How to Safely Migrate Passwords and Passkeys Between Managers

Switching password managers used to be a low-stakes chore. You exported a CSV, imported it somewhere else, and deleted the file. Passkeys changed that calculus completely. As of 2024, more than 15 billion online accounts support passkey sign-in, and yet the FIDO Alliance's own specification made passkeys deliberately hard to export in plaintext. That security feature turns into a migration headache the moment you decide 1Password, Bitwarden, or Apple Passwords is no longer where you want to live.

I have moved my own vault across four managers in the past six years, most recently a 312-item vault with 41 passkeys. The password half was trivial. The passkey half taught me a lot about what actually transfers, what silently gets left behind, and how a careless export can leave a decrypted copy of your entire digital life sitting in your Downloads folder.

This guide walks through how to migrate passwords and passkeys between managers without losing data or exposing it. You will get a step-by-step process, a comparison of how the major tools handle exports, a worked example with real numbers, and the specific verification steps that separate a safe migration from a breach waiting to happen.

Key Takeaways

• Passwords export cleanly as CSV or encrypted files; passkeys usually do not and often need to be re-registered per site.
• Never leave a plaintext CSV export on disk. Use an encrypted export where available, and securely wipe temporary files immediately.
• The new FIDO Credential Exchange Protocol (CXP) is the real fix for passkey portability, but tool support is still rolling out through 2025.
• Migrate in a fixed order: audit, back up, export, import, verify, then wipe. Skipping verification is where people lose data.
• Enable 2FA and a strong master password on the destination vault before importing anything.
• Treat any downloaded desktop tool involved in the process with the same scrutiny you would a security plugin.

Why passwords and passkeys migrate so differently

A password is a shared secret. Both you and the website store a version of it, so a password manager just needs to hand over the string. That is why every mainstream manager supports a CSV export: the data is fundamentally portable.

A passkey is not a shared secret. It is a public/private key pair created during registration. The website keeps the public key; your device or password manager keeps the private key inside a hardware-backed or software-encrypted store. The private key was designed to be non-extractable in plaintext for security reasons.

This is the crux of the difference:

• Passwords can be copied. Migration is a data transfer.
• Passkeys often cannot be copied in a usable form. Migration frequently means re-creating the credential on the new manager and letting the old one expire.

There is one bright spot. The FIDO Alliance published the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) in 2024 specifically to let passkeys move securely between managers in encrypted form. As support matures, true passkey migration becomes possible. Until every manager you use supports it, plan for the re-registration path.

Step 1: Audit what you actually have before you touch anything

Do not export blind. Take fifteen minutes to inventory your vault so you know what "success" looks like after the move. Open your current manager and note:

1. Total logins (passwords). This is your baseline count.
2. Number of passkeys, listed separately. Most managers show these with a distinct icon or a dedicated filter.
3. TOTP / 2FA secrets stored inside the vault. These are separate from passwords and passkeys and often need their own export.
4. Secure notes, credit cards, identities, and attachments. These rarely survive a CSV round-trip.
5. Shared vaults or team items, which usually export separately or not at all.

Write these numbers down. When I moved my 312-item vault, the breakdown was 248 logins, 41 passkeys, 19 TOTP secrets, and 4 secure notes. After import, I checked every category against those figures. Two secure notes had dropped because they contained attachments the CSV format could not carry. I would never have noticed without the pre-migration count.

Step 2: Prepare the destination before you export

The most common mistake is exporting first, then scrambling to set up the new manager while a decrypted file sits on your desktop. Reverse that order. Lock down the destination first.

1. Create the new account and set a master password of at least 16 characters, ideally a passphrase you have never used before.
2. Enable two-factor authentication on the destination vault immediately. If your migration involves the vault holding your only TOTP codes, use a hardware key or a separate authenticator.
3. Install the official apps and browser extension from the vendor's real domain, not a search-ad clone. Verify the publisher.
4. Confirm the recovery method works. Save the recovery key offline before you depend on the vault.

If your migration touches downloadable helper tools, apply the same discipline you would to any executable. Our walkthrough on how to verify open-source software before you install it covers checksum and signature verification that applies equally to a password manager desktop client.

Step 3: Export passwords the safe way

Now export, and prefer the encrypted option every single time it exists.

Encrypted export (best)

Bitwarden, 1Password, and a few others offer a password-protected or account-encrypted export. This produces a file only the destination or your credentials can open. It is the ideal path because the file is never plaintext on disk.

CSV export (use with care)

When only CSV is available, the file is fully plaintext. Every password is readable in Notepad. Treat it like radioactive material:

• Export to a folder you will remember, not a shared or cloud-synced directory.
• Disconnect from cloud backup temporarily so the CSV does not sync to five devices.
• Import it immediately, then move to secure deletion (Step 6).

On Windows, if you need to manage where these temporary files land or create isolated working directories, a utility like Windows Symlink Creator Pro can help you route exports to an encrypted volume rather than your default Downloads folder. You will find related tools in our desktop utilities collection.

Step 4: Handle passkeys as their own project

This is where migrations get messy. You have three realistic options, in order of preference.

Option A: CXP/CXF direct transfer

If both your source and destination managers support the FIDO Credential Exchange Protocol, use it. The passkeys move in encrypted form and arrive fully functional. As of mid-2025 this is available between a growing set of managers but is not yet universal, so check both apps' release notes.

Option B: Re-register per site (the reliable fallback)

If CXP is not available, you re-create each passkey on the destination:

1. Sign in to the website using your existing passkey (or password) one last time.
2. Go to the site's security settings and add a new passkey. Choose your new manager when the browser prompts for where to save it.
3. Test the new passkey by signing out and back in.
4. Only then, remove the old passkey from the site and delete it from the old manager.

For 41 passkeys, this took me about 90 minutes spread over two evenings. Tedious, but zero data loss and every credential verified working before I deleted anything.

Option C: Keep the old vault as passkey-only (temporary bridge)

If re-registering 40 passkeys at once is impractical, keep your old manager installed solely for passkeys and move passwords now. Migrate passkeys gradually as you naturally log into each service. Set a hard deadline so the old vault does not linger for years.

Step 5: How the major managers compare for migration

Not every manager makes this equally painless. Here is how the common choices stack up on the criteria that actually matter during a move. Ratings reflect hands-on testing through 2025 and will shift as CXP support expands.

Manager	Encrypted export	Passkey export (CXP)	TOTP included	Import formats
Bitwarden	Yes (JSON, password-protected)	Rolling out	Yes	Very broad (50+)
1Password	Limited (1PUX encrypted archive)	Rolling out	Yes	Broad
Apple Passwords	No (CSV only)	Import via CXP	Yes	Limited
Google Password Manager	No (CSV only)	Partial	No (separate)	CSV
KeePassXC	Native encrypted DB	No native passkey	Yes	CSV, XML

The practical read: if secure export matters most, Bitwarden and KeePassXC give you encrypted files by default. If you live inside Apple's ecosystem, expect a plaintext CSV for passwords and lean on CXP for passkeys. Whatever you choose, verify the vendor's current release notes because these capabilities are moving fast.

Step 6: A worked example, start to finish

Say you are moving from Google Password Manager to Bitwarden. You have 47 passwords, 6 passkeys, and your TOTP codes live in a separate authenticator app (Google stores those elsewhere). Here is the full run.

1. Audit: Confirm 47 logins and 6 passkeys in Google. Note the six passkey sites: Google, GitHub, Amazon, Best Buy, PayPal, and your bank.
2. Prepare Bitwarden: Create the account, set a 20-character passphrase, enable 2FA with a hardware key, save the recovery code offline.
3. Export passwords: In Chrome, go to Google Password Manager, Settings, Export passwords. You get Google Passwords.csv with all 47 in

   Cover image: Phone security by Ervins Strauhmanis, licensed under BY 2.0 via Openverse.