Android Can Now Move Passkeys Between Password Managers: How to Switch Safely
Technology / Digital Security
Android’s new direct transfer flow moves passwords and passkeys between supported managers without downloading an exposed CSV file. Here is what to check before and after switching.
The featured image is an original editorial illustration, not a screenshot of the Android interface.
Changing password managers used to involve an awkward compromise: export your passwords into a file, import it elsewhere, then make sure the unencrypted copy was deleted. Moving passkeys was harder because they often had to be recreated at each service. On September 10, Google announced an Android flow that coordinates a direct transfer between supported managers, including passkeys, without a downloaded file.
Google says the experience is available on Android 8 or newer and names Google Password Manager, 1Password, Bitwarden Password Manager and Dashlane as participating services. Availability of a particular direction and interface depends on the apps and their current versions. The important point is control: the receiving manager starts the request, Android identifies the source, and the source asks you to review and authorize the move.
Update Android and both password-manager apps, make sure your phone has a screen lock, and verify that you can still unlock the old manager. Do not uninstall it or erase its vault before checking the transferred accounts and passkeys.
How the direct transfer works
Open the manager you want to use next and look for its import or copy option for passwords and passkeys. Select the existing manager when Android presents the available sources. The old manager should then ask you to sign in or unlock, review what is moving and explicitly approve the transfer. A recovery key may be requested for some passkeys. Finish in the destination app and inspect the results.
If Google Password Manager is the destination, Google’s help instructions say to open its Settings, choose Import passwords and passkeys, tap Next, choose the source manager, authenticate to that manager, approve export and tap Done. If Google is the source, begin in the third-party destination app, select the Google account whose credentials you intend to move, authenticate and approve the export in Google Password Manager. A screen lock is required for either direction.
What to verify before retiring the old manager
Compare the number of saved accounts, then spot-check several important logins: primary email, banking, work accounts and sites that use passkeys. Try signing in through the new manager on a trusted device. Passkey use on a new device may require the old device’s screen lock or a Google Password Manager PIN. Do not assume a successful transfer means every entry, label or recovery method behaved identically.
Check the new manager’s autofill setting and synchronization across your own devices. Keep a separate, current recovery method for the most important accounts. A passkey on a device you lose should be removed from the relevant account’s security settings when you regain access; Google’s account help explains that adding a Google Account passkey does not automatically remove existing authentication or recovery factors.
Why the old CSV route needs extra care
Google still documents CSV import for cases where a direct transfer is unavailable. A CSV containing passwords is readable by anyone who can open it. If you must use one, follow the official instructions for the two managers, avoid sending it through email or general cloud folders, and delete the file after a successful import. Google’s help page explicitly warns that leaving it on the device exposes passwords to other users of that device.
The direct flow reduces that particular file exposure, but it does not make a malicious destination app safe. Install the intended manager from its official source, verify the developer and be wary of prompts that ask you to paste credentials into a website. You should be able to stop and investigate if the source or destination shown by Android is unfamiliar.
If the option is missing or import fails
Confirm Android and app versions, a working screen lock and that both managers support the new exchange. Google’s troubleshooting notes say an empty or damaged source vault can cause failure. Retry through the official app settings rather than through a third-party conversion site. Some employers and managed devices may impose additional restrictions.
Moving a vault is a security-sensitive task, so a few minutes of verification is more useful than speed. The benefit of the new Android flow is a safer path away from an unencrypted export file and, for supported managers, less need to recreate passkeys one account at a time.
