# What to check before you move off a password manager Know why you're moving and sort the vault before you export. Some items don't carry over, CSV exports aren't encrypted, and shared passwords may need changing. Updated: October 16, 2026 You might be leaving a [password manager](/guides/shared-accounts/what-is-password-manager) over cost or ease of use, or over how it handles sharing. But the vault holds more than shared logins. It also has employees' own logins, notes, cards and passkeys. If you export before deciding what goes where, you find out later what didn't make the trip. ## Name why you're moving The reasons fall into two groups. The first is the product itself: cost, how easy it is to use, which devices it supports. Another product of the same kind may fix those. The second comes from how sharing works. People can see the shared passwords, and each departure means changing them and sending out new ones. Hiding the password from the people who autofill it doesn't settle this: Bitwarden's help center says to treat a hidden password like any shared login ([Does hiding a shared password keep it secret?](/guides/shared-accounts/hidden-password-sharing-limits)). So moving to another password manager leaves both problems in place. Removing them takes a way to sign people in without showing them the password. Your reason also decides two later steps: whether you change passwords during the move, and which items go somewhere other than the new system. ## Sort the vault by type - Accounts several people use for work (shared accounts) - Each employee's own work logins - Employees' personal passwords - Notes, payment cards, addresses and similar items - Passkeys (sign-ins that use the device's fingerprint or face check instead of a password) - Setup keys for authenticator app codes, and two-step verification backup codes - File attachments Leave personal passwords out of the company move. Ask employees to move them to a personal account of their own. [Can employees keep work passwords in their personal password manager?](/guides/shared-accounts/personal-password-manager-at-work) covers which passwords belong where. If you aren't moving to another password manager, decide where everything except shared accounts will live. A system that signs people in to shared accounts isn't a place for notes, payment cards or an employee's own passkeys. ## Check before you export ### Who is allowed to export On business plans, an admin setting may block exports. LastPass Teams and Business have a policy, "Prohibit export", that turns the option off. On Keeper Enterprise accounts, the person's role policy must allow exports, and an admin can restrict them. Bitwarden Enterprise has a "Remove export" policy that stops members from exporting their own vault, but it doesn't apply to owners and admins. In 1Password, people who sign in through the company identity provider ("Unlock with SSO") can't export. An admin can turn that setting off for them. Plan for an admin to export the shared items. In Bitwarden, a personal vault export leaves out items the organization owns. Only owners, admins and some custom roles can export the organization's items. A member with permission to manage a collection (Bitwarden's unit of sharing) can export the collections they can reach. ### What each format leaves out In 1Password, Bitwarden and LastPass, a plain CSV file (a spreadsheet-style text file) leaves some kinds of item out. 1Password's CSV holds only Login and Password items, and leaves out custom fields such as two-step backup codes. For those, pick 1Password's own 1PUX format. Bitwarden also exports JSON, a text file with more structure than CSV. Payment cards, identities, passkeys and SSH keys go only into JSON exports, and no format includes items in the trash. LastPass's CSV export leaves out attachments and the one-time codes your vault generates. Check passkeys separately. 1Password exports passkeys only from its iOS and Android apps, using Credential Exchange, a standard for moving passkeys and other sign-ins straight from one app to another. From a computer, you create new passkeys on each site. Bitwarden includes passkeys in JSON exports, and its mobile apps also support the same exchange standard. The receiving side has limits too. From a CSV file, 1Password imports logins, credit cards and secure notes. In a 1Password business account, someone without permission to create vaults can import from a 1PUX file only the items from their own Employee, Personal or Private vault. Bitwarden doesn't check for duplicates, so importing the same file twice doubles every item. Attachments go back in one at a time. ## Handle the export file like the passwords inside it CSV and 1PUX files aren't encrypted. 1Password says anyone with access to the file can read your passwords. Both 1Password and Bitwarden say not to email the file and to delete it when you're done, and 1Password adds not to store it online. Encrypted exports exist: Bitwarden offers a password-protected JSON file, and Keeper can export a KeePass file locked with a password you choose. Before anyone starts, decide who exports, on which computer, and when the file gets deleted. A file saved to a shared drive or cloud folder can be read by everyone who can open that folder. ## Change passwords when you move If the new system doesn't show passwords to the people who use them, change each password as you move it. Otherwise anyone who saw it in the old vault can still sign in without going through the new system. For accounts whose authenticator setup key lived in the vault, set up two-step verification again too. The old vault, or an export that includes the key, can still generate valid codes. If you're moving to another password manager, the same people still know the same passwords. Each departure will still mean changing passwords in the new product, as described in [What to stop and what to change when someone leaves a shared password manager](/guides/shared-accounts/password-manager-offboarding). ## Running both for a while, then shutting down 1Password and Bitwarden both recommend turning off the browser's own password saving, so it doesn't get in the way of their extension. While old and new tools run side by side, two fill-in tools appear on the same sign-in page. For each account, decide which one people should use. Keep the overlap short: once a password changes in the new system, people who still use the old vault can't sign in. To finish, do three things: 1. Remove the old product's browser extension from every computer. As long as it's installed and signed in, it can keep filling in old entries. 2. Delete passwords saved in the browser and turn off its offer to save them. Bitwarden's help center has the Chrome steps for turning saving off. 3. Delete the old vault. In 1Password, a lapsed subscription freezes the account instead of deleting it, and people can still view items and copy passwords. When a Teams owner deletes the account, 1Password permanently deletes the data after 30 days. For a Business account, you contact 1Password Support to delete it, so ask them about timing. ## Frequently asked questions **When should we delete the export file?** As soon as you've confirmed the import worked. 1Password and Bitwarden both say not to email an unencrypted export and to delete it when you're done. **Can passkeys move with everything else?** It depends on the product. 1Password exports passkeys only from its iOS and Android apps; from a computer you create new ones on each site. Bitwarden includes passkeys in its JSON export, a structured text file, but not in CSV. **Does canceling 1Password delete the old vault?** No. When the subscription lapses, the account is frozen, and people can still view items and copy passwords. Deleting the account is a separate step. **Should we change passwords after moving?** If the new system doesn't show passwords to the people using them, yes, as you move each one. Otherwise anyone who saw a password in the old vault can still sign in without going through the new system. ## Sources - [1Password Support: How to export your data from the 1Password apps](https://support.1password.com/export/) - [1Password Support: Move your data from other applications to 1Password](https://support.1password.com/import/) - [1Password Support: Turn off the built-in password manager in your browser](https://support.1password.com/disable-browser-password-manager/) - [1Password Support: If your 1Password account is frozen](https://support.1password.com/frozen-account/) - [1Password Support: How to delete your 1Password account](https://support.1password.com/delete-account/) - [Bitwarden Help Center: Export Vault Data](https://bitwarden.com/help/export-your-data/) - [Bitwarden Help Center: Import to your Vault or Collections](https://bitwarden.com/help/import-data/) - [Bitwarden Help Center: Collection Permissions](https://bitwarden.com/help/collection-permissions/) - [Bitwarden Help Center: Enterprise Policies](https://bitwarden.com/help/policies/) - [Bitwarden Help Center: Autofill Passkeys](https://bitwarden.com/help/storing-passkeys/) - [Bitwarden Help Center: Deactivate My Browser's Built-in Password Manager](https://bitwarden.com/help/disable-browser-autofill/) - [LastPass Support: Export vault data from LastPass as a generic CSV file](https://community.lastpass.com/kb/articles/40-export-vault-data-from-lastpass-as-a-generic-csv-file%EF%BB%BF) - [Keeper Documentation: Vault Export](https://docs.keeper.io/user-guides/export-and-reports/vault-export) ## How Junify handles this **Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login. **With Junify** If you're moving because people can see shared passwords, or because each departure means changing and resending them, Junify can take the password manager's place for shared accounts. Change each password as you move it and store the new one only in Junify. People sign in without being shown it. When someone leaves, the admin removes their access in Junify, and each use is recorded by person. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=moving-off-password-manager) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both. - [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password. - [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.