Most people who change password managers do it once, maybe twice, in a decade. That is exactly why the process feels so fraught. You are moving the single most sensitive file you own, the one that opens your bank, your email, your cloud storage and your work accounts, and you are doing it without a regular rhythm to fall back on. A 2024 survey of consumer security habits found that roughly one in three respondents had never exported their password vault at all, and most of those who had tried reported at least one entry that failed to transfer cleanly. The gap between "I want to switch" and "I have switched safely" is where people lose accounts.
Passkeys have made this harder. A passkey is a cryptographic credential tied to a device or a synced credential provider, and it does not behave like a typed password. You cannot read it out as text, and in many cases the standard export formats simply do not carry it. Users who assumed their vault was a portable spreadsheet of logins are discovering that some of their sign-ins live somewhere else entirely.
This guide explains how password manager passkey export and import actually work in 2026, what gets carried across and what does not, and how to move your vault without creating new risks. You will get a worked example with real numbers, a comparison of the main transfer routes, and a numbered walkthrough you can follow from start to finish. We will also cover the cleanup most people skip, which is the step that actually reduces your exposure.
Key Takeaways
- A passkey is not a password. Standard CSV exports usually omit passkeys, so you must check each service's sign-in methods separately.
- Export is the riskiest moment. The exported file is an unencrypted copy of your secrets, so treat it like a live credential and delete it immediately after use.
- Verify before you delete. Count entries in the source and the destination, then spot-check at least ten logins including one passkey-backed account.
- Re-enroll passkeys on the new manager while the old session is still active. You cannot always migrate the cryptographic key itself.
- Rotate the passwords you exported if the file was ever stored in a shared folder, emailed, or synced to a device you do not fully control.
- Keep the old vault read-only for 30 days as a fallback, then archive it encrypted rather than deleting it outright.
What Is a Password Manager Passkey Export, Exactly?
A password manager passkey export is the process of pulling your stored credentials out of one vault in a format another vault can read. For ordinary passwords, that usually means a CSV or JSON file containing site name, URL, username, password and notes. For passkeys, the picture is more complicated, because a passkey is generated by your device or manager and bound to a specific relying party, usually a website or app.
There are three things a passkey can be. It may be a synced passkey held by a cloud provider such as iCloud Keychain, Google Password Manager or a third-party vault with passkey support. It may be a device-bound passkey that lives on one piece of hardware, such as a security key or a single phone, and cannot be copied. Or it may be a vault-stored passkey, where the manager holds the private key and can in principle export it if the vendor supports that operation.
The practical consequence is simple. Passwords move as text. Passkeys move, if at all, through vendor-specific protocols. Most export buttons will give you the text you can see and quietly skip the rest.
Why Passkey Export Is Harder Than Password Export
The reason passkeys do not travel like passwords is deliberate. The whole point of a passkey is that the private key never leaves the device or the trusted provider in readable form. A CSV file cannot represent a private key without undermining that promise, so the standard export format has no column for it.
The FIDO Alliance and major browser vendors have been working on a portable credential exchange format so that passkeys can move between providers without a full re-registration. Support is arriving unevenly. Some providers can import a standard credential bundle, while others only accept re-registration. Assume that the cryptographic key will not transfer for any given account, and plan for re-enrollment.
Worked Example: Moving 47 Logins Across 12 Services
Consider a realistic case. Priya runs a small design studio and has 47 saved entries in her old vault, spread across 12 services she actually uses: email, cloud storage, banking, two e-commerce platforms, a project tool, a domain registrar, her hosting panel, a social account, and a few smaller utilities. Of those 47 entries, 31 are plain passwords, 9 have two-factor codes stored alongside them, and 5 are accounts where she has enrolled a passkey on her phone.
Her plan breaks down like this:
- Step load: 31 password entries export cleanly as CSV. 9 entries need the TOTP seed re-added manually, since many exports drop it. 5 passkey accounts need re-enrollment.
- Time estimate: The CSV transfer takes about 3 minutes. Verification takes about 20 minutes if done properly. Re-enrolling 5 passkeys and re-adding 9 TOTP seeds takes roughly 45 minutes, because each one requires logging into the service and confirming.
- Risk window: The unencrypted CSV exists on disk for however long she leaves it there. If she keeps it in her Downloads folder for a week, that is a week of exposure for 31 live passwords.
Her first attempt went wrong in a way that is common. She exported, imported, saw 47 entries in the new vault, and deleted the old one the same afternoon. Three days later she discovered that the import had silently dropped the notes field, which held recovery codes for her domain registrar. Losing those would have locked her out of the domain. The lesson: a matching entry count is not the same as a complete transfer.
Passkey Export Options Compared
The right route depends on which managers you are moving between and how many passkeys you hold. This comparison reflects the general state of major options in 2026; always confirm current behavior with the vendor, since support changes frequently.
| Transfer route | Passwords | Passkeys | TOTP seeds | Ease of use | Main risk |
|---|---|---|---|---|---|
| Standard CSV export and import | Yes | Usually no | Often no | High | Unencrypted file left on disk |
| Encrypted vault export (JSON or vendor format) | Yes | Sometimes | Usually yes | Medium | Forgotten export password |
| Credential exchange standard import | Yes | Yes, where supported | Partial | Medium | Partial support across providers |
| Manual re-enrollment per site | Re-entered by hand | Yes | Yes | Low | Time cost and missed accounts |
| Platform keychain migration | Yes | Yes, within same ecosystem | Partial | High | Locks you into one ecosystem |
My own preference, after moving vaults several times, is the encrypted export where the vendor offers one, followed by a deliberate passkey re-enrollment pass. The encrypted file removes the plaintext-on-disk problem, and the re-enrollment is slow but it is the only method that reliably works for passkeys across providers.
How Do You Export a Password Vault Without Exposing It?
Exporting is the most dangerous step, so the goal is to shrink the window in which a plaintext copy exists. Here is the walkthrough I use.
- Update both apps first. Old versions often have export bugs that were fixed in later releases. Check that both the source and destination managers are on current builds.
- Audit before you export. Open the source vault and note the total entry count, the number of entries with notes, the number with two-factor data, and the number with passkeys. Write these down. You will check against them later.
- Check for passkeys separately. Go through your most important accounts (email, banking, cloud, domain registrar) and look at each service's security settings for "passkeys" or "security keys." Record which ones you have enrolled.
- Choose an encrypted export if offered. If your vendor supports an export protected by a passphrase, use it and choose a long passphrase you will store separately. If only plaintext CSV is available, go to step 5 with extra care.
- Export to an encrypted or local location only. Do not export into a cloud-synced folder. Do not email the file. If you must use plaintext, export to a removable drive or a folder excluded from sync, not your Downloads folder.
- Import into the new manager. Use the destination's import wizard and read any column-mapping prompts carefully. A misaligned notes column is the most common silent failure.
- Verify. Compare the entry count against your audit. Then spot-check at least ten entries, including one with notes, one with TOTP, and one that uses a passkey on the source.
- Re-enroll passkeys. While the old session is still active on each service, go to security settings, add a new passkey, and select the new manager or the device it syncs to. Remove the old passkey only after the new one works.
- Destroy the export file. Overwrite it with a secure delete tool, then empty the trash. On macOS and Linux, a standard delete leaves recoverable data; on Windows, use a secure-erase utility if the drive holds sensitive material.
- Keep the old vault read-only for 30 days. Do not delete it yet. Archive it encrypted if you want a long-term fallback.
What Should You Do If the Export File Was Exposed?
If an unencrypted export sat in a synced folder, was emailed, or was copied to a machine you no longer control, treat every password in it as compromised. The fix is not complicated, but it is tedious, and it is the step people most often skip because the migration already feels finished.
Prioritize in this order: email accounts first, because they reset everything else; then banking and payment accounts; then your domain registrar and hosting; then cloud storage; then everything else. Change each password, enable or rotate two-factor authentication, and check each service's active sessions and connected devices for anything you do not recognize.
If you are unsure whether a broader vault problem exists, the breach-response steps in our guide on password manager breach response walk through what to lock down and in what sequence. For a concrete example of how a vendor incident changes the calculus, see our analysis of the mSecure breach and what it meant for users, which covers how to judge whether your own vault needs replacing.
How Do You Verify a Password Manager Import
Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse.
