To move team passwords safely, prepare the self-hosted organization and its access model first, export data in a format the destination can import, then validate records, permissions, and attachments before switching the team over. Bitwarden’s cloud-to-self-hosted instructions provide a concrete example, but export formats, license requirements, and import behavior vary by product. This guide focuses on team-managed passwords and other vault items—not a full migration of infrastructure secrets such as application credentials or deployment keys.
What to inventory before migrating
Make a record of what the team actually uses before exporting anything. Separate organization-owned records from items stored in individual users’ vaults: organization exports may not include personal items, and export access follows each user’s permissions. Bitwarden’s Teams and Enterprise Migration Guide and Migrate to a New Server describe these considerations for Bitwarden migrations.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- Organization vaults, collections, shared folders, nested shared items, and any custom organization layout.
- Individual vault items that users intend to move, with an owner assigned to each export.
- Passwords, usernames, secure notes, documents, custom fields, and TOTP secrets.
- File attachments and key files, including SSH or RSA keys, with the vault item each belongs to.
- Groups, collection assignments, user invitations, SSO, and organization policies that control access.
Remove individually owned items from any export intended for organizational import. Keep a mapping of records and attachments to their owners or destination collections so you can check placement and access later.
Prepare the self-hosted destination and access model
Deploy and configure the destination before importing production data. For the Bitwarden example, its server migration instructions cover configuring the target server and domain, and call for an SMTP connection where needed. The Teams and Enterprise migration guide says to create the organization before importing directly into it rather than importing first into an individual vault.
#1 Best Overall
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Bitwarden’s documented organization migration also has product-specific account and license requirements: the self-hosted account uses the email associated with the cloud license, and a self-hosted organization is unlocked with a license key generated through a Bitwarden cloud organization. These are not universal self-hosting requirements. Confirm the current requirements for your chosen product, edition, version, and organization features in the vendor’s instructions before scheduling the move.
Decide how users will regain access at the destination. Record the current group-to-collection assignments, invitations, SSO configuration, and policies; these may need to be recreated rather than transferred by an item import.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Offline Local Storage for Privacy:This Password Keeper stores all your login credentials directly on the device, with no cloud or internet connection, helping reduce exposure to hacking and data breaches.
- Full Control of Your Sensitive Data:Unlike cloud-based managers, this physical device keeps your passwords entirely under your control. Your information never leaves the device, and you won’t share it with third-party servers.
- Built-in Device Password Protection:Add an extra layer of security with optional device password protection, helping prevent unauthorized access to your stored records if the device is misplaced.
- Compact Hardware Vault for Credentials:A secure alternative to handwritten notes or spreadsheets, this portable device lets you store unique, complex passwords for all your accounts in one place.
- Simple USB Type-C Access:Connect via the included USB Type-C cable to your laptop, phone, or standard 5V charger to view and navigate your passwords on the built-in screen, no internet required.
Choose an export the destination can import
Do not assume an export is portable just because it contains the vault data. In Bitwarden’s cross-account example, an account-restricted encrypted JSON export cannot be imported into a different account, including a self-hosted account. Bitwarden documents password-protected encrypted JSON as the option that can be imported into another Bitwarden account using the password chosen for the export. Store that password separately and securely. See Bitwarden’s export documentation.
| Bitwarden export type | Cross-account import to self-hosted Bitwarden | Important handling point |
|---|---|---|
| Account-restricted encrypted JSON | Not importable to a different account, including a self-hosted account, according to Bitwarden’s export guidance. | Do not select it for this cross-account move. |
| Password-protected encrypted JSON | Bitwarden documents this as importable to another Bitwarden account with the chosen export password. | Keep the password separate from the export file. |
| Plain JSON or CSV | Import compatibility depends on the destination and format; do not treat either as universally portable. | These files expose stored passwords to anyone who can open them. Vaultwarden advises against leaving unencrypted exports in Downloads or synced cloud storage. |
Format support can also depend on the source product and its version. For example, Bitwarden’s 1Password import guide documents workflows for 1PIF and older-version CSV exports, and says that 1Password 8 desktop PUX exports are not supported by that guide. Check the current source and destination instructions before exporting the team’s full vault.
Rank #3
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Import in a controlled window and validate the result
- Confirm the destination organization is ready. Verify the target account, organization, collections, and planned access model before using a production export.
- Import organization data into the organization. For Bitwarden, the Teams and Enterprise guide recommends importing directly into the organization. If individual vaults are in scope, coordinate separate exports with their users.
- Check for prior imports. Bitwarden says its import cannot detect whether imported items duplicate items already in the vault. A clean destination or a deliberate deduplication plan helps avoid confusing duplicate records.
- Validate representative records. Check usernames and passwords, custom fields, TOTP secrets, notes, collection placement, and whether the intended users can access each item. Include a sample from each important item type and sharing pattern.
- Record mismatches and resolve them. Import tools do not guarantee that every field maps exactly. Vaultwarden’s password-import guidance cautions that TOTP secrets and custom fields may not survive a generic CSV import. Treat those fields as explicit checks, not assumed successes.
Bitwarden’s migration guide states: “Import to Bitwarden can’t check whether items in the file to import are duplicative of items in your vault.” This is why a successful import message is not, by itself, evidence that the destination is clean or complete.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recreate permissions and transfer attachments
Moving records does not necessarily move the access system around them. Bitwarden’s self-hosted organization migration directions call for re-implementing applicable enterprise policies or SSO, manually recreating groups and assigning them to collections, and inviting users again. Verify the destination’s current product-specific steps rather than assuming these settings are embedded in the data export.
Attachments are separate migration work: Bitwarden says they are not included in import operations and must be uploaded manually. Use the inventory to attach each file to the corresponding destination item, then confirm that representative users can open it.
Cut over only after access checks, then remove exports
Keep the SaaS vault available until administrators and representative team members can reach the destination and critical records have been checked. In particular, confirm that users can sign in, access the collections they need, use key credentials and TOTP entries, and open required attachments. This is an operational safeguard, not a universal vendor-defined acceptance checklist.
After validating the destination, remove temporary exports and empty the source or destination trash as appropriate. Plaintext JSON and CSV files contain readable credentials; Vaultwarden’s export and backup guidance warns against leaving unencrypted exports in Downloads or synced cloud storage. If you retain an encrypted export as a backup, protect it and its password appropriately; removable storage is optional and does not make a plaintext export safe.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to evaluate a self-hosted destination
Compare the actual migration and operating requirements rather than choosing on the basis of “self-hosted” alone. The Bitwarden migration materials identify practical work areas, but they do not provide a neutral comparison of all self-hosted password managers.
Quick Recap
- Import support: Does the destination accept the source’s current export format, and which fields are preserved?
- Sharing model: Can the destination represent your organization’s collections, groups, nested sharing, and ownership?
- Attachments: Are files included in imports, or must you transfer and relink them manually?
- Provisioning and policy: Which user invitations, SSO settings, and policies need to be rebuilt?
- Hosting responsibility: Who will maintain the server, backups, updates, recovery process, and access to the service?
- Edition and licensing: Does the self-hosted edition support the team and organization features you need, and what account or license setup is required?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
