Password manager migration is the process of moving your saved logins, notes and other vault contents from one password manager to another, or from one storage location to a different one.
Done carelessly, a move can leave accounts locked out, leave copies of sensitive data in unexpected places, or leave old vaults still accessible. Done carefully, it is a manageable task that a patient person can complete in an afternoon.
Why Your Vault Might Need to Move in the First Place
Most people change password managers for ordinary reasons. A service may raise its price, shut down, or stop supporting the platform you use. You might switch from a phone to a computer as your main device, or move from a shared family setup to an individual one.
Sometimes the reason is trust: a company changes its privacy policy, or you decide you want a different approach to where your encrypted data is stored.
Whatever the reason, it helps to name it before you start. A migration done to escape a service that is failing has different priorities than one done because you want a better tool for a family.
Knowing your goal tells you how fast to move, how much to verify, and whether you should keep the old vault around for a while.
A password manager is a tool that stores your login credentials in an encrypted container, called a vault, and fills them in for you. Because the vault holds the keys to much of your digital life, moving it is more sensitive than moving a photo library. Treat the migration as a security project, not a simple copy-and-paste job.
Before You Touch Anything: Inventory and Preparation
Start by taking stock of what your current vault contains. Count the logins, note any secure notes, payment cards, identity entries, file attachments and shared folders.
Check which accounts rely on two-factor codes, because those codes may be tied to an authenticator app rather than the password manager itself. Make a short list of the accounts you consider most important, such as email, banking and government services.
Next, confirm that you can actually log in to both the old and the new service. Check that you remember the master password for the old vault, and that recovery options such as recovery codes or a second device are available.
Make sure the new service is set up with its own strong master password and any multifactor protection it offers.
Choose a quiet period for the move. Avoid doing it during a busy work week or while traveling on unfamiliar networks. Close unnecessary browser windows and make sure your devices are updated, since operating system and browser updates reduce the risk of malware interfering with the process.
Exporting Your Data Safely
Most password managers offer an export function, but the options and file formats differ. The following points help you export carefully and reduce the chance of leaving sensitive material exposed:
- Confirm the export format the new service accepts, such as a standard comma-separated or structured file, and check its import guidance first.
- Export from a trusted, up-to-date device and avoid shared or public computers entirely.
- Store the exported file in an encrypted container or on a secure local drive rather than an email attachment or cloud folder.
- Delete the exported file as soon as the import is verified, and empty your device trash so the copy does not linger.
- Keep the original vault intact until you have confirmed that everything has arrived correctly in the new location.
An export file is essentially an unencrypted list of your secrets in readable form. That is why it deserves the same care as a physical document containing your passwords. Plan to remove it securely once you no longer need it, and avoid leaving copies in downloads folders, messaging apps or synced cloud storage that you forget about.
Importing and Verifying Your Data
Importing is where many migrations go wrong. Some fields may map incorrectly, notes may be truncated, or custom fields may be dropped entirely.
Before you consider the move finished, open a sample of entries in the new vault and compare them against the old one. Pay close attention to usernames, web addresses, and any notes you rely on for account recovery.
Verification also means testing that the passwords actually work. Log in to a few low-risk accounts using credentials pulled from the new vault. Do this carefully and in a way that does not disrupt anything important. If an account forces a password change, follow the site’s normal process and record the new password in the new vault immediately.
Keep a written checklist of which entries you have verified. Many people find it useful to work through their list in order of importance, starting with email, since email is often the recovery route for every other account.
Handling Different Kinds of Entries
Not every item in a vault is a simple username and password. Some entries need special handling during a move, and treating them the same way as ordinary logins is a common source of lost information.
Passwords and Login Entries
Standard logins are usually the easiest part of a migration. They typically carry over with a username, a password, a web address and sometimes a note.
Check that the web addresses still match the sites you visit, since a mismatched address can cause autofill to fail or, in rare cases, offer credentials to the wrong place. Pay attention to entries that use multiple domains, such as a single account that signs in through several web addresses.
After importing, scan for duplicates. Migrations sometimes create two entries for the same account, one from each source. Keep the more accurate one and delete the other, but only after confirming which password is current. Stale duplicates can cause confusion later when a password changes.
Secure Notes and Attachments
Secure notes often hold recovery codes, account numbers, or instructions your future self will depend on. These entries are sometimes the first thing lost in a transfer, so check them individually. Formatting such as line breaks and lists may not survive, which can make a note hard to read even if the text is present.
Attachments raise additional concerns. Not every service supports moving files, and some formats are not carried across. If an attachment is important, such as a scanned identity document or a set of backup codes, consider storing a separately encrypted copy as well, and confirm it can be opened before you rely on it.
Payment Cards and Identity Entries
Payment card and identity fields are often structured differently between services. A card number, expiry date and security code may import into the wrong fields, or some fields may be left blank. Check each entry against the physical card or your records, and never assume the import is accurate.
Keep in mind that card data is highly sensitive. Limit how many copies exist during the migration, and remove any exported files that contain it as soon as possible. If your card issuer offers its own secure wallet or tokenization features, you may prefer to use those for card details rather than moving raw numbers between managers.
Keeping Accounts Secure During the Transition
During a migration, you are briefly working with two sets of credentials at once. That period is when mistakes are most likely to happen, so it deserves extra attention. Make sure both vaults are protected by strong, unique master passwords, and that neither one is accessible from a device you do not control.
Be alert to phishing during this time. Scammers sometimes send messages pretending to be a password manager, claiming that your vault needs urgent action or that a new import link must be followed.
Real services will not ask you to enter your master password through a link in an unsolicited email. When in doubt, go to the service directly by typing its address yourself.
Consider whether any accounts should have their passwords rotated after the move. If you suspect an old vault was ever exposed, or if you shared it with someone who no longer needs access, changing the most important passwords is a sensible step. Do this one account at a time so you do not lose access to anything.
Retiring the Old Vault Responsibly
Once you have verified the new vault, do not rush to delete the old one. Keep it available for a short overlap period, such as a few weeks, so you can check for anything that did not transfer.
Make a note of when you intend to close it, and set a reminder so the old copy does not sit around indefinitely.
When you are ready to close the old service, check its account deletion process. Some services delete data immediately, while others keep it for a period. Confirm what happens to your vault, backups and any shared access before you proceed. If you shared folders with family members or colleagues, remove those shares or transfer them before closing the account.
Consider whether any other devices or apps still hold a copy of the old vault, such as browser extensions, mobile apps, or desktop clients. Uninstall or sign out of those so that a stale copy does not keep syncing or auto-filling from an outdated source.
Practical Migration Checklist
Use this checklist to keep the move organized from start to finish. Work through each step in order and tick it off only after you have confirmed it:
- Note your reason for migrating and confirm both master passwords and recovery options.
- Back up critical recovery codes and two-factor setup information before you begin.
- Export your vault in the required format and store the file securely.
- Import into the new service and check a sample of entries, including notes and cards.
- Test login on several important accounts, starting with your primary email.
After the checklist is complete, delete the exported file securely, keep the old vault for a short overlap period, and then close it.
Record the date of the migration somewhere you will find it, so you can refer back if a problem appears later. A written note of what you moved and when is often the fastest way to resolve questions months afterward.
Planning Ahead So the Next Move Is Easier
The best time to prepare for a future migration is now, while your current setup is working. Choose a password manager that supports standard export formats, so you are not locked into one vendor.
Ask whether the service offers a clear way to download your full vault, including notes and attachments, and whether that download is available to you at any time rather than only when you cancel.
Keep your recovery materials current. Store recovery codes, account numbers and emergency contact information in a safe place that is not dependent on the password manager itself. A trusted printed copy kept securely at home is one option many people use. Review these records once a year and update them whenever you change a phone, email address or two-factor method.
Build a habit of periodic checks. Review your vault for old accounts you no longer use, remove them, and confirm your important logins still work. A vault that is tidy and well documented makes any future migration faster, safer and far less stressful.