Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I work with - just simply curious.
So if an old employer needed a password for some resource that only I had. Would I be obliged to give it to them or could I (probably unwisely) stick it to them and either refuse or charge an outrageous "consulting" fee for providing that password?
Or what if I designed some component for them like some sort of underlying encrypted security layer that required some a hash key that only I had, would I be obliged to give it to them?
These two scenarios are generally the fault of the employer, but what if in the third scenario, I built this component in stealth, without them actually knowing? I don't necessarily mean the component was built with the sole intention of locking the employer out in the future, it may have actually served a good purpose - it just never got documented how it functioned because company had poor documentation processes or developers were too busy etc.
In that scenario, when they finally need this hash key, would I be obliged to provide it?