To switch password managers safely, prepare the new account, transfer supported data, test access and only then retire the old vault. Prefer a supported direct transfer when available. If you need a file export, protect it carefully and check which items it actually includes.
A move can involve more than passwords. Passkeys, verification-code secrets, attachments and shared access need separate checks. Keep the old manager intact until you know that everything you rely on works in the new one.
1. Prepare the New Account and Recovery Route
Install the new manager from its official source and confirm that it supports your devices and browsers. Set up its account protection and recovery options before adding your whole vault. If you are moving work credentials, follow your organisation’s approved process.
- Choose a strong, unique account password where required and enable supported MFA.
- Store recovery information somewhere accessible without unlocking the new vault.
- Confirm you can sign in on the devices you intend to use.
- Decide which vaults belong to you and which are shared or organisation-owned.
Different providers use different recovery mechanisms. For instance, 1Password’s Secret Key has a different role from a two-factor recovery code. Do not assume that a backup email or one saved code can recover everything.
2. Make an Inventory Before Moving Anything
Record approximate counts by type, without copying secret values into an ordinary checklist. Include logins, notes, payment details, identities, documents, passkeys and stored verification codes. Note who uses shared items and which services are essential.
Also check archived items and any data stored in a separate authenticator app. A password-manager export will not automatically collect secrets from unrelated apps. Keep a short list of items you must verify individually, such as email recovery and business administration accounts.
3. Choose a Transfer Method Both Apps Support
Use the documentation for your exact source, destination and operating system. “Supports credential exchange” does not mean every pair works in both directions.
Direct Transfers on Android
Google’s September 2026 Android announcement describes transferring passwords and passkeys without creating an export file. Start the import in the destination app, select an available source and authorise the selected items.
Google lists Google Password Manager, 1Password, Bitwarden and Dashlane as participating providers, but app-specific limits still apply. For example, Bitwarden’s current import guide requires Android 14+ for its direct import and says Dashlane-to-Bitwarden importing through that Android route is unsupported. Check the direction you need before relying on it.
Direct Transfers on iPhone
Compatible apps can use credential exchange on iOS 26 or later. 1Password’s export documentation covers this option, including passkeys. On iPhone, you generally start in the source app’s export flow and choose a supported destination. Update both apps and check what the confirmation screen includes.
File Export and Import
When direct transfer is unavailable, choose the richest export format your destination explicitly supports. CSV is widely used for passwords, but it may leave out other records or fields. For example, 1Password documents narrower coverage in CSV than in its 1PUX export.
Not every export is encrypted. CSV, plaintext JSON and unencrypted archive formats can expose secrets to anyone who can read the file. Some managers offer encrypted exports, but a proprietary backup is not necessarily importable elsewhere. Bitwarden’s export documentation distinguishes plaintext, encrypted and attachment-containing options.
- Export only on a trusted, updated device.
- Save the file to a private local folder that is not automatically synced or shared.
- Import it promptly using the destination’s matching source format.
- Do not email the file or send it to an online converter, support chat or AI tool.
- After checking the import, delete the temporary export and remove accessible copies from Trash or Recycle Bin.
If you discover that a plaintext export was publicly shared or accessed by someone else, treat the included secrets as compromised and prioritise replacing them. Accidental storage in your private cloud account is not proof that an attacker read it, but you should remove unnecessary copies and assess who could access them.
4. Check the Items That Commonly Need Extra Work
- Passkeys: use a supported transfer or format. Where migration is unavailable, add a new passkey through the service’s account settings while your old sign-in still works.
- Verification codes: determine whether the secret that generates time-based codes moved. Some formats include it; others do not. Test before removing the old method.
- Attachments and notes: open a sample of each type and compare fields. A login record can arrive without its attached document.
- Shared access: check permissions and ownership. Copying an item into your private vault does not automatically recreate family or team sharing.
Do not assume that every JSON file transfers passkeys. Bitwarden’s own JSON export can contain them, but another manager may not understand the format. A file extension is not an interoperability guarantee. If you are replacing a phone, use our passkey recovery guide to check the original storage provider and preserve a working sign-in route.
If a code-generating secret did not transfer, follow that service’s supported process for changing authenticators. Keep a recovery method available; do not disable your only working second factor simply to tidy up the old app.
5. Test Sign-In, Autofill and Recovery Access
- Compare item totals and inspect the username, website and password fields in several records.
- Test a few low-risk accounts first, then essential services such as email and the accounts used for recovery.
- Check transferred passkeys and verification codes separately.
- Confirm that authorised family members or colleagues can reach their shared items.
- Set the new manager as your autofill provider on each device and confirm it works.
Use a fresh sign-in on a trusted device while retaining an existing working session. This tests more than opening a record in the vault. Avoid repeatedly attempting a failing password against an account with lockout controls.
If you are moving into Bitwarden, our Bitwarden import guide covers the exact routes and duplicate-import pitfalls.
6. Retire the Old Manager After Verification
Keep the old vault protected and available during the transition. Avoid saving new passwords into both managers, which can leave you unsure which copy is current. Turn off the old autofill or save prompts once the new setup works, without immediately deleting the old data.
Only close the old account when you have confirmed all required data, shared access, passkeys and recovery routes. Check subscription cancellation separately from account deletion. Uninstalling an app does not necessarily cancel billing or remove a cloud account.
There is no universal number of days to wait. Completion depends on verification, not the calendar. For ongoing protection after the move, see how to use a password manager more safely.
Frequently Asked Questions
Do I need to recreate every passkey?
Not always. Supported direct transfers and some formats can move passkeys. If your exact app pair cannot, add a new passkey at each service while the old sign-in remains available.
Should I delete my old account after the import says complete?
No. First verify important logins, item types, shared access, passkeys and recovery. An import confirmation does not establish that everything you need transferred correctly.
Will my verification codes transfer?
It depends on the source, format and destination. Some transfers include time-based-code secrets and others do not. Test the new codes or use the service’s supported authenticator-change process before removing the old method.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.