A password manager only protects you if you actually use it. That is why many people switch: the vault that felt fine two years ago now feels clunky, too expensive, or tied to a company they no longer trust. The problem is that a vault holds more than a list of logins. It holds years of accumulated data, and one clumsy export can turn a sensible upgrade into hours of cleanup.
The good news is that switching is a solved problem. Every major password manager can export its data, and nearly every one can import it. The bad news is that “export and import” hides a dozen small traps: plaintext files, duplicate entries, orphaned folders, broken two-factor codes, and shared vaults that never make the trip. This guide walks through the whole process in the order that actually works, with the mistakes people make most often flagged along the way.
Why People Switch, and Why It Is Riskier Than It Looks
Switching is common enough that vendors have built entire migration paths around it. The December 2022 LastPass breach pushed a large wave of users toward competitors, and price changes or feature removals regularly do the same. But a password vault is one of the few files where a mistake can do more than inconvenience you: it can become a security incident.
The core risk is the export file itself. Most managers export to CSV, and a CSV export is almost always unencrypted plaintext. Every username, password, and note sits in a file that any program on your computer can read. Some managers offer encrypted formats such as JSON or a proprietary archive, but CSV remains the universal fallback because every competitor can read it.
That single fact shapes the entire process. A migration is a short window in which your secrets exist outside any vault, and the goal is to make that window as small and as private as possible.
Before You Touch Anything: Prepare the Ground
Do not start with Export. Start by reviewing what you have.
Inventory your vault
Open your current manager and count what is actually in there. Most vaults contain more than logins:
- Passwords and usernames
- Secure notes (recovery codes, Wi-Fi passwords, software licenses)
- Identity records (addresses, passport numbers, card details)
- TOTP seeds for two-factor authentication
- Attachments such as scans and PDFs
- Shared or family vaults with other people’s items
Write this inventory down. It becomes your checklist later, because the single most common failure is importing passwords, declaring victory, and discovering three weeks later that the secure notes never came across. (Use Strong Passwords)
Check what your new manager can actually import
Before committing, confirm that the destination supports the format your current manager produces. Most vendors publish import instructions covering LastPass, 1Password, Dashlane, KeePass, and generic CSV. Read those pages first. If a specific data type, like attachments or TOTP seeds, is not supported, you want to know that before the export, not after.
Pick a low-stakes moment
Do the migration on a calm evening, not five minutes before you need to log into a work system. You will be locked out of nothing if you follow the steps below, but you will be juggling two vaults for a while, and that is much easier when you are not in a hurry.
The Export Step: Keep the Window Small
The export is where discipline matters most.
- Create the export from your current manager’s settings. Choose an encrypted format if one is offered.
- Move the file immediately to a location you control, ideally an encrypted drive or a folder you will delete afterward.
- Do not email it to yourself. Email is the worst possible transport for a plaintext vault dump.
- Do not leave it in your Downloads folder for a week while you “get around to it.”
- Note the timestamp. If you add a password to the old vault after exporting, it will not be in the file.
If you must use CSV, treat the file as radioactive until it is deleted. That means no cloud sync folders, no shared drives, and no backup software that quietly uploads everything.
The Import Step: Expect Friction
Importing is usually a single menu action, and it usually works. What follows is the cleanup, and this is where most of the real work lives.
Duplicates
If you have ever imported the same file twice, or if your old vault contained near-duplicate entries, you will get duplicates. Most managers have a built-in duplicate finder or a “find duplicates” report. Use it, but review before deleting: two entries with the same URL are not always the same account.
Folders, tags, and structure
CSV has no concept of folders. Flat exports lose your organizational structure, so expect to rebuild folders or tags by hand. Some managers map folders to a “folder” column if the CSV includes one, but this varies. Budget time for reorganization if your vault was carefully sorted.
TOTP seeds
Two-factor codes stored inside the vault are the most fragile data type. Some managers export them, some do not, and some export them in a format the destination cannot read. If your 2FA codes live in your vault, test one login end to end after migration before you delete anything.
Secure notes and attachments
Notes often import as a single blob of text, losing formatting. Attachments frequently do not export at all. Check your inventory list against what actually arrived.
A Practical Comparison of Migration Paths
| Approach | Data preserved | Security during transfer | Effort |
|---|---|---|---|
| CSV export and import | Passwords, usernames, URLs, basic notes | Weak: plaintext file | Low |
| Encrypted JSON or archive | Most fields, sometimes attachments | Strong if handled carefully | Low to medium |
| Manual re-entry | Everything, exactly as you choose | Strongest: nothing leaves the vault | High |
| Vendor migration assistant | Varies by pair of vendors | Usually strong | Low |
Manual re-entry sounds absurd until you have a small vault. For someone with forty logins, retyping them over a weekend is genuinely safer than a plaintext CSV sitting on a desktop. For someone with eight hundred, it is not realistic.
What Actually Works in Practice
A few habits separate a clean migration from a messy one.
Keep the old vault alive for at least two weeks. Do not delete the source account on day one. Use the new manager as your daily driver, but leave the old one intact as a fallback. If something did not import, you still have the original.
Change the passwords that matter most. A migration is a natural moment to rotate credentials for email, banking, and anything with financial access. It costs little and closes the window in which an old export could be exploited.
Delete the export file properly. Deleting it from the file manager is not always enough on modern drives. If the file touched a cloud folder, delete it from the cloud trash too.
Verify a sample, not the whole vault. Pick five logins you use daily and confirm each one works, including the 2FA step. If those five are fine, the rest usually are.
Do not migrate on a shared computer. Obvious, and still done constantly.
If you are still deciding which manager to move to, it helps to compare options on security rather than price alone. A look at the best password managers for security is a reasonable starting point, and if budget is the constraint, the best free password managers for personal use covers the realistic free tier options. The guide to choosing a secure password manager walks through the criteria that actually matter during a switch, such as export formats and whether the vendor supports encrypted backups. (Password manager)
Common Mistakes That Cost People Data
The failures are predictable, which means they are avoidable.
- Exporting only once, early. Additions made after the export are lost. Do a final export right before you commit.
- Assuming shared vaults come along. Family or team vaults are often excluded from personal exports. Those items need to be re-shared manually.
- Ignoring the trash. Deleted items in the old vault may not export. If you deleted something by accident months ago, recover it before migrating.
- Trusting the import summary. A message saying “412 items imported” does not mean 412 items are usable. Spot-check.
- Leaving browser-stored passwords out of the plan. Many people have a second, invisible vault in Chrome or Safari. Decide whether those move too.
- Forgetting recovery codes. If your new manager generates a recovery kit, store it somewhere that is not the new manager.
Security Standards Worth Knowing
Password handling is one of the few areas with genuinely authoritative public guidance. The NIST Digital Identity Guidelines (SP 800-63B) set out how credentials should be handled, including guidance on password length and complexity that has shaped how modern managers generate passwords. It is worth a skim if you want to understand why your new manager behaves the way it does.
Similarly, CISA, the U.S. cybersecurity agency, publishes practical guidance encouraging password manager use and offering advice on securing accounts. Both are useful references when you are evaluating whether a vendor’s approach is sound, rather than just convenient.
After the Switch: Locking It Down
Once the new vault is live, spend twenty minutes on hygiene. Turn on the strongest two-factor option the manager offers, preferably an authenticator app or hardware key rather than SMS. Review which devices are signed in and remove old ones. Set a reminder to review your vault in a few months, because migrations tend to surface stale accounts you had forgotten about, and that is a good excuse to close them.
Then delete the old account. Not immediately, but within a few weeks. An abandoned vault is a liability: it holds your data, it may still be tied to an old email address, and you are no longer watching it.
Conclusion
Switching password managers is not difficult, but it is unforgiving of shortcuts. The process that works is unglamorous: inventory the vault, read the destination’s import documentation, export to an encrypted format if possible, import promptly, verify a sample of logins, and keep the old vault alive until you are confident. The traps are equally unglamorous: plaintext CSVs left in Downloads, secure notes that never arrive, TOTP seeds that break silently, and shared vaults that do not travel.
Treat the export file as the sensitive document it is, give yourself an evening rather than ten minutes, and the migration will be boring. Boring is exactly what you want when the data in question is every key to your digital life.
Frequently Asked Questions
Is it safe to switch password managers?
Yes, if the export file is handled carefully. The main risk is the plaintext CSV that most exports produce. Keep it on an encrypted drive, import it promptly, and delete it thoroughly afterward. The migration itself is a routine operation that millions of people have completed without incident.
Will I lose my secure notes and attachments?
Possibly. Notes often import as plain text with formatting stripped, and attachments are frequently excluded from exports entirely. Check the destination’s import documentation before you start, and compare your inventory against what actually arrives.
Do two-factor authentication codes transfer between managers?
Sometimes, but this is the least reliable data type in any migration. Some managers export TOTP seeds, some do not, and formats vary. Test one 2FA-protected login end to end before deleting your old vault.
How long should I keep my old password manager?
At least two weeks, and ideally a month. Use the new manager daily during that period but leave the old account active as a fallback. Once you have confirmed that your important logins work, close the old account properly rather than abandoning it.
What if my vault has hundreds of passwords?
Use the import tools rather than manual re-entry, but plan for cleanup time. Duplicates, lost folder structure, and missing notes are the usual issues. A duplicate finder built into the new manager will handle most of the mess, though you should review before deleting anything.
Can I switch back if I do not like the new manager?
Yes, as long as you keep the old vault until you are sure. This is the strongest argument for a slow migration: run both managers in parallel for a few weeks. If the new one disappoints, you still have the original intact and can simply stop using the new one.
