How to Transfer Passkeys Between Password Managers Safely

In this article

1. Why Transferring Passkeys Differs from Exporting Passwords
2. The FIDO Alliance Credential Exchange Standard
3. Pre-Migration Audit: Preparing Your Accounts
4. How to Move Passkeys: The Direct and Manual Routes
5. Path A: Direct Import and Export (Where Supported)
6. Path B: Manual Passkey Re-Registration (The Universal Fallback)
7. The Zero-Lockout Protocol: Parallel Verification
8. Summary Checklist

Switching password managers used to be straightforward: export your database to an encrypted file or spreadsheet, import it into the new manager, verify your entries, and clear the old app. With the rise of passkeys, this process is noticeably different. If you attempt to transfer passkeys between password managers using traditional export methods, you will quickly notice that your passkeys are often left behind.

Because passkeys rely on asymmetric public-private key cryptography rather than simple symmetric text strings, moving them requires strict security boundaries. Here is an overview of the technical hurdles involved, how standards like the FIDO Alliance Credential Exchange framework aim to address portability, and the practical steps needed to move your credentials without risking an account lockout.

Why Transferring Passkeys Differs from Exporting Passwords

To understand why passkey migration feels restrictive, consider how standard passwords differ from public-key credentials:

• Passwords are static symmetric secrets: Both you and the server hold the identical secret (or a hashed representation of it). Exporting passwords typically produces a structured plaintext format, such as a CSV or JSON file, which contains your username, password, and URL. If you need a refresher on safeguarding standard exports, see our guide on how to export and encrypt your browser passwords before switching password managers.
• Passkeys are asymmetric key pairs: When you generate a passkey, your authenticator creates a public key (registered with the website or service) and a private key (stored securely on your device or synced password manager). The relying party never sees your private key. Instead, authentication occurs through a digital signature.

Because the private key must remain protected from unauthorized extraction, operating systems and credential managers historically restricted direct export of the underlying cryptographic keys. While this helps prevent unauthorized extraction of credentials, it can also create platform lock-in, leaving users unable to easily export passkeys to another service.

The FIDO Alliance Credential Exchange Standard

To address cross-platform portability, specifications for credential exchange (often discussed in terms of Credential Exchange Protocol and Credential Exchange Format) are being developed within industry groups such as the FIDO Alliance. The goal of this standardized framework is to provide a secure mechanism for moving credentials—including the underlying private keys—between different credential providers without exposing secrets in plaintext.

Instead of relying on unencrypted CSV files, a standardized credential exchange aims to use secure, encrypted transport mechanisms. Under these specifications, credentials can be packaged into an encrypted container for transfer, allowing an importing manager to ingest that container and unpack the cryptographic keys directly into its secure storage.

However, cross-platform adoption remains an evolving effort. Implementation across major password managers depends heavily on underlying operating system support, native API hooks, and ongoing software rollouts. As a result, seamless, universal one-click transfers are not guaranteed across every combination of platforms and applications today.

Pre-Migration Audit: Preparing Your Accounts

Before attempting to move passkeys to a new password manager, perform a thorough inventory. Attempting a migration without proper fallback configurations can leave you locked out of critical services. As discussed in our checklist on making a passkey recovery plan, redundancy is your best defense against data loss.

1. Identify all passkey-enabled logins: Review your current password manager vault to identify entries that store a passkey. Note which accounts rely exclusively on passkeys versus those that retain a secondary password.
2. Confirm secondary recovery channels: For passkey-reliant accounts, ensure you have an active secondary recovery method. This may include time-based one-time passwords (TOTP), SMS verification, account recovery codes, or a secondary hardware key.
3. Keep both password managers active: Avoid uninstalling your existing password manager or deleting its vault before verifying that every login functions properly in the destination manager.

How to Move Passkeys: The Direct and Manual Routes

Depending on which password managers and platforms you use, you will generally follow one of two paths: an encrypted direct import/export (where supported) or a manual re-enrollment workflow.

Path A: Direct Import and Export (Where Supported)

If your source and destination managers support standardized or encrypted file exchanges, general steps typically involve:

1. Check compatibility: Ensure both applications are updated. Verify whether your destination manager explicitly supports importing passkey data from your source platform’s export format.
2. Generate an encrypted export: In your current password manager, check the export options. Standard CSV exports generally omit private keys; passkey data typically requires specific encrypted formats supported by the software.
3. Import into the new manager: Open your destination manager, select the appropriate import option, and provide the exported file along with any required decryption credentials.
4. Inspect the imported vault items: Verify that the imported entries specifically indicate that a passkey or cryptographic credential is present, rather than just basic login fields.

Path B: Manual Passkey Re-Registration (The Universal Fallback)

If direct passkey transfer is not supported between your chosen managers—or if an export fails to include private keys—manual re-registration serves as the universal fallback.

1. Log in to the target service using your existing passkey or fallback credentials.
2. Navigate to the service’s account security or sign-in management settings.
3. Locate the section listing your registered passkeys or security devices.
4. Choose the option to add a new passkey or security credential.
5. When prompted by your browser or operating system to save the credential, ensure the request is handled by your destination password manager.
6. Complete the prompt to save the new key pair into the destination vault.
7. Once the new passkey is saved, test it in an isolated session before removing the old passkey from the service.

The Zero-Lockout Protocol: Parallel Verification

The primary risk during a credential migration is deleting your legacy database before confirming that the new vault functions correctly. A cautious verification sequence helps reduce the risk of lockouts:

Verification Stage	Action Required	Pass Criteria
1. Visual Audit	Inspect entries in the destination manager.	Passkey data is present and recognized by the app.
2. Isolated Session Test	Open a private or separate browser window and attempt sign-in.	Destination manager prompts for and successfully completes authentication.
3. Fallback Check	Verify account recovery codes or alternate MFA methods are accessible.	Secondary login channels are verified and safely stored.
4. Legacy Removal	Revoke obsolete keys on the service and clear old vault entries.	Old passkeys are disabled only after successful independent logins.

Only after an account passes verification should you consider navigating to the service’s security panel to remove the old passkey. Deleting the old key from the service prevents clutter and helps avoid attempting authentication with an obsolete credential.

Summary Checklist

Passkey portability continues to evolve as standardized credential exchange frameworks are developed and evaluated across the industry. Until universal, platform-agnostic transfers are broadly supported across consumer environments, a cautious approach is best: check for supported encrypted transfer options, use manual re-registration when direct transfer is unavailable, and maintain your existing credentials until sign-ins are verified.