What if the biggest risk in switching password managers isn’t the new app at all, but the mistakes made along the way? People leave 1Password for plenty of good reasons: price hikes, a preference for open source, or a move to a platform that bundles a manager for free. But the switch itself is where things go wrong. A rushed migration can leave passwords stranded, two-factor codes lost, and family members locked out of shared accounts.
This guide walks through the most common mistakes people make when choosing and moving to a 1Password alternative. It also covers what actually works in practice, based on how these tools behave when you export, import, and re-share vaults. If you are weighing options, related comparisons like 1password vs proton pass and 1password vs keeper are useful background, but the migration details below matter more than any feature chart.
Mistake One: Choosing an Alternative Before Checking the Export Path
The single most expensive mistake is picking a new manager based on reviews, then discovering the export is messier than expected. Every major vendor documents its export formats, and those documents are the only reliable source. Security guidance from CISA is clear that password managers are worth using, but it does not cover what happens when you leave one.
Before committing, check three things on the vendor’s own help pages:
- What export formats the current tool produces (CSV, JSON, or a proprietary archive).
- Which of those formats the destination accepts.
- Whether the destination maps custom fields, notes, and attachments, or drops them silently.
Most people skip step three. That is where data quietly disappears.
CSV Is Not a Universal Language
A CSV export looks like a clean spreadsheet, which creates false confidence. In practice, each vendor uses slightly different column headers and treats multi-line notes differently. A note with line breaks can split across rows and corrupt the import. Custom fields often collapse into a single blob or vanish entirely. The practical fix is to open the CSV in a spreadsheet before importing and check that the row count matches the number of items you expect. If you had 340 items and the file has 290 rows, something was already lost.
Mistake Two: Leaving a Plaintext CSV Sitting on Disk
Every major vendor warns that CSV exports are unencrypted plaintext. This is the mistake with the worst downside, because a CSV on your desktop is a complete, readable list of every password you own. Common slip-ups include:
- Exporting to a synced folder like Desktop or Documents that backs up to cloud storage.
- Emailing the file to yourself as a “backup.”
- Leaving it in the Downloads folder for weeks after the import “worked.”
- Deleting the file normally instead of shredding it, leaving recoverable copies.
What works in practice: export to a local, non-synced folder, import immediately, verify the import, then delete the file and empty the trash. Do the whole sequence in one sitting. If you need a fallback copy during the transition, put it in an encrypted archive with a strong passphrase, not a zip file with no password.
Mistake Three: Assuming Everything Transfers
Feature parity is where expectations and reality diverge most. People assume that because both tools have a feature, the data behind it moves across. It usually does not. The table below shows what typically survives a migration and what usually needs manual work.
| Data type | Usually transfers | Usually needs manual re-entry |
|---|---|---|
| Login username and password | Yes | — |
| Website URLs | Yes, sometimes with duplicates | Merging duplicate entries |
| Notes | Partially, formatting often lost | Line breaks and rich text |
| Custom fields | Inconsistent | Often yes |
| TOTP seeds (2FA codes) | Rarely | Yes, re-scan QR codes |
| File attachments | Rarely | Yes, re-upload |
| Shared vault permissions | No | Yes, re-invite and re-share |
| Passkeys | No | Yes, re-register per site |
The TOTP row catches the most people. If your second-factor codes live inside 1Password, moving them means logging into each site and re-enrolling the authenticator. That is not a five-minute job if you have forty accounts. Plan for it, and keep the old manager active until every code is re-enrolled, or you risk locking yourself out of accounts that require the code to disable the old factor.
Mistake Four: Cancelling the Old Subscription Too Early
The temptation is to cancel the day the new manager is set up. That is backwards. The old subscription is your rollback plan. A sensible order of operations:
- Export from the old manager and import into the new one.
- Spot-check twenty logins across different sites, including at least one banking and one email account.
- Re-enroll TOTP codes and re-upload attachments.
- Re-share vaults with family or teammates and confirm they can open them.
- Run both tools in parallel for a week or two.
- Only then cancel the old plan.
People who cancel early often find a missing item weeks later with no source to recover it from. The cost of one extra billing cycle is trivial compared with rebuilding access to an account.
Mistake Five: Forgetting the People in Shared Vaults
Family and team plans add a coordination problem that solo users never hit. Shared vaults do not migrate. The new manager has no idea who had access to what, so every share has to be rebuilt from scratch. Common failures include inviting people to the wrong vault, sharing an item individually when it should be in a shared folder, and assuming the other person accepted the invitation when they never did.
What actually works: make a list of every shared item and who needs it before you touch anything. Then invite people, confirm acceptance, and test with one item before moving the rest. If you are also comparing costs across family plans, how much does 1password cost breaks down the pricing tiers, which helps when judging whether the alternative is genuinely cheaper once you count the seats you need.
Mistake Six: Trusting Old Comparison Articles
Password manager features change fast. A comparison written eighteen months ago may describe pricing, plan names, or features that no longer exist. Passkey support, for example, has been added across the major tools at different times, and any article predating those updates is misleading on that point. The same applies to breach history: LastPass published incident updates in 2022 describing the scope of its breach, and the exact wording of those statements matters more than any secondhand summary.
The practical rule is simple. Use comparison articles to build a shortlist, then verify every claim that affects your decision on the vendor’s own documentation. Check the last-updated date on help pages before trusting them. For a broader look at how tools in this space evolve, comparisons like proton pass vs 1password are only as good as their publication date.
Check the Date on Every Source
A quick habit that saves trouble: before acting on any feature claim, find the date. Vendor help pages usually show a last-updated stamp. If a page has no date, treat the claim as unverified and test it yourself in a trial account. Trials exist precisely so you can confirm behavior instead of assuming it.
Mistake Seven: Ignoring the Recovery Setup
People spend hours choosing a manager and five minutes on recovery. Then a phone is lost, a laptop dies, and the emergency kit is nowhere. Every manager has some form of recovery mechanism, whether it is a recovery code, an emergency contact, or a printed kit. The mistake is setting it up and never testing it, or never setting it up at all.
What works in practice: store the recovery kit somewhere separate from the device that runs the manager, such as a locked drawer or a safe. Do not store it in the manager itself, which sounds obvious but happens more than people admit. If the manager supports an emergency contact, test that the contact can actually initiate recovery before you need it. (Password manager)
Mistake Eight: Skipping the Security Hygiene Pass
A migration is the best moment to fix weak passwords, because you are touching every entry anyway. Most people import everything unchanged and carry old problems into the new tool. Two habits pay off here:
- Change reused passwords during the import. Start with email, banking, and anything tied to money.
- Turn on two-factor authentication everywhere it is offered, ideally with an authenticator app or a hardware key rather than SMS.
The National Institute of Standards and Technology’s digital identity guidelines, NIST SP 800-63B, are the reference point many vendors follow on authentication and password handling. They are worth a skim if you want to understand why some practices are recommended and others are not. (NIST Cybersecurity Framework)
Mistake Nine: Overlooking the Browser and Mobile Experience
A manager can look great in a review and feel wrong in daily use. The friction shows up in small places: autofill that misfires on login forms, a mobile app that requires too many taps, or a browser extension that conflicts with another extension. People discover this after cancelling the old tool.
The fix is to test the new manager for a full week on the devices you actually use, before you commit. Log into ten sites from your phone, ten from your laptop, and try at least one site with a multi-step login. If autofill fails on your bank, you want to know that while the old manager is still active.
Mistake Ten: Assuming Free Means Sufficient
Free tiers are genuinely capable, but they usually limit one or more of the things that matter: device sync, sharing, attachment storage, or two-factor code generation. The mistake is choosing on price alone and discovering the limit later. Read the plan comparison on the vendor’s pricing page and map each limit to your actual usage. A household with four devices and two shared vaults has different needs from a single user with one laptop.
What a Smooth Migration Actually Looks Like
Pulling the mistakes together, a clean switch follows a predictable shape. Shortlist two or three alternatives based on current documentation, not old reviews. Export to a local folder, import immediately, and verify the item count. Re-enroll two-factor codes and re-upload attachments by hand. Rebuild shared vaults and confirm every person has access. Run both tools in parallel for a week, then cancel. Set up recovery and test it. Do a password hygiene pass while everything is in front of you.
None of these steps is difficult. The failure mode is always the same: speed. People treat a password manager migration like changing an app, when it is closer to moving house. You can do it fast, but you will leave things behind.
Conclusion
Switching away from 1Password is a reasonable decision, and the alternatives on the market are strong. The risk sits almost entirely in the transition, not the destination. The people who come out clean are the ones who check export formats before committing, treat the plaintext CSV as radioactive, assume nothing transfers automatically, and keep the old subscription alive until the new setup is proven. Everything else is detail. Take the migration slowly, verify as you go, and the switch becomes a routine chore instead of a security incident.
Frequently Asked Questions
What is the biggest mistake when switching from 1Password?
Cancelling the old subscription before the new manager is fully verified. The old plan is the only reliable rollback if an item fails to import. Keep it active for at least a week after the migration and confirm logins, two-factor codes, and shared vaults all work first.
Do two-factor authentication codes transfer between password managers?
Usually not. TOTP seeds are rarely included in standard exports, so codes stored in 1Password typically have to be re-enrolled by scanning the QR code at each site. Plan time for this, and keep the old manager active until every code is set up in the new one.
Is a CSV export from a password manager safe?
The file itself is fine; how you handle it is the risk. CSV exports are unencrypted plaintext, so export to a local folder that does not sync to the cloud, import right away, then delete the file and empty the trash. Never email it to yourself or leave it in Downloads.
Why do shared vaults break during a migration?
Shared vaults are tied to the old manager’s account structure, so nothing carries over. Every share has to be rebuilt by inviting each person again and confirming they accepted. Make a list of shared items and who needs access before starting, then test with one item first.
How long should I run both password managers at once?
One to two weeks is a practical window. It is long enough to catch missing items during normal use, including logins you only touch occasionally, and short enough that keeping two managers in sync does not become a chore. Cancel only after a full week with no surprises.
Are free password manager tiers enough to replace 1Password?
Sometimes, but check the limits first. Free tiers often cap device sync, sharing, attachment storage, or two-factor code generation. Map each limit to how you actually use the tool, especially if you share vaults with family or need codes stored alongside logins.
