Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The safest password-manager migration is a controlled, two-vault process: configure the new manager and its multi-factor authentication first, export the old vault in an encrypted format when possible, import it locally, and verify important records before deleting anything. If the old service offers only a plaintext CSV or JSON file, keep that file on one trusted device, pause backup synchronization, never email or upload it, and erase it as soon as the import succeeds. Keep the old vault available until counts, sign-ins, autofill, passkeys, one-time-password data, shared access, notes, and attachments have all been checked.
What is the safest order for moving to a new password manager?
Move in this order: inventory, prepare the destination, create the least-exposed export available, import, validate, then clean up. The sequence matters because an export can contain the credentials for your entire digital life, while an import can silently omit fields that a simple item count will not reveal.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory before exporting. List every vault or collection, shared folder, emergency-access arrangement, passkey, one-time-password seed, secure note, identity, payment card, attachment, custom field, and browser-saved credential. Mark what should move, what should be deleted, and what needs a separate transfer.
- Prepare the destination. Install the new manager on a trusted, fully updated device. Create a long, unique master passphrase and enable multi-factor authentication (MFA) before importing anything. NIST recommends long passphrases, unique passwords, and MFA where available; its guidance says, “Password managers offer greater security and convenience for the use of passwords to access online services.” NIST guidance
- Export using the strongest format offered. Prefer an encrypted JSON export, a PGP-encrypted ZIP, or another vendor-supported protected format. Encrypted files reduce exposure while in transit or storage, but they do not guarantee that every item type will be supported by the destination.
- Import through the documented workflow. Use the destination’s current import screen, not a generic file opener. Source, destination, app version, and file format all affect compatibility.
- Validate before retiring the old vault. Compare counts by vault and category, inspect high-value records, test autofill and real sign-ins, and separately check passkeys, OTP seeds, attachments, shared access, and browser extensions.
- Remove temporary copies and then decommission. Delete plaintext exports, empty the operating system’s trash or recycle bin, check backup and antivirus quarantine locations, revoke old sessions, and remove old extensions only after validation is complete.
Keeping both vaults temporarily is not a security failure; it is a recovery measure. Shutting down the source before testing the destination can turn one missing field or passkey into an account-recovery incident.
How should I choose and harden the destination manager?
Choose a destination that can represent the data you actually use, not merely one that accepts a basic password CSV. Compare encrypted and plaintext export options, import formats and version compatibility, treatment of passkeys and OTPs, attachment and shared-vault support, MFA and account-recovery design, supported operating systems and browsers, synchronization architecture, and how easily you can verify an import.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Set the master passphrase before importing
Use a long passphrase that is unique to this manager and is not reused anywhere else. Do not derive it from an old vault password. Record a recovery method in a place you can access without leaving it beside the computer used for migration.
Enable MFA and plan recovery
Turn on MFA before the first import. A FIDO2 security key is a practical hardware option when the manager supports it, but enroll a second key or another documented recovery method so a lost key does not lock you out. Store recovery codes offline and treat them as highly sensitive credentials.
Update the device and applications
Run current operating-system and manager updates, use a trusted account, and avoid performing the migration on a shared or publicly accessible computer. Install only the official desktop or browser applications required for the transfer.
Check synchronization behavior
If the destination synchronizes automatically, understand when a newly imported vault will be uploaded. For a migration involving plaintext files, complete the file-handling steps below before allowing any temporary export to enter a synchronized folder.
Which export format exposes the least information?
An encrypted, vendor-supported export is preferable because the file is not immediately readable if copied. Examples include encrypted JSON and PGP-encrypted ZIP archives, but support is product- and version-specific.
| Export type | Exposure if copied | What to verify |
|---|---|---|
| Encrypted JSON | Requires the export password or decryption process | Whether the destination supports that exact schema and version; Bitwarden documents encrypted JSON and local decryption during export (Bitwarden export documentation) |
| PGP-encrypted ZIP | Protected while the archive and key remain secure | That the destination can decrypt and import the archive; Proton Pass recommends a PGP-encrypted ZIP for storage or transfer (Proton Pass export documentation) |
| Plaintext CSV | Anyone who obtains the file can read the included fields | Which columns are present; CSV commonly omits passkeys, OTP seeds, attachments, and other specialized data |
| Unencrypted JSON | Readable by anyone with file access | Whether custom fields, notes, sharing metadata, and item types survived conversion |
Encryption protects the export file, not the accounts represented inside it. Use a strong export password, do not leave decrypted copies behind, and still validate the imported vault.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should I do if the old manager offers only a plaintext CSV or JSON export?
Treat the file as a temporary copy of your entire vault. The UK National Cyber Security Centre warns: “Once exported, by either a legitimate user or an attacker, the passwords are unprotected.” NCSC password-manager buyer’s guide
- Use a private, updated device with full-disk encryption enabled where available.
- Temporarily pause cloud-drive backup, photo/file synchronization, automated desktop backup, and any other service that could copy the export.
- Export directly to a local folder that is not monitored or synchronized. Do not save it to a shared desktop, removable drive used by other people, or a browser-download folder that is automatically backed up.
- Do not email the file, upload it to a website, paste its contents into a chat, or send it through an unencrypted transfer service. 1Password explicitly warns that its exports are plaintext and should not be emailed or stored online (1Password export guidance).
- Import it immediately into the destination manager and avoid opening it in a spreadsheet, which can create additional temporary or autosave copies.
- After confirming the import, delete the file, empty trash or recycle bin, and inspect backup history, synchronized folders, temporary directories, and antivirus quarantine for retained copies.
A short-lived local plaintext file is still a risk, but controlling its location and lifetime prevents many accidental copies. If you suspect that another person or service accessed it, treat all included passwords as exposed and rotate the most sensitive accounts.
How do I export from the old manager without losing special data?
Export only after making an inventory. A standard login export may not include non-login records, and some products intentionally restrict passkey export.
Record categories separately
- Login items and custom fields
- Secure notes and identities
- Payment cards and other financial records
- Attachments and document scans
- Shared vaults, collections, permissions, and emergency-access accounts
- Passkeys and one-time-password seeds
- Credentials saved in browsers rather than in the old manager
Decide whether each category belongs in the new manager. Deleting obsolete records before export reduces the amount of sensitive data in the temporary file, but keep an offline record of any account you intentionally omit so you do not mistake it for a failed import.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Understand field limitations
CSV is often a lowest-common-denominator format. 1Password documents that its CSV export has limited fields and that desktop passkey export is not available (1Password export guidance). An encrypted export may preserve more structure, yet the destination can still ignore unsupported item types. Treat passkeys, OTP seeds, attachments, and shared metadata as separate migration projects rather than assuming they are included.
How do I import the vault into the new manager?
Use the destination’s documented import path and select the exact source format. Do not rename extensions or edit the file to make it appear compatible.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Open the new manager’s desktop or web application on the trusted device.
- Go to its import or data-transfer area and choose the source manager and format, not merely “generic CSV” when a named workflow exists.
- Select the local export file and provide its decryption password if required.
- Review any field-mapping or conflict screen. Confirm how folders, tags, custom fields, attachments, shared collections, and duplicate logins will be handled.
- Start the import and wait for the completion message. Do not close the application or move the file during processing.
- Record the resulting totals by category before making changes.
Compatibility can change between releases. For example, a Bitwarden guide for importing from 1Password states that a 1Password 8 .1pux file is not supported in that workflow (Bitwarden 1Password import documentation). Proton Pass publishes import guides for major managers and browsers (Proton Pass import documentation). Check the current instructions for your exact source and destination versions before exporting.
How can I prove that the import is complete?
No single count proves a migration is complete. Combine quantitative checks with real-world sign-ins and a category-by-category review.
Compare counts by vault and category
Record the number of logins, notes, identities, cards, attachments, shared items, and other categories in the old manager, then compare the destination totals. Investigate every discrepancy instead of accepting a near match. A difference can indicate filtered records, unsupported item types, duplicate handling, or a failed import.
Inspect high-impact records first
- Administrator and billing accounts
- Primary email and recovery addresses
- Banking, tax, and payment services
- Cloud-storage and identity-provider accounts
- Domain, server, and other infrastructure credentials
- Emergency-access and shared-family or team records
Open representative records from every category, including one with custom fields, one with a note, and one with an attachment. Confirm usernames, passwords, URLs, tags, notes, and attachments rather than relying on the title alone.
Test autofill and real sign-ins
Install the new browser extension only after the vault is present, then test autofill on several sites with different login layouts. Sign in and sign out of selected accounts, including at least one account that requires a username separately from a password. Check that the extension offers the intended record and does not fill into an unrelated page.
Verify passkeys and OTP data separately
Passkeys are not ordinary password fields. Confirm that each important passkey appears in the destination and can complete an actual sign-in on a supported device. For one-time-password accounts, compare the seed or generated codes and test a login before removing the old authenticator entry. If a source export did not include these items, use the service’s documented re-enrollment process rather than assuming the CSV contained them.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check shared access and recovery
Have another authorized user confirm that shared items, permissions, collections, and emergency-access arrangements work as intended. Verify that the new manager’s recovery method is usable without relying on the old vault.
When is it safe to delete the export and close the old manager?
Delete the temporary export immediately after the destination passes validation, but keep the old manager accessible until you have completed the sign-in, special-data, and shared-access checks. This balances two risks: leaving a readable export available and losing the only working copy of an omitted item.
- Delete every plaintext CSV or unencrypted JSON copy.
- Empty the operating system trash or recycle bin.
- Search local folders, downloads, temporary directories, synchronized drives, external media, and backup consoles for the export filename or copies.
- Check antivirus quarantine and endpoint-management retention, which can preserve a copy even after normal deletion.
- Revoke active sessions and remove old browser extensions after the new manager is working.
- Uninstall the old application or close the old account only when you no longer need its records for recovery.
- Rotate passwords for the most sensitive accounts if the export was exposed, stored online, or handled by an untrusted device.
Do not confuse deleting the export with deleting the old vault. The file should disappear first; the source account can remain available for a short validation period.
What are the most common migration failures and their fixes?
| Symptom | Likely cause | Practical response |
|---|---|---|
| The import count is lower than the old vault | Unsupported item types, filters, duplicates, or a partial export | Compare category totals, inspect the export format, and transfer omitted categories separately |
| Passwords appear, but notes or custom fields are blank | CSV column limitations or incorrect field mapping | Use the manager’s structured encrypted export if available, then inspect representative records |
| Autofill selects the wrong account | Duplicate URLs, changed login domains, or duplicate records | Correct the destination URL and record matching, then retest on the actual sign-in page |
| A passkey is missing | The source did not export passkeys or the destination cannot import them | Keep the old passkey available and enroll a new passkey through the account’s security settings |
| OTP codes fail after import | The seed was omitted, copied incorrectly, or time synchronization is wrong | Compare the source and destination entries, verify device time, and re-enroll the authenticator if necessary |
| A shared item is visible but unusable | Permissions, collection membership, or emergency-access settings did not transfer | Recreate access in the destination and have an authorized user test it |
| The export reappears after deletion | Cloud backup, endpoint backup, autosave, or quarantine retained a copy | Remove retained copies from each system and review synchronization settings before another export |
How should I compare password managers before committing to a migration?
Use the migration itself as a decision test. A manager that imports basic logins but cannot preserve the records you rely on may create more work and risk than it removes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Decision area | Questions to ask |
|---|---|
| Export protection | Can you create encrypted JSON, PGP-encrypted ZIP, or another protected export, and can you delete or revoke it afterward? |
| Import compatibility | Does the documented workflow support your source manager, file format, and current app version? |
| Special records | How are passkeys, OTP seeds, secure notes, custom fields, identities, cards, attachments, and browser credentials handled? |
| Sharing and recovery | Can shared vaults, permissions, emergency access, recovery codes, and team or family structures be recreated? |
| MFA | Are FIDO2 security keys or other strong MFA methods supported, and is there a practical backup route? |
| Platforms | Are your operating systems, browsers, phones, and required extensions supported? |
| Synchronization | When does data leave the local device, and can you control synchronization during a sensitive import? |
| Verification | Can you view category counts, identify import errors, and test autofill and sign-in behavior easily? |
Perform a small, noncritical trial import if the product permits it. A trial can reveal unsupported fields before you expose the entire vault, but delete trial exports and duplicate test records when finished.
What should I document for a personal or family migration?
Write a short transfer record while both managers are available. Note the export format and date, destination version, categories intentionally omitted, accounts that require passkey or OTP re-enrollment, and who has tested shared access. Do not put passwords or export contents in that record.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
For family or team vaults, tell authorized users when the switch occurs, where the new emergency-access instructions are stored, and which sign-ins they must test. Keep recovery information separate from the vault so a locked account does not make every credential unavailable.
Can an encrypted export still lose data?
Yes. Encryption protects confidentiality, not feature compatibility. A destination may decrypt the file successfully while ignoring an unsupported item type, attachment, custom field, passkey, or sharing rule. That is why category counts and representative record checks are required even when the export never existed in plaintext.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteShould browser-saved passwords be migrated separately?
Yes. Include browser stores in your inventory instead of assuming the old manager contains them. Export or transfer them only through the browser’s documented local workflow, import them into the destination, compare the resulting accounts with your inventory, and then remove the browser copy after testing.
What if I discover a missing account after deleting the old vault?
Use the service’s account-recovery process and any recovery codes or secondary administrator access you documented. If the missing credential was part of an exposed export, change it rather than trying to recover the old value. Keeping a validated recovery path and a record of intentionally omitted accounts prevents an accidental omission from becoming permanent lockout.
Frequently Asked Questions
Can I migrate only selected passwords instead of my whole vault?
Yes, when the source manager supports selecting vaults, folders, or records during export. Make a written list of excluded accounts and verify that the destination count matches the selected scope; otherwise an intentional omission can look like a failed transfer.
Do passkeys move automatically with a password export?
Usually not. Passkeys use device-bound or platform credentials rather than ordinary password fields, and some desktop applications do not offer passkey export. Check each important account in the new manager and be prepared to enroll a replacement passkey through that account’s security settings.
Recommended Free Tools
Is a password-protected ZIP safe to keep forever?
No. Encryption lowers the chance of accidental disclosure, but the archive remains a concentrated copy of your credentials. Keep it only for the transfer or a deliberately managed offline recovery procedure, then remove it and any duplicate copies when validation is complete.
What should I do before giving away the computer used for migration?
Confirm that the export, deleted-file remnants, synchronization caches, backup snapshots, and browser downloads are gone, then sign out of both managers and perform a secure device reset. If the export was ever exposed on that computer, rotate the highest-value credentials first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
