How to Move Your Password Vault to a New Manager Without Losing Accounts
Switching password managers usually goes wrong in the same order: export, import, cancel, then discover that the VPN login, a shared team vault, and two-factor codes did not come with you.
The order of operations
- Read the destination's import documentation before exporting anything.
- Take a full export from the old manager and keep it offline.
- Set up the new account and its own two-factor authentication first.
- Import, then reconcile counts and spot-check items by category.
- Re-enrol two-factor codes site by site, old authenticator still running.
- Rebuild shared vaults, collections, and family or team access.
- Switch browsers and devices over one at a time.
- Only then cancel the old plan — and delete every plaintext export.
What a migration can carry, and what it quietly drops
Exports cover only the item records your chosen format supports.
| Item type | Typically migrates | What to check first |
|---|---|---|
| Login URL, username, password | Yes, in every format | Custom fields and notes may be dropped |
| Secure notes | Often, as a note field | Formatting rarely survives CSV |
| Cards, identities, custom fields | Partly | CSV columns cover different fields per product |
| File attachments | Frequently not | Assume you move these by hand |
| TOTP / built-in authenticator codes | Do not assume | Plan to re-enrol each protected site |
| Shared vaults and collections | No — memberships are server-side | Re-invite from the new account |
| Organisation or team data | Separate from personal export | Bitwarden states a personal export excludes organisation-owned data |
| Emergency access and sharing rules | No | Recreate deliberately; the item people forget |
| Passkeys | No | Create fresh in the new provider — see our passkeys guide |
CSV carries logins well and structure poorly; JSON carries more per product but is often only readable by the same vendor. Bitwarden's help pages on exporting vault data and importing data list the formats each side accepts; KeePassXC documents its import and export paths in the official KeePassXC documentation.
Step 1: snapshot before you touch anything
Export from the old manager while you still have full access, and take two copies if the product allows: the most expressive format available, plus CSV as a fallback any tool can read. Store both outside a cloud-synced folder.
Also keep a copy you can read without any software — a printable report, or the CSV opened in a spreadsheet. That copy is how you find a lost recovery phrase when the import goes badly.
The plaintext window is the actual risk
A CSV export holds every password in the clear, in a file most operating systems will sync to the cloud, back up, and leave in the Trash. Two rules: never let it travel through email, a chat app, or a shared drive — copy it to the destination machine over local storage or a drive you control; and delete it properly once the import is verified, from the Desktop, the Trash or Recycle Bin, and any backup snapshot that captured it.
Prefer a password-protected or encrypted export if the product offers one, but still treat the file as sensitive — some encrypted formats are bound to the originating account and cannot be imported anywhere else, so take both.
Step 2: build the new account before importing
Create the new account, install its apps, and turn on its own two-factor authentication and recovery options before any vault data lands. Confirm the master password is one you can type on a phone keyboard without a hint — most managers cannot reset it through the usual "forgot it" flow.
Step 3: import, then reconcile rather than trust
Do not settle for a green success message: compare the new vault's item count against the old one, then check for these failure modes:
- Fewer items than expected. Rows the importer could not parse — often custom fields, unusual dates, or multi-line notes.
- More items than expected. Duplicates from an import you re-ran "just in case".
- Folder and tag structure gone. Expected with CSV; rebuild the organising layer once.
- URLs missing the scheme. Autofill stops matching silently when a saved URL is
example.com/loginversushttps://example.com/login. - Blank passwords. A field-mapping problem, not a lost credential — re-import the affected items individually.
Step 4: verify by category, not by scrolling
Open the categories that hurt to lose, and test one of each with a real sign-in:
- Email — including whether second-factor codes still work.
- Banking or a payment card on a site you use weekly.
- Your old password manager's own login — you need it until the end.
- A VPN, a server SSH key note, or any infrastructure credential.
- A rarely-used portal: council tax, dentist, an old employer's benefits site.
- Anything shared — a family account, a team log-in, a split subscription.
If a login fails, work out whether the credential or the autofill is wrong before re-typing: paste the saved value into the password field with the show-password toggle to see what the vault holds.
Step 5: two-factor, shared access, and the cutover
Re-enrol authentication codes properly
For each site with TOTP, start the reset from inside your new manager: sign in, add the new code, confirm it generates a matching number, and only then delete the old entry. Never remove the last working authenticator to "test" the new one.
Rebuild sharing, because it is server-side
Shared vaults, collections, family plans, and emergency-access contacts do not live in the export file. Recreate them on the new service: invite members, re-share folders, re-add an emergency contact, and confirm the plan covers the same number of users. If you admin an organisation vault, that is a separate project with its own export path.
Move devices one at a time
Sign out of the old extension or app, sign in with the new one, and test autofill on that device before moving to the next. Two managers autofilling the same browser is how half-edited credentials end up in a vault you later cancel.
Rollback, cleanup, and the mistakes worth avoiding
If verification goes badly, rollback is straightforward while the old account still exists: re-enable the old app, sign in, and put the test machine back as it was.
Cancel the old plan only after a final export from the new vault, delete every copy of the plaintext file, revoke old browser sessions and unused devices from the new account's session list, and remove the old app from any shared family computer where someone might still type a password.
- Exporting from the old manager before reading what the new one can import.
- Cancelling the same day, then discovering a login that needs the old account.
- Assuming attachments, note formatting, and TOTP seeds came along.
- Reusing the master password you had on the old service.
- Emailing the CSV to yourself "so I have a copy on both machines".
- Never testing emergency access or a recovery kit on the new account.
FAQ
Will my two-factor authenticator codes move with the vault?
Do not count on it. Plain CSV usually carries only login fields, and even a richer export is not guaranteed to produce working codes in a different product. Re-enrol each protected site, keeping the old authenticator live until the new one matches.
How long should I keep the old account active?
Two to four weeks of everyday use plus one deliberate check of awkward items — shared logins, a monthly VPN, rarely-visited portals. Cancel only after those work, and export from the new manager before the old plan lapses.
Is a password-protected export safe to email or upload?
Treat any export as sensitive. Protected exports are only as strong as the password on them and the channel you send them through, and some encrypted formats cannot be opened by any other account. Copy locally, delete everywhere afterwards.
Does moving vaults move my passkeys too?
Usually not. Passkeys are held per provider and per device, so plan to create them again in the new place, and keep a fallback sign-in method working before you remove anything.
Related on ToolStep: 1Password vs Bitwarden and Bitwarden vs LastPass cover each product's import and export paths in practice; LastPass alternatives and KeePassXC alternatives address common starting points; our ranking of the best password managers and the 2026 shortlist explain which are easiest to leave.