The irony of a password manager migration
The entire point of a password manager is to avoid ever having your passwords sitting in plaintext anywhere. Migrating between two password managers almost always requires briefly breaking that principle: most services export your vault as a plaintext CSV file, containing every password, username, and often notes and payment details, all readable by anyone who opens it. The migration process itself is the single most common moment a password manager user's data exists outside of encrypted storage.
Where that export file usually ends up
By default, browsers save downloaded files to a Downloads folder that isn't encrypted, isn't automatically cleaned up, and is often synced to cloud backup services without a second thought. A plaintext password export left there — even briefly — is genuinely one of the more serious, avoidable security risks a careful person can create for themselves, precisely because it happens during a task meant to improve security.
The other commonly missed piece: 2FA secrets
Two-factor authentication codes (TOTP) are frequently stored in the same password manager as your passwords, but many export formats don't include the underlying TOTP seed/secret by default. This means a migration that looks complete — passwords imported, accounts accessible — can silently leave you unable to generate 2FA codes for a given account until you notice and re-enroll it from scratch, sometimes at an inconvenient moment like being locked out mid-login.
Verification matters more than the export/import itself
Custom fields, secure notes, and payment card details don't always survive an export/import cycle cleanly across different password manager platforms, since each vendor's export format has its own quirks. Spot-checking a sample of entries — not just confirming the import "ran successfully" — is what actually catches silent data loss before you need that specific entry and discover it's missing.
The step people forget entirely: deleting the export
Once the new password manager is verified working, the plaintext export file needs to be securely deleted — not just moved to Trash, which typically leaves the underlying data recoverable until overwritten. This single step is the one most migration guides mention in passing and most people skip in practice, simply because by the time migration "feels done," the export file has been forgotten.
What "done" actually looks like
A complete migration means every device you use is synced to the new manager, shared vaults and emergency access contacts have been reconfigured (since these don't transfer automatically), and the new manager's own recovery kit has been stored somewhere safe. Treating the migration as finished after the first successful import, on just one device, is how gaps end up surfacing weeks later.
Frequently Asked Questions
Because most migrations require exporting your entire vault as a plaintext CSV file — every password, username, and often notes and payment details, all readable by anyone who opens the file. That export, if left sitting in a Downloads folder or synced to cloud backup, is one of the more serious avoidable security exposures a careful person can create, precisely during a task meant to improve their security.
Not always. Many export formats include your passwords but exclude the underlying TOTP (two-factor authentication) seed or secret by default. This can leave a migration looking complete while silently leaving you unable to generate 2FA codes for certain accounts until you notice and re-enroll them individually.
No — moving a file to Trash or deleting it through normal means typically leaves the underlying data recoverable on your drive until it's overwritten by other data. Securely deleting a plaintext password export means using your OS's secure-delete option or a dedicated file-shredding utility, not just dragging it to Trash.
Shared vaults with family members and emergency access/recovery contacts are two settings that typically don't transfer automatically during a basic vault export and import — they need to be manually reconfigured in the new password manager after migration.
Yes — the Password Manager Migration Checklist is a weighted 12-point checklist covering the full process: export, secure handling of that export, import verification, 2FA migration, and — weighted heavily — secure deletion of the plaintext export file once everything is confirmed working.