Roughly 60% of people reuse the same password across multiple accounts, according to a 2019 Google/Harris Poll online security survey. That habit turns a single breach into a cascade of compromised logins. It also explains why so many people eventually decide to leave Chrome’s built-in password manager behind and move their credentials somewhere with stronger encryption, better sharing controls, or cross-browser support.
Exporting passwords from Chrome is a five-minute job. Doing it without leaking your entire digital life is the part most guides skip. This article walks through the exact steps, the risks nobody mentions in the dialog box, and what actually works when the export button refuses to cooperate. (Manage passwords in Chrome)
What Chrome’s Export Actually Produces
Before touching any menu, it helps to understand what you’re about to create. Chrome’s password manager can save logins, generate passwords, and run a password checkup. When you choose to export, it writes every saved credential into a CSV file — a plain-text spreadsheet format with columns typically labeled `name`, `url`, `username`, `password`, and `note`.
That file is not encrypted. No main password protects it, nothing scrambles it, and no lock blocks it. Open it in any text editor and every password appears in readable characters. Google’s own export dialog warns about this explicitly, but the warning is one line of small text that is easy to click past.
This is the single most important fact about the whole process: the moment the CSV exists, your passwords are only as safe as the folder they’re sitting in. A downloaded file lands in your Downloads folder, gets indexed by desktop search, may sync to cloud backup, and can be opened by anyone who uses your computer.
Step-by-Step: Exporting Passwords From Chrome on Desktop
The export option lives on desktop Chrome only. Here’s the current path.
- Open Chrome and type `chrome://password-manager/passwords` into the address bar, then press Enter. Older versions used `chrome://settings/passwords`, which still redirects.
- Confirm you’re signed in to the Google account whose passwords you want, or that you’re viewing the local (on-device) list.
- Look for the settings gear or the three-dot menu in the upper right of the password manager page.
- Select Download file (some versions label it Export passwords).
- Chrome will ask you to verify your identity — your operating system password, Windows Hello, Touch ID, or similar. This step exists so a stranger at a laptop that is already signed in cannot drain your vault.
- Choose a save location and confirm. Chrome creates `Chrome Passwords.csv` or a dated variant.
That’s it. The file is now on your disk.
A Practical Tip on the Save Location
Don’t accept the default Downloads folder. Save the CSV to a location you’ll remember and can wipe in one action — a temporary folder on an encrypted drive is ideal. If your machine has full-disk encryption enabled (FileVault on macOS, BitLocker on Windows), the file at rest is at least protected if the laptop is stolen. Without disk encryption, a stolen laptop means a stolen password vault.
Why You Might Need to Export in the First Place
People export for a handful of reasons, and they’re all legitimate.
Switching password managers. Moving to a dedicated manager like Bitwarden, 1Password, or Proton Pass is the most common trigger. All of them accept CSV imports, which makes Chrome’s export the de facto bridge between ecosystems. If you’re weighing options, this comparison of 1Password vs Proton Pass covers the encryption models and pricing differences that matter before you commit.
Consolidating across browsers. Someone who lives in Chrome on desktop but Safari on iPhone often wants one unified vault. Understanding how the two browsers handle credentials differently helps — see this breakdown of Safari vs Chrome on iPhone before assuming your logins will follow you automatically.
Backup before a reset. A fresh OS install or a new laptop is a classic export moment. Better to have a CSV you delete afterward than to discover a decade of accounts locked behind forgotten passwords.
Auditing your own security. Seeing every saved login in one spreadsheet makes duplicate and weak passwords obvious in a way the password manager UI never quite does.
The Part Everyone Gets Wrong: Handling the CSV
Here’s where practical experience beats theory. The export is easy; the cleanup is where people slip.
Delete the file the moment the import finishes. Not “later.” Not “after lunch.” Immediately. A plaintext password file sitting on a desktop for three days is a genuine liability, and it’s the most common mistake people make during a migration.
Never email it to yourself. Email is stored on servers you don’t control, often indefinitely, and attachments get scanned, cached, and backed up. Sending your password vault through Gmail to move it between devices is actively dangerous.
Don’t drop it in a shared cloud folder. A synced Dropbox or Google Drive folder with sharing enabled can expose the file to collaborators without any warning.
Check the file opened correctly. Import the CSV into your new manager, then spot-check five or six random accounts by logging in. CSV parsing occasionally mangles passwords containing commas, quotes, or leading spaces. Catching that before you delete the original saves a painful password-reset marathon.
Empty the trash. Deleting a file doesn’t remove it from the Recycle Bin or Trash. Empty it.
For broader context on how credential storage is evolving, this look at passkeys vs passwords vs 2FA in 2026 explains why some logins may not need a password at all going forward — which affects what’s worth migrating.
Importing the CSV Into Another Manager
The receiving side is usually straightforward. Most password managers have an Import option that accepts a generic CSV and asks you to map columns. Chrome’s headers (`name,url,username,password,note`) are widely recognized, so the mapping is often automatic.
A few practical notes:
- Import into a fresh, empty vault if possible. Merging into an existing vault can create duplicates that are tedious to clean up.
- Some managers require you to confirm the file’s origin before parsing, a small safeguard against importing junk.
- After import, run the new manager’s security audit. It will flag reused and breached passwords instantly — often the real reason people switch.
If you’re moving to a browser-based alternative rather than a standalone app, note that Chrome’s CSV also imports cleanly into Firefox and Edge, both of which accept login data files through their settings pages.
When the Export Button Isn’t There
Sometimes the option simply doesn’t appear. The causes are predictable.
| Situation | Why export is missing | What to do |
|---|---|---|
| Chrome on Android or iOS | Mobile Chrome has no CSV export | Export from desktop Chrome signed into the same account |
| Work or school managed device | Enterprise policy can disable the password manager entirely | Ask IT; policy-level blocks can’t be bypassed locally |
| Signed into a managed Google Workspace account | Some admin configurations restrict export | Check with your administrator |
| Very old Chrome version | Feature predates the installed build | Update Chrome |
| Profile using only on-device storage | Export path differs slightly by version | Check both the profile menu and the password manager page |
On mobile, the workaround is genuinely just “use a computer.” Sign into Chrome on a desktop with the same Google account, let sync finish, and the passwords will be there to export. If sync hasn’t run, force it from the sync settings first.
For managed devices, there’s no clever trick. If an administrator has disabled password export, that’s a deliberate security control, and circumventing it is both difficult and a bad idea professionally.
A Word on Chrome’s Password Manager Itself
Chrome’s manager is convenient and free, and it has improved considerably — it now warns about breached credentials and offers a password generator. But it has structural limits worth knowing before you decide to stay.
The vault is tied to your Google account, which means your passwords are protected by the same credential as your email. If that account is compromised, everything behind it is exposed. Dedicated managers typically require a separate password that Google never sees, adding a genuine layer of separation. That’s the core argument for migrating, and it’s a strong one.
There’s also the browser-lock problem. Chrome passwords don’t natively flow into Safari or Firefox without an export. If you’re the kind of person who switches browsers, or who keeps a work browser and a personal one, a standalone manager removes that friction permanently. The same reasoning applies when you’re deciding which extensions to trust with your data — this guide to the best productivity Chrome extensions is a useful reminder that convenience features and security features are not the same thing. (Google Chrome)
Common Mistakes Worth Avoiding
A short list, drawn from the patterns that trip people up most often:
- Exporting on a shared or public computer. The CSV lands on a machine you don’t control. Don’t.
- Leaving the file in Downloads for weeks. Set a reminder if you must. Better: delete it the same session.
- Importing without verifying. Always test a few logins before wiping the source.
- Assuming the export includes everything. Passphrases stored in a separate authenticator app, recovery codes, and security answers are not in the CSV. Back those up separately.
- Forgetting to revoke the old vault. After migrating, consider whether you want Chrome to keep saving new passwords. Turning off the built-in manager prevents future split-brain confusion where some logins live in one place and some in another.
Conclusion
Exporting passwords from Chrome takes about five minutes and produces a file that is, by design, completely unprotected. The steps are simple — open the password manager, choose download, verify your identity, save — but the responsibility doesn’t end when the file appears. Treat the CSV as radioactive: move it, import it, verify it, delete it, and empty the trash, all in one sitting.
The bigger decision is whether to export at all. Chrome’s manager is fine for casual use, but anyone who reuses passwords, juggles multiple browsers, or wants their vault protected by something other than their email login has good reason to migrate. Done carefully, the export is a clean bridge to a stronger setup. Done carelessly, it’s the weakest link in your entire digital life. The difference is entirely in the handling.
Frequently Asked Questions
Does exporting passwords from Chrome delete them from Chrome?
No. Exporting is a read-only operation. Every saved login stays in Chrome’s password manager after the CSV is created. If you want to remove them, you have to delete entries individually or turn off password saving and clear the list manually.
Is the exported CSV file encrypted?
No. Chrome writes a plain, unencrypted CSV. Anyone who opens the file in a spreadsheet app or text editor can read every username and password in clear text. There is no password prompt to open it. This is why the file should be deleted as soon as the import is complete.
Can I export passwords from Chrome on my phone?
Not directly. Mobile Chrome on Android and iOS doesn’t offer a CSV export option. The standard workaround is to sign into Chrome on a desktop with the same Google account, let sync complete, and export from there.
Why is the export option greyed out or missing?
The most common cause is a managed device or a work/school Google account where an administrator has disabled the password manager through enterprise policy. Other causes include an outdated Chrome version or being on mobile. Policy-based blocks can’t be bypassed locally — contact your IT administrator.
What happens if the CSV import mangles some passwords?
Special characters like commas, quotation marks, and leading or trailing spaces can break CSV parsing. Always spot-check several logins after importing, and keep the original CSV until you’ve confirmed the migration worked. If entries are corrupted, re-export and try importing into an empty vault.
Is it safe to switch from Chrome to a dedicated password manager?
Generally yes, and for many people it’s a security upgrade. Dedicated managers typically encrypt your vault with a password that the vendor never sees, separating your passwords from your email account. The migration itself is the risky part — handle the CSV carefully and the switch is straightforward.
