How to Migrate Passkeys Between Password Managers on Android

If you've spent the last year setting up passkeys, you've probably run into an uncomfortable truth: getting them in was easy. Getting them out is a different story. Passkeys were designed to be phishing-resistant and account-bound, and that same security model makes them stubborn to move. Until very recently, if you stored 30 passkeys in Google Password Manager and wanted to switch to 1Password or Bitwarden, your only real option was to delete each one and re-register it site by site.

That changed in 2024 when the FIDO Alliance published a working draft of the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), a standardized way for password managers to hand credentials to each other securely. Apple, Google, 1Password, Bitwarden, Dashlane, and others all signed on. As of 2025, the first real implementations are shipping on Android, and the experience is finally starting to resemble a proper migration rather than a manual slog.

This guide walks through how to migrate passkeys between password managers on Android in 2025, what actually works today versus what's still theoretical, the tradeoffs between the major apps, and how to do it without locking yourself out of your accounts. I've migrated my own collection twice, so I'll flag the sharp edges as we go.

Key Takeaways

• Android 14+ lets you set any FIDO2-compatible app as your default credential provider, which is the foundation for switching managers.
• True passkey export/import via the FIDO Credential Exchange Protocol is rolling out gradually in 2025 — check whether both apps support it before you plan a migration.
• If direct export isn't available yet, the reliable fallback is re-registering passkeys per site, which takes roughly 1–2 minutes each.
• Never delete a passkey from your old manager until the new one is confirmed working and you've tested a sign-in.
• Keep at least one recovery method (2FA backup codes or a password) active on every account before you touch its passkeys.
• Sync-based managers make cross-device migration far smoother than device-bound passkeys stored in hardware.

What a Passkey Actually Is (And Why Migration Is Hard)

A passkey is a pair of cryptographic keys. The private key stays on your device or in your password manager's encrypted vault; the public key lives on the website's server. When you sign in, your device proves it holds the private key without ever transmitting it. That's why passkeys can't be phished the way passwords can.

The catch is right there in the design. Because the private key never leaves its secure storage, there was historically no sanctioned way to copy it into a different manager. Passwords are just strings, so exporting them as a CSV was trivial. Passkeys are secrets that were engineered specifically to not be portable.

Two things break this deadlock:

• Synced passkeys. Most modern managers store passkeys in a cloud-synced, end-to-end encrypted vault rather than in hardware. These are copyable in principle because the manager already moves them between your own devices.
• The Credential Exchange Format (CXF). A new open standard that lets one manager package passkeys into an encrypted bundle that another manager can import, without ever exposing the raw keys to the operating system in plaintext.

If you're still getting comfortable with the basics, our companion piece on how to set up passkeys to replace passwords covers registration from scratch. This article assumes you already have passkeys and want to move them.

Before You Migrate: The Pre-Flight Checklist

Migrations go wrong when people delete the old thing before confirming the new thing works. Do this in order.

1. Inventory your passkeys. Open your current manager and count them. Note which are critical (email, bank, primary Google/Apple account) versus low-stakes.
2. Confirm each critical account has a backup sign-in method. A recovery email, an authenticator app, or stored 2FA codes. Our guide on how to store 2FA backup codes safely is worth reading before you proceed.
3. Update both apps to their latest versions. Passkey export support is version-gated. An outdated app simply won't show the option.
4. Charge your phone and use a stable network. A dropped connection mid-import can leave a half-migrated vault.
5. Pick a quiet 30-minute window. This isn't a five-minute task if you have more than a handful of credentials.

A worked example

Say you have 47 passkeys spread across Google Password Manager, and you want to consolidate everything into Bitwarden so your work and personal devices share one vault. Of those 47, maybe 8 are high-stakes (email, bank, brokerage, cloud storage) and the rest are throwaway logins for shopping sites and forums.

If your Android build and both apps support CXF export, the entire batch moves in a single encrypted transfer that takes under two minutes. If they don't yet, you'd re-register the 8 critical ones by hand first (about 15 minutes total), verify each with a test login, and migrate the remaining 39 opportunistically the next time you visit each site. That staggered approach means you're never locked out of anything that matters.

How to Set Your Default Passkey Provider on Android

Before you can migrate anything, your target manager needs to be the system's active credential provider. On Android 14 and newer:

1. Open Settings and search for Passwords & accounts or Passkeys.
2. Tap Passwords, passkeys & autofill services (the exact label varies by manufacturer — Samsung, Pixel, and OnePlus word it slightly differently).
3. Under Preferred service or Additional providers, you'll see every installed manager that supports the passkey API.
4. Select your new manager (for example, Bitwarden or 1Password) as the preferred provider.
5. Confirm the permission prompt. Android may ask you to unlock the app once to verify.

Once set, new passkey registrations and sign-in requests route through your chosen app. Note that setting a new default doesn't move existing passkeys — it only changes where future ones land. The actual migration is a separate step covered below.

Method 1: Native Passkey Export and Import (CXF)

This is the clean path, and it's the one to use if both your source and destination apps support it. The interface is still being polished across vendors, but the general flow looks like this:

1. In your source manager, open Settings and look for Export, Transfer, or Move credentials. In apps that support CXF, you'll see an option specifically for passkeys, not just passwords.
2. Authenticate with biometrics or your master password. This is mandatory — the app won't package secrets without a fresh unlock.
3. Choose your destination manager from the list of installed apps that advertise import support. The OS brokers this handshake so the encrypted bundle never touches a file you could accidentally leak.
4. Confirm the transfer. The passkeys move as an end-to-end encrypted payload.
5. Open the destination manager and verify the passkeys appear in your vault.
6. Test a sign-in on one non-critical account before deleting anything from the source.

Reality check for 2025: not every pairing works yet. Support depends on both apps implementing the same CXF version. If the option is grayed out or missing, your apps aren't there yet, and you'll fall back to Method 2. The standard is moving fast, so re-check after each major app update.

Method 2: The Manual Re-Registration Fallback

When direct export isn't available, you re-create passkeys on the new manager one account at a time. It's tedious but bulletproof, and it's what most people used through 2024.

1. Set your new manager as the default provider (see above).
2. Sign in to a target website using your existing password or old passkey.
3. Go to the site's Security settings and find the passkey management section.
4. Choose Add a passkey or Create a passkey.
5. When Android prompts you for where to save it, your new manager should now be the offered option. Confirm with biometrics.
6. The new passkey is created and stored in the new vault. The site now has two public keys registered — the old one and the new one.
7. Sign out and sign back in using the new passkey to confirm it works.
8. Only then delete the old passkey from both the website and your old manager.

At roughly 60 to 90 seconds per account, 47 credentials is around an hour of work. Do the 8 critical accounts in one focused session and let the rest trickle in naturally. There's no rule that says you have to migrate everything the same day.

Password Manager Comparison for Android Passkey Migration

Not all managers are equal when it comes to moving passkeys. Here's how the major options stacked up for Android users as of mid-2025. Verify current versions, since this space changes monthly.

Manager	Synced passkeys	CXF export (2025)	Android default provider	Cross-platform
Google Password Manager	Yes	Rolling out	Yes (built in)	Android + Chrome
1Password	Yes	Yes (early)	Yes	All major platforms
Bitwarden	Yes	Rolling out	Yes	All major platforms
Dashlane	Yes	Planned	Yes	All major platforms
Samsung Pass	Yes	Limited	Yes (Samsung only)	Samsung ecosystem

The pattern is clear: cross-platform managers with full sync are the safest bets for anyone who lives across Android, Windows, and the web. If you're locked into a single vendor's ecosystem, migration options narrow quickly. When you're evaluating any security tool, the same instincts apply as when you choose backup software using a proper buyer's checklist — portability and export are features, not afterthoughts.Cover image: Phone security by Ervins Strauhmanis, licensed under BY 2.0 via Openverse.