Move password managers in stages: secure the new vault, export locally, import and verify, migrate high-value accounts, then securely remove temporary files. Keep the old vault available until the new system works on every required device.
How this guide was made: The security baseline follows current NIST and CISA consumer guidance. Product-specific buttons change, so use each provider’s current export and import documentation.
Why use a manager?
NIST recommends password managers for accounts that still require passwords because they can generate and store long, unique credentials. NIST also recommends a password of at least 15 characters when you must create one yourself. CISA likewise advises strong passwords, a password manager and MFA.
The master credential protects many accounts, so give it extra care. Choose a long, unique master password you have not used elsewhere, and enable a strong MFA method supported by the service.
Before export
- Update both password-manager apps from official sources.
- Confirm you can sign in to the old vault and its recovery email.
- Create the new account using a unique master password.
- Enable MFA and save recovery codes in a secure, separate place.
- Install the new app/extension only from official stores or vendor links.
- Read the precise import/export instructions and supported fields.
- Make a backup plan for attachments, passkeys, secure notes and shared vaults; these may not transfer through a basic CSV.
Treat the export as highly sensitive
Many export formats are unencrypted plain text. Anyone who obtains the file may read its contents. Export on a trusted, updated device; avoid shared computers and cloud-synced download folders. Do not email the export or leave it in trash/recycle bins.
If the old and new services support a direct encrypted transfer, evaluate their documentation. Otherwise, minimize how long the temporary file exists.
Import and verify before changing anything
Import into the new vault and compare counts by category. Spot-check at least:
- primary email;
- financial and shopping accounts;
- social accounts;
- Wi-Fi/router administration;
- cloud storage and backup;
- recovery codes and secure notes;
- shared items and attachments.
Check username, password, URL and notes. Duplicate entries are less dangerous than a missing credential during the transition; deduplicate after validation.
Migrate high-value accounts first
Start with email because it often controls password resets. Then move cloud storage, financial services, domain/hosting accounts and social profiles. For each:
- Sign in using the new manager.
- Replace reused or weak credentials with a unique generated password.
- Enable MFA or a passkey where supported.
- Refresh recovery methods and save new recovery codes.
- Sign out and sign back in before moving on.
Do not change every credential in one uninterrupted session if losing focus would create mistakes. Use a checklist and stop at a known point.
Verify every device
Test the new vault on the primary computer, phone and any required tablet or secondary browser. Confirm autofill only activates on the correct domain. Review logged-in devices and revoke sessions you no longer recognize or use.
Retire the old system safely
After a defined observation period:
- verify no missing attachments or shared items;
- delete the unencrypted export using the operating system’s normal secure-storage practices;
- empty relevant trash/recycle areas and check cloud sync;
- disable old browser extensions;
- cancel billing if appropriate;
- request old-account deletion only when you are certain recovery is complete.
Storage deletion behavior varies, especially on solid-state drives and synced systems. The safest control is to avoid creating unnecessary plaintext exports and keep the device encrypted.
Ongoing routine
Review breach alerts, inactive accounts, emergency access, recovery methods and vault exports quarterly. Never store the sole recovery key inside the vault it unlocks. Include password-vault recovery materials in the 3-2-1 backup plan without exposing them to the same account failure.
Protect cloud accounts selected with the cloud-storage guide and store router credentials from the Wi-Fi placement guide in the vault.
Check what the export format actually carries
A filename extension is not proof of encryption or complete transfer. 1Password’s export instructions warn that exports are unencrypted and that its CSV option carries a limited set of fields. Bitwarden’s export documentation distinguishes plaintext, encrypted and attachment-inclusive formats; an account-restricted encrypted export is not a general migration file for another account.
Before exporting, make a transfer inventory: logins, notes, attachments, shared items, passkeys and recovery material. For each, record whether the chosen source format includes it and whether the destination supports importing it. A matching total item count cannot prove every attachment or field arrived.
Fictional acceptance example: a test vault contains two harmless logins, a note and a dummy attachment. The destination shows three items, but the attachment is absent. The migration is incomplete even though both login tests pass. This is a designed check, not a test we ran on either vendor. Keep the old vault until all required material and recovery paths have been verified. Never use a public spreadsheet or an AI prompt to compare real exported passwords.
Sources
- NIST: How Do I Create a Good Password?
- CISA Secure Our World
- Current export/import documentation from both password-manager providers
