Treat migration as a controlled change
A password manager holds credentials for many services, so moving its contents deserves more care than moving ordinary bookmarks. Begin by deciding why you are changing tools and which features you need to preserve: passwords, passkeys, secure notes, shared items or attachments. Different products support different export formats, and not every type of item necessarily transfers through the same process.
Read the current export and import instructions from both providers before starting. Confirm that you can sign in to the destination and that its recovery arrangements are understood. Do not remove the old manager or delete its vault simply because the new application installed successfully. Installation establishes that software is present; it does not show that your account data has transferred accurately or can be recovered.
Protect the destination before importing
Use a strong, unique master password where the product requires one, and enable its supported account protection. Store recovery information in a secure place that will remain accessible if the primary device fails. Review which devices are signed in and whether synchronization is enabled. A successful import into one local installation is different from a completed, recoverable setup across the devices you intend to use.
Avoid performing the migration on a shared or untrusted computer. Close unrelated applications that do not need access to the process, and use the providers' built-in tools rather than an unknown conversion website. The goal is to minimize the number of places where the vault contents appear. A convenient online formatter is not an appropriate destination for a file containing account passwords.
Understand the export format before saving it
Some exports are unencrypted text files, commonly CSV or JSON. Others may be protected in a provider-specific format. The filename alone does not tell you which protection applies. Read the export warning carefully and assume that an unencrypted export can be read by anyone who gains access to that file. Avoid placing it in a shared download folder or a directory that automatically synchronizes somewhere you did not intend.
Choose a controlled local location and keep the file only as long as necessary. Do not email it to yourself, paste it into a support conversation or upload it to a public file-sharing service. If an encrypted archive is part of your process, understand that its password and the archive should not be casually stored together. Encryption is useful only when the surrounding handling remains sensible.
Import and inspect a representative sample
Use the destination's documented import process and inspect the result before making the switch permanent. Check several item types, not only the first entry in the list. Confirm that account names, usernames, website addresses, notes and any required custom fields arrived as expected. Watch for duplicate entries and for passwords associated with the wrong hostname.
Test a few low-risk sign-ins through independently verified website addresses. Do not approve unexpected account changes merely to prove that autofill works. If a credential fails, compare the source entry rather than repeatedly guessing. Pay special attention to items that the providers say are not supported by the transfer format. Passkeys, attachments or shared-vault permissions may need a separate migration or re-enrolment process.
Resolve duplicates and recovery dependencies
During a transition, two managers may both offer autofill. This can make it unclear which copy was updated after a password change. Choose which tool will handle normal filling and disable the redundant integration when you are ready. Keep any remaining source vault access only for a deliberate verification period, rather than leaving two conflicting systems active indefinitely.
Review the email and second-factor accounts used to recover the new manager. If all recovery information is available only inside the new vault, a lockout can become circular. Keep supported recovery material securely accessible outside that dependency. For shared or organizational vaults, coordinate with the owner or administrator. An individual export may not preserve permissions, ownership or audit records associated with a managed account.
Remove temporary copies and finish the handover
Once the migration is verified, remove unnecessary export files using the operating system's normal deletion process and review synchronized folders or backups where a copy may have been created. Be realistic about deletion: it does not guarantee immediate erasure from every backup, storage medium or previously shared location. If the export was exposed to another person or an untrusted service, deleting your local copy does not undo that exposure.
Document which manager is now authoritative and how its recovery process works. Remove obsolete browser extensions and review devices that no longer need vault access. Keep the original provider's account only if you have a clear reason and understand its remaining data. A successful migration ends with a working, comprehensible system and no forgotten plaintext export sitting beside ordinary downloads.
Sources & further reading
These references explain the underlying topics. They do not endorse DMfirst or certify a gaming operator.