How to Import Passwords Into Bitwarden Safely

The steps below cover a personal vault. If an employer manages the data, use its approved migration process and permissions. Do not transfer organisational passwords into a personal account just because you can export them.

Before You Start

• Sign in to the correct Bitwarden account and server region. Confirm you can unlock it and access your recovery information.
• Keep the old manager available. Check which items belong to your personal vault and which are shared or owned by an organisation.
• Note the item types you need: passwords, notes, cards, attachments, passkeys and verification-code secrets.
• Use your own updated device. Decide where an export will be saved before creating one; avoid a folder that automatically syncs to the cloud.

Check the source-specific instructions linked from Bitwarden’s import and export FAQ. A file’s extension is not enough: two CSV files can use different field layouts. Do not upload a password export to an online converter or AI chat to “fix” it.

Import a File Through the Web Vault

1. Open your Bitwarden web vault and select Import from the navigation menu.
2. Choose My vault as the destination for personal data. You can select a folder to help identify the imported batch.
3. Select the format matching the manager or browser that produced the file.
4. Choose the export file, then select Import data. If the supported file is password-protected, supply that export password when prompted.
5. Read the result and inspect your vault before repeating the operation.

These web instructions follow Bitwarden’s current import guide. In the browser extension, the documented route is Settings > Vault options > Import items. Interfaces differ; do not assume every app uses the web vault’s Tools menu.

Import Directly From a Desktop Browser

A direct import avoids leaving a manually exported password file behind. Bitwarden supports this in its desktop app for selected Chromium browsers, with platform-specific availability. It is available in the Windows and macOS downloads from Bitwarden and the Linux AppImage, but not desktop builds downloaded from app stores.

1. Open the Bitwarden desktop app and choose File > Import data.
2. Select your vault and the correct browser format.
3. Choose Import directly from browser if offered.
4. Select the browser profile containing your passwords, then import and complete the requested device authentication.

Chrome, Opera and Brave are listed; Edge and Vivaldi are limited to Windows and macOS, and Arc to macOS. If your combination is unsupported, use the documented file-export route instead. Do not disable security software to force a transfer. On a managed computer, ask your administrator about a blocked import.

Mobile Transfers: Check the Direction and App Pair

For a direct transfer into Bitwarden, its current mobile import instructions specify iOS 26+ or Android 14+ and a compatible source app. These are Bitwarden import requirements, not a universal minimum for every password-manager transfer.

• iPhone: start the export in the compatible source app, select the items and choose Bitwarden as the destination.
• Android: in Bitwarden, use Settings > Vault > Import items > Import from another app, then choose the source and authorise the transfer.

Bitwarden currently says importing Dashlane data through this direct Android route is unsupported. If your app pair is unavailable, use an accepted file format.

Check What Your Format Actually Includes

Do not assume a successful password import has moved every kind of item. Bitwarden’s custom-file documentation distinguishes its CSV and JSON structures. A basic CSV is useful for logins and secure notes, while other item types require appropriate support.

For a hand-maintained spreadsheet, use the documented Bitwarden format and UTF-8 encoding. Work locally and check that the editor has not changed leading zeros, punctuation or other credential characters. Keep the original vault intact while diagnosing a problem.

Passkeys are not carried in an ordinary password CSV. However, it would also be wrong to say that JSON can never contain passkeys: Bitwarden’s own JSON exports can include stored passkeys. Successful transfer to another product depends on what the destination can import, not only what the source can export.

If the source is 1Password, its export documentation explains that CSV includes fewer item types and fields than its richer 1PUX format. Select a format that Bitwarden actually accepts. Check attachments and sharing permissions separately rather than assuming they accompany the login.

Choose the Destination Before Converting Data

A folder helps organise personal items; it is not the same as a shared collection with access permissions. Before creating a file, write down the source account, the destination account and server, and whether the items should remain private or become organisation-owned. Keep passwords and recovery secrets out of that planning note. If you are moving work credentials, confirm the authorised destination with your administrator.

Use a dedicated destination folder where appropriate so a batch is easier to identify. Bitwarden says source folders can be nested inside a folder selected during import. A changed folder layout is therefore not automatically lost data. Check the intended vault and folder filters before deciding that a record is missing. Importing to a collection also requires the relevant permission; choosing a shared location is an access decision as well as an organisational one.

For a custom file, Bitwarden documents different individual and organisation layouts. Field names are case-sensitive. Keep the documented header spelling, save as UTF-8, and avoid letting a spreadsheet convert a password, username or code into a number or date. A file that looks tidy can still have altered values. Work on a protected local copy and compare suspicious fields with the original manager rather than guessing the intended credential.

A verification-code seed is a secret capable of generating future codes; it is not the same as the six-digit code currently displayed by an authenticator. Do not fill an import field with whichever code happens to be visible. Transfer only through a supported method and confirm the resulting code with the account’s normal sign-in process while another recovery route remains available. If the source cannot export a required secret, plan that account’s supported MFA change separately.

Separate a Rejected File From an Uncertain Result

Bitwarden’s import guide says a rejected import for documented file or field limits adds no data. Correct that reported problem before trying again. A closed window, interrupted connection or missing success message is a different situation: first inspect the destination and the batch so you do not repeat an operation that already succeeded.

Result	Next step	Avoid
Explicit rejection with a format or limit error	Read the exact error and correct a protected copy of the source file.	Repeatedly importing the same unchanged file.
No clear completion result	Inspect the intended destination and identify whether the batch arrived.	Assuming that no message means nothing happened.
Items arrived but some details differ	Compare the affected fields and required item types with the source.	Purging the entire vault to remove uncertainty.

If the file must be split, give the batches distinct local names and track which ones have been imported. Separate the record of a completed batch from the secret file itself. Check the first batch before continuing, and correct only the affected records or remaining batch where possible. Do not apply destructive cleanup to an existing vault that contains unrelated or newly created items.

If a login still fails, distinguish a wrong imported value from an account that needs a separate verification step or password change. Compare the correct source entry, account name and website. Do not keep trying an uncertain value on a financial or workplace service. Use its documented recovery process when needed, then update the saved item only after the change succeeds.

Verify the Import Before Cleaning Up

1. Compare totals by item type. A matching overall count is helpful, but does not prove that fields mapped correctly.
2. Inspect important entries for the right username, website and password. Check records with notes or unusual characters.
3. Test sign-in to essential accounts using the new vault, while keeping a working recovery route.
4. Check any transferred passkeys and verification codes separately. Test shared access with the authorised people who need it.
5. Confirm the vault is available on your other devices and set up autofill there.

Choose a few low-risk accounts for the first sign-in checks, then check your important services. Avoid repeated guesses against banking or work systems that may lock an account. If a record is wrong, compare it with the source rather than immediately resetting everything.

Fix Errors Without Purging Your Vault

If an import is explicitly rejected, record its error and check the source format and the relevant importer’s instructions. If completion is uncertain, inspect the destination first. For a field or size problem, fix only the affected data and preserve any information removed from an import in the original vault. Do not post the export or passwords in a support forum.

Bitwarden imports add records rather than automatically merging duplicates. Before retrying, establish whether the previous attempt added anything. Identify the imported batch and review duplicate entries carefully; purging the entire vault is not a routine troubleshooting step.

Remove Temporary Files and Finish the Move

After verifying the import, delete unencrypted export files and remove their copies from Trash or Recycle Bin. Check whether downloads, backups or sync tools made additional copies. Deletion is not a guarantee of forensic erasure, so avoiding unnecessary plaintext files is preferable.

Keep the old manager intact until all required items and recovery methods work. For the wider migration, use our guide to switching password managers. Our password-manager safety guide covers ongoing account and device protection.

Moving between Bitwarden accounts or server regions

An encrypted file is not automatically portable. Bitwarden distinguishes account-restricted exports, which depend on the originating account’s encryption key, from password-protected exports. An account-restricted file cannot be restored to a different account, including the same email address on another region or self-hosted server. Deleting and recreating the account does not preserve that ability. Key rotation can also invalidate an older restricted export. Check the encrypted-export requirements before starting a region or account move.

Treat destination choice as a separate check from file compatibility. Confirm the account email, server and intended personal vault before importing. A successful upload to the wrong account is still a migration error. Keep a short private record of the source, destination and batch date without placing actual passwords in the record. If a household shares a computer, close unrelated vault sessions so the intended account is clear.

Check attachments, old passkeys and missing items

Bitwarden’s export guide now lists a ZIP option containing JSON and attachments for individual-vault data. It does not mean every importer or organisation workflow accepts that package. The guide also warns that exported passkeys created before version 2024.3.1 may have counter-related limitations as long-term backups. Check actual sign-in and a separate recovery route rather than treating the existence of an export as proof that every credential is usable.

Create a transfer checklist by item type before pressing Import: ordinary logins, secure notes, cards, attachments, passkeys and any verification-code secrets you depend on. Mark each type as transferred, checked separately or still outstanding. A total of 200 records at both ends does not reveal whether one missing attachment was replaced by a duplicate login. Inspect representative complex items as well as simple username-and-password entries.

For a partial import, stop and compare the result with the source while both remain available. Distinguish a genuinely missing record from a different folder, search filter or ownership location. Keep the displayed error message, but remove any secret values before contacting support. If a format needs local correction, work on a protected copy and preserve the original; do not upload credentials to a public converter.

For acceptance, try an ordinary low-risk login, an entry with additional fields and each essential credential type. Then check access from the other device you actually intend to use. A record appearing in the web vault is different from autofill being configured correctly on a phone. Keep a working session and recovery route while investigating a mismatch, and avoid repeated guesses against services that can lock you out.

Finish the import only when access works

Retain the old manager until the required items and recovery routes have passed your checks. Then clear temporary exports and their unintended synced copies, and decide when to stop saving new credentials into the old manager. Moving records does not strengthen reused passwords; change those on the actual services as a separate, controlled task.

Frequently Asked Questions

Sources and Image Credits

Sources: Bitwarden import methods and errors; supported formats; Chromium browser imports; custom-file formats; export contents and limitations; encrypted export scope; 1Password export formats.

Illustrations: Impulsec.

Share this article

WhatsAppLinkedInRedditFacebookX