Free tools Windows power users keep installed
One-click scans. No signup required.
Set up the new password manager first, secure its account, export your existing passwords from the old browser or vault, import the file, and verify several important logins before deleting anything. Most migrations use a CSV file that contains passwords in readable form, so keep it private and remove it immediately after the new vault has been checked.
What you need before moving passwords
A password migration is safest when the destination is ready before you create an export. Gather the computers and phones you use, identify where passwords are currently stored, and decide whether you need to move more than login credentials.
As an Amazon Associate I earn from qualifying purchases.
- Destination support: Confirm that the manager has apps or browser extensions for your operating systems and browsers. Check whether it supports the source you are migrating from.
- Account access: Create the destination account with a long, unique account password that you do not use anywhere else.
- Second-step protection: Have an authenticator app or, if supported and compatible with your devices, a FIDO2/WebAuthn security key ready.
- Source inventory: Note whether the old system contains passwords, passkeys, payment cards, addresses, secure notes, shared items, or Wi-Fi credentials. An import may cover only some of these categories.
- Private workspace: Export only on a device you control. Do not email the export or save it in a shared or synchronized folder.
How password-manager migration works
The usual path is an export file followed by an import. Chrome and Edge password settings can produce a CSV for migration to another manager. Chrome-to-1Password also uses CSV. Apple warns that its exported CSV is unencrypted, and Google requires CSV for imports. Treat every export as a temporary copy of your entire password collection.
The destination normally encrypts records when they are added to the vault, but that protection does not make the original CSV safe to leave on disk. Anyone who can open the file can read the exported credentials. Keep the window between export and deletion as short as possible.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step-by-step: set up the new manager and migrate your vault
1. Choose the destination based on compatibility and data coverage
Do not choose only by the number of supported platforms. Compare whether the source and destination work on your devices, which data types transfer, whether the route requires a plaintext CSV, how duplicates are handled, and what account-security options are available.
| Decision | What to check | Why it matters |
|---|---|---|
| Devices and browsers | Desktop apps, phone apps, browser extensions, and supported operating systems | You need the destination available wherever you currently use autofill. |
| Credential types | Passwords, passkeys, cards, addresses, notes, Wi-Fi credentials, and shared entries | A password-only import can leave other records behind. |
| Transfer method | CSV, direct app transfer, or Credential Exchange where supported | Direct methods can avoid an exposed file, but availability is platform- and app-specific. |
| Import behavior | Duplicate handling, field mapping, and item-type support | Repeated imports can create duplicate records or put values in unexpected fields. |
| Account security | Two-step login options and recovery procedures | The vault password protects every stored login, so losing access has broad consequences. |
2. Install the apps and browser extension
Install the destination manager from its official distribution channel on each device you use. Add its browser extension, sign in, and confirm that the extension can open the vault. If you use both a desktop browser and a phone, complete this setup on both before importing.
Create a strong, unique account password and record it using a method you can retrieve without leaving it in an exposed text file. Read the provider’s recovery instructions before continuing; recovery options and plan requirements differ between services.
Recommended Free Tools
3. Turn on two-step login for the vault
Two-step login for the password-manager account is separate from two-step authentication on individual websites. The first protects the vault itself; the second protects accounts such as email, banking, or social services.
Bitwarden’s documentation recommends securing the vault with two-step login and lists authenticator apps and FIDO2/WebAuthn keys among its supported methods. Other managers may offer different methods or restrict some options to particular plans. If you use a hardware security key, verify that your device has the required USB, NFC, or Bluetooth support and register a backup method before relying on the key.
4. Prepare the old manager
Keep the old manager available during the entire migration. Do not sign out, uninstall it, or bulk-delete its records yet. Close unrelated applications and make sure you know where the export will be saved so you can remove it later.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the exporting service recommends pausing backups, do so only for the export period. 1Password specifically advises temporarily disabling backup software before exporting Chrome passwords so an unencrypted CSV is not copied automatically. Restore backups after the CSV and any copies have been removed.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →5. Export using the source’s official method
Use the exact export controls for your browser, operating system, and source manager. Chrome and Edge generally expose a CSV export in their password settings. The wording and menu location can change, so follow the current instructions for your version rather than assuming that a menu shown on another device is identical.
Before clicking export, close screen-sharing sessions and make sure no one else can access the device. The resulting file may contain every username and password in the source vault. Do not rename it into a shared project folder, upload it for convenience, or send it through email or messaging.
6. Import into the correct vault and format
Open the destination’s import command, select the source format that matches the file, and choose the intended vault or account. A wrong format can map columns incorrectly or create unusable items. If the destination offers a direct transfer for your particular desktop app and operating-system combination, read its eligibility requirements first; direct import is not universal.
Bitwarden supports importing through its web app, browser extension, desktop app, or command-line interface, depending on the source and format. It says imported data is encrypted locally before being sent to its server. Its import process does not deduplicate records, so importing the same CSV twice can produce duplicate vault items.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
7. Verify the new vault before changing the old one
Verification is not optional. Select a representative sample instead of checking only the item count:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Search for your primary email account, banking or payment accounts, work accounts, and several ordinary sites.
- Open each item and confirm the website address, username, password, notes, and folder or collection assignment.
- Use a private or separate browser window to test signing in with the destination’s autofill. Confirm that the login succeeds without consulting the old manager.
- Inspect recently created, duplicated, or uncategorized items. Look for usernames placed in password fields, app names placed in URL fields, truncated notes, and records with missing website addresses.
- Check for data types the import may not support, including passkeys, payment cards, addresses, secure notes, Wi-Fi passwords, and shared entries.
Google notes that some app or site names can appear in unexpected fields after import. A successful import count therefore does not prove that every record is usable.
8. Switch autofill only after testing
Set the new extension or phone autofill provider as the default where your operating system allows it. Turn off the old browser manager or extension only after several logins work from the new vault. Keeping both active can produce competing autofill prompts and make it unclear which record supplied a password.
9. Delete the export and retire the old copy carefully
After verification, delete the CSV from its original folder, empty the recycle bin or trash if your system retains deleted files there, and remove any copies created by backup or synchronization software. Then decide whether to keep the old manager as a read-only reference for a short transition period or remove its stored passwords.
1Password warns that deleting Chrome passwords is permanent. Do not perform that deletion until all important records have been confirmed in the destination and any unsupported data has been copied manually.
Platform-specific migration paths
Chrome or Edge to Bitwarden
Bitwarden documents exporting passwords from Chrome or Edge’s password settings to CSV and importing the result through the web app, extension, desktop app, or command-line interface. It also documents direct browser import for selected desktop configurations, with restrictions based on the operating system and how the browser was installed.
After import, inspect duplicates because Bitwarden does not compare incoming records with existing vault items. If you retry an import, remove or identify the earlier batch first. Delete the exported data file once the records have been checked.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Chrome to 1Password
1Password’s Chrome procedure saves browser passwords as a CSV and imports them through its apps or 1Password.com. The Chrome import creates Login items from passwords. It does not import credit cards, addresses, passkeys, or other information, so those records require a separate plan.
Install the 1Password browser extension after importing, turn off Chrome’s built-in password manager to prevent competing prompts, and verify every important login before deleting Chrome’s saved passwords. The unencrypted CSV should be deleted immediately after validation, along with copies made by backup software.
Importing into Google Password Manager
Google’s current help instructions require a CSV file and recommend the column headings url, username, and password. Google states a limit of 3,000 passwords per import and up to 10,000 passwords stored in a Google Account. These are Google-specific product limits, not general limits for password managers.
If your export exceeds 3,000 records, split it into supported batches without changing the column names. Review each batch for field placement because Google warns that some app or site names may not land where you expect. Delete the CSV after the import; anyone with access to the device could open it.
Apple Passwords on an iPhone
Apple’s export flow creates a CSV and warns that it is unencrypted. The documented iPhone import path is Settings > Apps > Safari > Import; it accepts a CSV or ZIP file. Delete the imported file after the transfer and validation.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Apple says this export route cannot include Wi-Fi passwords, passwords shared with a group unless you created the group, or passwords for Sign in with Apple accounts. Imported passwords may not be encrypted while they remain in the file, so keep the file local and temporary.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Other managers and direct transfers
1Password lists import routes from Chrome, Firefox, Edge, Brave, Safari, Bitwarden, Dashlane, KeePass, Keeper, LastPass, and other applications. CSV transfers are common, but the available fields vary by source. Some desktop-app combinations support Credential Exchange, a direct migration standard, on supported operating-system versions. Treat direct transfer and passkey coverage as source- and destination-specific rather than assuming that every credential type will move.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can go wrong, and how to recover
The import created duplicates
This usually means the same file was imported more than once or the destination does not deduplicate incoming records. Stop importing, identify the newer batch by its creation time or folder, and remove duplicates only after opening a sample to determine which copy contains the complete data. Keep the old vault intact until the cleanup is finished.
Fields are in the wrong places
Different exporters label columns differently. An app name may appear where a website URL belongs, or a username may be placed in a custom field. Edit affected records manually, add the correct sign-in URL, and test autofill. For a large migration, correct the CSV headers only when the destination’s documentation specifies the accepted names; do not guess at unsupported columns.
Some records are missing
Compare the source categories with the destination’s documented import scope. A password-only route may omit passkeys, cards, addresses, notes, Wi-Fi credentials, or shared items. Export or copy unsupported categories using their own supported methods and add them manually. For a particularly important account, open the old record and create a fresh item in the new vault rather than relying on a damaged import.
Autofill still uses the old manager
Disable the old browser manager and extension, then check the operating system’s password-autofill setting on each phone and computer. Sign out of a test site, open a new private window, and confirm that the new extension offers the expected item. If two extensions remain enabled, temporarily disable one while diagnosing the prompt order.
The CSV was copied or exposed
Assume every credential in an exposed export is compromised. Delete the file and its recoverable copies, then change passwords for the most sensitive accounts, starting with email, financial services, work systems, and any account that can reset other passwords. Enable website two-step authentication where available. Do not rely on deleting the file alone if another person or service may already have read it.
Quick Recap
Security practices after migration
- Use the manager’s generated passwords for new or changed accounts rather than reusing a memorable pattern.
- Protect the vault account with two-step login and store recovery information separately from the vault.
- Review the browser extension’s autofill behavior. For high-risk sites, configure it to require an explicit user action before filling when that option exists.
- Keep the old vault or browser manager disabled once you are confident the destination works; two active stores make future updates easy to miss.
- Update important website passwords that were reused elsewhere, even if the migration itself succeeded.
- Keep passkeys and shared credentials in the system designed to manage them. A CSV password export is not a universal backup for every modern credential type.
A final verification checklist
- The destination app and browser extension work on every device you use.
- The vault account has a unique password and an enabled second step where supported.
- Primary email, financial, work, and recovery accounts have been opened and tested.
- Duplicate, malformed, and uncategorized records have been reviewed.
- Unsupported categories such as passkeys, cards, addresses, notes, Wi-Fi passwords, and shared items have been handled separately.
- The new manager supplies autofill without prompts from the old manager.
- The CSV and copies in synchronized folders, backups, trash, and recycle bins have been removed.
- The old passwords have not been deleted until the checks above are complete.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
