Switching password managers used to mean exporting a file and importing it, which worked because a password entry is just text. It is more involved now, because a modern vault holds things a text export cannot represent — passkeys bound to cryptographic material, two-factor seeds, file attachments, and shared items with permission structures.
The migration is still routine. It just needs doing in an order that leaves you a way back if something does not arrive.
What changed in 2026
- Passkey portability standardized. Direct transfer between credential managers became supported, replacing the earlier situation where passkeys effectively could not move.
- Export formats stayed inconsistent. Standard export remained plaintext CSV or JSON with vendor-specific structures, which is why direct transfer is preferable where available.
- Passkey adoption raised the stakes. With more accounts secured by passkeys rather than passwords, a migration that drops them is a migration that locks you out.
- Family and team vault structures got more complex. Shared items with granular permissions transferred poorly through file-based export.
What migrates and what does not
| Item |
Via file export |
Via direct transfer |
| Passwords and usernames |
Yes |
Yes |
| Notes and custom fields |
Usually, sometimes mangled |
Yes |
| Two-factor seeds |
Sometimes; format varies |
Usually |
| Passkeys |
No |
Yes, where supported |
| File attachments |
Rarely |
Sometimes |
| Shared vault permissions |
No |
Sometimes |
| Password history |
No |
Rarely |
| Folder structure |
Usually |
Yes |
If both your source and destination support direct transfer, use it. File export is the fallback, and it silently drops the items that matter most.
The safe order
Audit before moving. A migration is a natural moment to delete accounts you no longer use rather than carrying dead entries to a new home. Run whatever breach-check feature the old tool offers first, so you fix reused and compromised passwords before the move rather than after.
Export or transfer. If exporting to a file, do it on a machine you control, not a shared or work computer. The file is plaintext — every credential you own, readable by anything on that system.
Import and verify. Check counts match. Then spot-check across categories: a banking login, an entry with a two-factor code, one with an attachment, one from a shared vault. Confirm a passkey actually authenticates by signing in with it.
Destroy the export. Securely delete the file, and empty the trash. Check whether your operating system or backup software copied it somewhere — a plaintext credential dump sitting in a cloud-synced downloads folder is a serious exposure.
Keep the old vault for a few weeks. Do not cancel or delete until you have used the new one for a full cycle and hit the accounts you access rarely. Quarterly logins are exactly the ones you discover are missing months later.
Then close the old account. Verify it is actually deleted rather than just logged out, and revoke any browser extensions or connected apps.
If you are also moving to passkeys as part of this, do that as a separate exercise afterwards rather than simultaneously — the sequencing is in passkey migration guide.
Common mistakes
- Deleting the old vault immediately. The most common cause of lockout.
- Leaving the export file around. Plaintext credentials in a synced folder.
- Assuming passkeys transferred. Verify by authenticating, not by seeing an entry.
- Exporting on a work machine. You may not control what is logged or backed up there.
- Not verifying rarely-used accounts. Those are the ones you find broken later.
- Skipping the breach audit. Best time to fix reused passwords is during a migration.
FAQ
Is the export file really that risky?
Yes. It is every credential you own in readable text. Handle it as you would handle writing all your passwords on paper, and destroy it as deliberately.
Can I transfer passkeys between any two managers?
Support has landed broadly and rollout timing varies. Confirm both ends support it before relying on it, and verify by authenticating afterwards.
What about two-factor codes?
Seeds sometimes export and sometimes do not, and the format varies. Where they do not transfer, re-enrol two-factor on the affected accounts deliberately rather than assuming it moved.
Should I use the browser's built-in manager instead?
They have improved considerably, including passkey support. Dedicated managers still lead on sharing, cross-browser use, and organizational features.
Where to go next
For moving beyond passwords entirely, read passkey migration guide. For the surrounding network, home network security audit, and for account access after death, digital estate planning.