An account inventory records which accounts exist and where authorized access is arranged. Keep it protected: account names, login identities, and recovery locations are still sensitive information.
For this system, keep passwords in a reputable password manager and record only their location in the inventory. A disclosed password can put an account at risk, although multifactor authentication may prevent access. If a password is exposed, change it promptly. If you suspect someone accessed the account, follow the provider's recovery process, including reviewing active sessions and recovery settings.
What NIST Actually Recommends
NIST — the U.S. agency that maintains the federal government's digital identity guidelines — is more specific than most password advice on two points. Its current guidance states that verifiers "SHALL NOT require subscribers to change passwords periodically" but "SHALL force a change if there is evidence that the authenticator has been compromised" (SP 800-63-4, Authenticators). Separately, NIST recommends letting a password manager generate and store passwords rather than memorizing or writing them down. Put together: don't rotate passwords on a schedule, do change one the moment you have real reason to think it's exposed, and let a password manager — not a handwritten list — hold the actual secret.
What to Record Instead
For each account, record the information that helps someone find and recover access — not the credential itself:
- The service or account name.
- The login identity used (which email or username, since people often have more than one).
- Which password manager holds the actual password.
- The authentication method, if relevant (authenticator app, security key, SMS).
- Where backup/recovery codes are stored, if the account has them.
The authentication method and a backup/recovery code aren't the same kind of thing. The method is a description you can safely write down ("2FA: authenticator app on my phone"). A recovery code is different — it's itself a working, often single-use credential that can bypass your normal login, so it deserves the same protection as a password: keep the actual codes in the password manager or another protected store, and record only where they're kept, never the codes themselves.
A FICTIONAL EXAMPLE
The Delgado household's account inventory lists their streaming services alongside everything else. Next to "Everstream," it reads: "login: household account, password manager: 1Password (family vault), plan: household plan — permitted viewers: Rosa, Marcus, and the kids." The streaming service's own household plan is what actually permits everyone in the house to log in and watch; the inventory just tells whoever's picking a show which entry to look under. Nobody's permission to use the account comes from the inventory itself — it comes from being on the plan the service itself recognizes.
A Structured Version, If You Want One
SUGADUMP / LIFE takes this same position by design — the ACCESS section's Digital Account Inventory records login identity, password manager, and 2FA method for each account, with an explicit list of things it never asks for: raw passwords or PINs, Social Security numbers, full card numbers, safe combinations, alarm codes, and crypto seed phrases or private keys. It documents where things are located, never the secrets themselves.
FROM SUGADUMP
SUGADUMP / LIFE
The ACCESS section's Digital Account Inventory records where access lives — never the passwords. Explicitly built not to collect your most sensitive secrets. $19, one-time.
Explore SUGADUMP / LIFE $19Where to Go Next
An account inventory is one piece of what someone else might need from you — what information should your partner be able to find covers the broader financial picture, and how to organize important family documents covers the paper side this doesn't touch.