Changing password managers has traditionally involved exporting a CSV file, importing it elsewhere, and then remembering to delete a plain-text copy of every password. Android’s new transfer mechanism is designed to remove that weak point for supported services.
What the transfer changes
Instead of writing credentials to a readable file in Downloads, Android coordinates a direct handoff between the old and new password managers. The user reviews and authorizes the request in the current manager, and the receiving manager imports supported passwords and passkeys.
Google lists Google Password Manager, 1Password, Bitwarden, and Dashlane among the initial participants. Availability requires Android 8 or later and current versions of the participating apps.
Before starting
- Update Android and both password-manager apps.
- Confirm that you can unlock both vaults and complete their two-factor authentication.
- Make a separate recovery plan for the old vault before changing subscriptions or deleting an account.
- Choose a quiet moment. Do not perform a credential migration over an unfamiliar public network or while screen sharing.
Verify, then switch the default
A completed import is not proof that every item arrived. Compare the approximate item count and manually check several types of record: a normal website password, a passkey, a secure note, a payment card if supported, and a login with multiple saved accounts.
Some record types may be proprietary to one manager. Attachments, custom fields, one-time password seeds, shared-vault permissions, and archived items need special attention. Keep the old vault intact until the new manager has worked across your main phone, browser, and at least one recovery device.
What this does not solve
A safer transfer cannot repair weak or reused passwords. After migration, run the new manager’s security audit and change exposed or duplicated credentials, beginning with email, cloud storage, financial accounts, and the password manager itself.
Passkeys also deserve a deliberate check. A passkey may be synchronized through a platform account, stored in a specific manager, or bound to hardware. Confirm that you can sign in before removing the old copy.
If direct transfer is not offered
Do not install an unofficial conversion tool. Use the documented export and import procedures from both vendors, work on a trusted computer, disconnect unnecessary cloud-sync folders, and securely remove the export after verification. An encrypted backup stored offline can be retained if the vendor supports one.
The direct Android flow is a meaningful security improvement because it removes a common moment when an entire vault can be exposed in one file. The final responsibility remains the same: verify the destination before retiring the source.