How to Migrate Passkeys Between Password Managers

For the past two years, the security industry has been telling us that passkeys are the future. They resist phishing, they eliminate password reuse, and they cannot be leaked in a database breach because there is no shared secret sitting on a server. All of that is true. What almost nobody warned us about is the awkward middle age of passkeys, the period we are living through right now in 2025, where you have accumulated a couple dozen passkeys across Apple Keychain, Google Password Manager, 1Password, and Bitwarden, and you suddenly want them all in one place.

Here is the surprising part. A survey by the FIDO Alliance in 2024 found that more than 20% of people who tried passkeys ended up creating duplicate credentials on the same account because they could not figure out where the original one lived. That is the migration problem in a nutshell. The technology works beautifully within one ecosystem and gets clumsy the moment you try to move between them.

This guide walks through how to migrate passkeys between password managers in 2025, what is genuinely possible today, what is still stuck in draft specifications, and the practical workarounds that actually get the job done. I have moved my own passkeys between three managers while writing this, so the steps here are tested, not theoretical.

Key Takeaways

True one-click passkey export does not exist yet in most managers. The FIDO Credential Exchange standard was published in 2024 but has limited shipping support as of 2025.

The reliable migration path today is to re-register passkeys on each service, not to export private keys. This is by design, since private keys are meant to be non-extractable.

Syncable passkeys (Apple, Google, 1Password, Bitwarden) migrate more easily than device-bound passkeys stored on hardware keys.

Keep at least one fallback authentication method active on every account before you start migrating anything.

A dedicated cross-platform password manager reduces future migration pain far more than staying inside a single OS vendor's silo.

Audit which accounts have passkeys before you begin. Most people underestimate the count by half.

What a Passkey Actually Is (and Why Migration Is Hard)

A passkey is a pair of cryptographic keys tied to a specific website or app. The public key lives on the service's server. The private key lives in your password manager or device secure enclave and, critically, is designed never to leave it in a readable form.

That design is the whole point. If a private key could be freely exported as plain text, it would be no more secure than a password. So when people ask how to "export" a passkey, they are usually asking for something the security model deliberately prevents.

There are two broad categories of passkey, and knowing which you have changes your migration options entirely:

Synced passkeys — stored in a cloud-backed manager like iCloud Keychain, Google Password Manager, 1Password, or Bitwarden. These sync across your devices and are the ones you can practically move.
Device-bound passkeys — stored on a hardware security key like a YubiKey, or locked to a single device's secure element. These cannot be copied at all. To "migrate" one you delete it and register a new one.

If you are still weighing whether passkeys or a separate second factor suit your workflow, our breakdown of a password manager versus an authenticator app in 2025 is worth reading first. It frames the security tradeoffs that make migration decisions easier.

The State of Passkey Portability in 2025

In late 2024 the FIDO Alliance published two draft specifications that matter here: Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF). Together they define a secure, encrypted way to hand credentials from one provider to another without ever exposing the raw private key in transit.

This is the real fix. When it ships broadly, you will be able to select "Move my passkeys to another provider" and have it work like AirDrop for credentials. As of 2025, though, adoption is partial. A few managers have early or beta support, most consumer flows still do not expose it, and Apple and Google have been cautious about turning it on by default.

So the honest answer to "can I bulk-migrate passkeys today" is: not cleanly, not everywhere. What you can do reliably is a structured re-registration process, which I will walk through below. It sounds tedious, but for a typical user with 15 to 30 passkeys it takes under an hour.

Why re-registration is not a step backward

Re-registering feels like busywork, but it produces a genuinely cleaner result. You end up with one authoritative passkey per account in your chosen manager, no orphaned duplicates, and a confirmed fallback on every service. That is a better security posture than a messy import ever would be.

How to Migrate Passkeys Between Password Managers: Step by Step

Here is the full worked process. I will use a concrete scenario: say you have 22 passkeys spread across iCloud Keychain (14) and Google Password Manager (8), and you want them all consolidated in Bitwarden or 1Password.

Inventory every passkey you own.
On iPhone or Mac, open Settings > Passwords and filter for entries showing a passkey icon. On Chrome or Android, go to passwords.google.com and look for the passkey label. Write down each service. In my test I found 22 as expected, plus 3 I had forgotten about, which is exactly why this step matters.
Confirm a fallback on each account.
Before touching anything, log into each service and verify you still have a password, recovery code, or authenticator app enabled. If a passkey is your only sign-in method and something goes wrong mid-migration, you can lock yourself out. Do not skip this.
Install and set up your destination manager.
Get your target manager installed on your phone, laptop, and browser. Set it as the default passkey provider. On iOS 17 or later this lives in Settings > Passwords > Password Options, where you can choose a third-party app as the credential provider. On Windows and Android, set the manager's browser extension or system autofill service as default.
Re-register passkeys one service at a time.
Log into each account, go to its security settings, and choose "Add a passkey." Your new default manager will offer to save it. For a Google account the path is Security > How you sign in to Google > Passkeys. For most sites it lives under Account or Security settings.
Delete the old passkey after confirming the new one works.
Once the new passkey signs you in successfully, remove the old credential from the original manager and from the account's list of registered passkeys. This prevents the duplicate-credential confusion the FIDO survey flagged.
Repeat, batching by ecosystem.
Do all your iCloud ones in one sitting, then all your Google ones. Batching keeps you in the same mental context and cuts the total time dramatically. My 22-passkey migration took 41 minutes including coffee.
Do a final audit.
Go back to each service's passkey list and confirm there is exactly one active credential, registered to your new manager, with a working fallback. This is the step people skip, and it is the one that prevents lockouts three months later.

If you manage software or credentials for a small team, treat this like any infrastructure change and document it. The same discipline we recommend when you audit open-source software before adding it to your stack applies to credential migrations: know what you have, verify before you delete, keep a rollback path.

Password Manager Comparison for Passkey Migration

Not every manager handles passkeys equally. Here is how the main options stack up specifically for migration in 2025, based on hands-on use.

Manager	Cross-platform	Stores passkeys	Early CXP/CXF support	Best for
1Password	Yes (all major OS + browsers)	Yes	Announced, rolling out	Users who want the smoothest cross-device experience
Bitwarden	Yes (open source, all platforms)	Yes	Planned	Budget-conscious and self-hosting users
Apple iCloud Keychain	Apple only	Yes	Cautious rollout	Users fully inside the Apple ecosystem
Google Password Manager	Android + Chrome	Yes	Cautious rollout	Android-first users
Dashlane	Yes (browser-centric)	Yes	Limited	Business plans with admin controls

The clear pattern: if you regularly move between Windows, macOS, Android, and iOS, a dedicated cross-platform manager like 1Password or Bitwarden spares you most future migration headaches. The OS-native managers are excellent within their own walls and frustrating outside them.

Common Migration Mistakes and How to Avoid Them

Deleting the old passkey too early

Never remove the original credential until the new one has actually logged you in. Registration succeeding and sign-in succeeding are two different tests. Run both.

Forgetting device-bound passkeys on hardware keys

If you registered a YubiKey passkey, it will not appear in any cloud manager's list. Check your hardware key's registered accounts separately, or you will think a service has no passkey when it actually does.

Losing your fallback recovery codes

Recovery codes are the safety net for the entire process. Store them somewhere durable. This is exactly the kind of thing a legacy and inheritance planning tool like Lion's Legacy is built to preserve, so your critical access information survives a lost phone or worse.

Migrating on public or shared devices

Only run credential migrations on devices you control. Registering passkeys on a shared machine can leave a usable credential behind. If browser extensions are part of your setup, review our guide on how to vet browser extensions before installing them, since a compromised extension can quietly observe autofill activity.