Safely Migrate Passwords & Passkeys Between Managers

Switching password managers used to be a rare, dreaded event. Now it happens for all sorts of reasons: a favorite app gets acquired and jacks up its price, a company mandate forces you onto a specific vendor, or you finally decide that storing 200 logins in your browser's built-in vault was never a real security strategy. Whatever pushed you here, the migration itself is the moment when your entire digital life is most exposed.

Here's the uncomfortable fact most tutorials skip: the standard way to move credentials between password managers is to export them to a plaintext CSV file. That file sits on your disk, completely unencrypted, readable by any process, backup service, or malware that happens to be watching. In a 2023 audit of common migration workflows, security researchers repeatedly found exported vaults lingering in Downloads folders and synced to cloud drives weeks after the move was "finished." One leaked CSV can undo years of careful password hygiene.

This guide walks you through how to migrate passwords between password managers safely, including the newer and trickier problem of moving passkeys. You'll get a repeatable checklist, a worked example with real numbers, an honest comparison of the major tools, and the specific cleanup steps almost everyone forgets.

Key Takeaways

Migration briefly turns your encrypted vault into a plaintext file. Plan the whole process around minimizing that exposure window.

Always work offline where possible: disable cloud sync and disconnect from the internet while a plaintext export exists on disk.

Passkeys generally cannot be exported like passwords yet. You re-register them on the new manager, one service at a time.

Audit and deduplicate before you import, not after. Migrating junk just relocates your mess.

Securely wipe the export file (not just "delete"), then rotate your most critical passwords once the move is complete.

Verify the import with a spot check of 10 to 15 accounts before you trust the new vault and uninstall the old one.

Why Migrating Passwords Is Riskier Than It Looks

Your password manager's entire value is that your credentials live encrypted behind one strong master key. Export breaks that promise on purpose. Every mainstream manager, from Bitwarden to 1Password to LastPass, exports to CSV or unencrypted JSON so the destination app can read it.

That means for a few minutes, or a few careless days, your bank login, your email recovery codes, and your work SSO password all sit in a file that reads like a spreadsheet. Three things commonly go wrong:

Cloud sync grabs it. Your Downloads or Desktop folder is often synced to iCloud, OneDrive, or Google Drive. The plaintext file gets copied to servers you don't control.
Backups snapshot it. Time Machine or a nightly backup captures the file. Now it's in a backup image you may keep for a year.
It never gets deleted. The single most common failure. People finish the import, feel relieved, and forget the CSV entirely.

The good news: with a disciplined process, the risky window can be under ten minutes and the file can be gone for good afterward. That discipline is the whole game.

Before You Start: The Pre-Migration Audit

Never migrate a vault you haven't cleaned. Importing a bloated, duplicate-riddled export just carries your problems to a new home and makes the new manager slower to search. Spend 20 to 30 minutes here and the rest goes smoothly.

Step 1: Inventory what you actually have

Open your current manager and look at the raw count. Most people are shocked. A typical individual vault after five years holds 150 to 300 entries, of which 30 to 40 percent are dead: sites that no longer exist, duplicate logins, or expired trial accounts.

Step 2: Deduplicate and delete

Sort by URL or title and delete obvious duplicates (you don't need three amazon.com entries).
Remove logins for services you've closed.
Flag weak or reused passwords using the manager's built-in security report. Don't fix them yet, just note them for the post-migration rotation.

Step 3: Note your passkeys separately

Passkeys are not passwords and usually won't come along in the export. Make a list of every service where you've set up a passkey (Google, Apple ID, GitHub, PayPal, and so on). You'll re-register these manually later.

Step 4: Prepare a clean, offline workspace

Decide where the temporary export file will live. Pick a folder that is not synced to any cloud service. If you're comfortable, create a dedicated folder on a local drive and confirm it's excluded from sync and backup for the duration.

How to Migrate Passwords Between Password Managers, Step by Step

This is the core walkthrough. It works for moving between any of the major managers. The principle is simple: keep the plaintext file offline, use it once, and destroy it immediately.

Update both apps. Install the latest version of your old and new managers. Import formats change between versions, and an outdated importer is a common cause of mangled data.
Disconnect from the internet. Turn off Wi-Fi and unplug Ethernet before you export. This single step neutralizes cloud sync and blocks any exfiltration during the exposure window.
Export from the old manager. Find the export option (usually under Settings, Account, or Tools). Choose CSV or JSON. Save it to your prepared offline folder with a name you'll recognize, like vault-export-temp.csv.
Inspect the file (optional but smart). Open it in a plain text editor to confirm the fields look right: names, URLs, usernames, passwords, notes. This catches encoding problems before they pollute your new vault.
Import into the new manager. Use the new app's import feature and select the matching source format. Many managers have a preset for "Bitwarden CSV," "LastPass CSV," or "1Password" that maps fields automatically.
Verify the count. Compare the number of imported entries to what you expected after your cleanup. If you cleaned down to 180 entries and only 172 imported, investigate before proceeding.
Securely delete the export file. Do not just drag it to the trash. On Windows, use a secure-delete utility; on macOS/Linux, overwrite before removing. More on this below.
Reconnect to the internet. Only after the plaintext file is gone should you turn networking back on and let the new vault sync.
Spot-check logins. Log into 10 to 15 varied accounts using the new manager's autofill. Include one bank, one email, one shopping site, and one work login.

A worked example with real numbers

Say you're moving from LastPass to Bitwarden. Your raw export shows 247 entries. During your audit you find:

31 duplicates (same site, identical or older credentials)
22 dead accounts (services shut down or abandoned)
6 passkeys that won't export and need manual re-registration

You delete the 53 duplicates and dead accounts, leaving 194 entries. You export those, import into Bitwarden offline, and the importer reports 194 successful and 0 errors. You then re-register your 6 passkeys directly in Bitwarden over the following week. Total plaintext exposure: about 7 minutes, all of it offline. That is a clean migration.

Migrating Passkeys: The Part Nobody Explains Well

Passkeys are the biggest source of confusion in modern migrations. A passkey is a cryptographic key pair bound to your device or synced through a specific provider's ecosystem. Unlike a password, it was designed to be non-exportable as a security feature.

What that means in practice:

You can't CSV-export a passkey. There is no plaintext form to move.
Cross-provider transfer is only just arriving. The FIDO Alliance has published a Credential Exchange spec, but as of now real support between managers is limited and rolling out slowly.
The reliable method is re-registration. Log into each service, delete the old passkey, and create a new one stored in your new manager.

How to re-register a passkey on a new manager

Set your new password manager as the active passkey provider on your device (in browser or OS settings).
Go to the service's security settings (for example, GitHub → Settings → Passkeys).
Add a new passkey. When prompted for where to save it, choose your new manager.
Test the new passkey by signing out and back in.
Only then remove the old passkey from the account.

Keep the old manager installed until every passkey is re-registered. Deleting it too early can lock you out of accounts where the passkey was your only sign-in method. If you're the kind of person who thinks ahead about handing off credentials, an inheritance-focused tool like Lion's Legacy is worth understanding before you finalize your setup.

Comparing the Major Password Managers for Migration

Not every manager makes moving in or out equally painless. Here's an honest look at how the popular options handle the migration mechanics that actually matter.

Manager	Import formats	Export format	Passkey support	Migration friction
Bitwarden	Many presets (LastPass, 1Password, Chrome, etc.)	CSV / JSON	Yes, syncs across devices	Low
1Password	CSV + several native presets	CSV / 1PIF	Yes, mature	Low to medium
Proton Pass	CSV + common presets	CSV / JSON	Yes	Low
Apple Passwords	CSV (limited)	CSV (recently added)	Yes, iCloud-bound	Medium (ecosystem lock)
KeePassXC	CSV / XML	CSV / XML	Partial	Medium (manual mapping)