How to Switch Password Managers Without Losing Your Logins

Switch password managers by transferring your data, verifying the result and testing recovery before retiring the old vault. An “import complete” message is not enough: attachments, passkeys, shared items and custom fields may need separate handling.

This guide is a migration checklist, not a ranking of password managers. Product-specific steps are based on documentation rather than a migration performed on your accounts.

Inventory what must move#

List the kinds of data you use: passwords, secure notes, payment details, file attachments, one-time-code secrets, passkeys and shared collections. Include both personal and organizational ownership.

Count items by type if your manager supports it, but do not rely on counts alone. One missing primary-email login matters more than dozens of obsolete entries.

Check the destination's importer before exporting. A format that preserves ordinary logins may omit richer data. Bitwarden's export documentation distinguishes plaintext and encrypted formats and describes restrictions on account-bound encrypted exports.

Prepare the destination first#

Create the new vault through the provider's normal flow. Set up the recovery and authentication methods you intend to use. Confirm that you can sign in from the devices you actually rely on.

For shared credentials, establish the correct organization or collection rather than importing everything into one person's private account. Check who should have access before moving the data.

Keep the old vault available during verification. Do not close its account simply because the new extension installed successfully.

Choose a transfer method deliberately#

Prefer a supported direct transfer where both products offer it and its scope is clear. Otherwise use a format the destination documents as compatible.

An unencrypted CSV or JSON export can expose your credentials to anyone who obtains it. Do not email it to yourself, upload it to an online converter or leave it in a synchronized folder. Use a controlled local location and remove the temporary export after verified import. Deletion cannot retroactively remove copies that already escaped.

An encrypted export is useful only if the receiving tool can decrypt that specific format. Check portability rather than assuming every encrypted file works with every manager.

Verify the import without repeating it blindly#

Bitwarden's import guide documents supported formats and import constraints. Use the equivalent guide for your chosen destination.

Check a sample from every important category:

• Does the login have the correct website and username?
• Are long notes intact?
• Are custom fields and attachments present?
• Are shared entries assigned to the right people?
• Are one-time-code entries and passkeys handled separately where necessary?

If something is missing, determine why before importing the same file again. Repeated imports may create duplicates, depending on the product. Preserve a short record of transferred and unresolved items.

Test real use on your devices#

Try browser autofill, a mobile login and an account you use infrequently. Ensure the old extension is not silently supplying the password during the test.

Test your supported recovery route as well. You do not need to lock yourself out to discover whether the documented recovery materials are available.

For passkey-specific recovery considerations, read passkeys versus passwords. A password migration and a passkey migration are related but distinct tasks.

Retire the old vault in stages#

Once the new setup works, switch your normal devices to it. Keep any required records under the old service's retention or cancellation rules. Remove temporary exports and confirm they were not backed up or shared accidentally.

If credentials were exposed during migration, changing the affected secrets addresses a different risk from deleting the export. Do not declare an exposure fixed merely because the local file is gone.

The migration is finished when your important items, access and recovery paths work—not when the import progress bar reaches the end. For independent protection of other important files, see cloud sync versus backup.