-in that resets every month, and it is not what most consumer products implement even when the marketing says "dead-man's switch." If a vendor claims the server cannot release early, ask who holds the key shares and what happens when the vendor's database is copied. If the answer is "trust us," you have an access-control switch. That can still be the right product. It is not the same claim.

Keys that have to last

The recipient may not need their release key for twenty years. A key that lives only in one browser profile will not. Download it and keep it with the other papers your future self, or your people, can find. The operator cannot regenerate it. That inconvenience is the same property that keeps the operator from reading the packet.

Use a switch for instructions and locations. Do not use it as a way to fire off account passwords at the first silent month. And do not treat a successful release as a legal transfer. The packet is a letter. The will, the beneficiary form, and the provider's own process are still the doors.