Android Password Managers Now Move Passwords and Passkeys Without CSV Files

Android can now move passwords and passkeys directly between supported password-manager apps on the same device, without downloading a file. That matters because the common file-based route left an unencrypted text file on the device, while passkeys had to be recreated across individual sites and apps.

From an export file to a direct handoff

Google announced the new Android transfer experience on September 10, 2026. Instead of routing a switch through an unencrypted text export, supported password managers can exchange passwords and passkeys directly on the same device using the standardized FIDO Credential Exchange Format.

The older CSV option remains available in Google Password Manager, so not every migration path is now file-free. Direct transfer is available when the participating providers support the framework.

Start in the new manager, approve in the old one

The handoff begins in the new password manager: choose its import or copy option, then let Android detect available existing managers on the device. After Continue is selected, Android opens the existing manager so the credentials can be selected, reviewed and authorized; Google says the app-to-app transfer then finishes in seconds.

Identity is verified with the device screen lock, and users need to trust the destination manager. A passkey transfer may also request a recovery key. Android coordinates the authorized handoff without exposing raw credentials to the operating system or unauthenticated apps.

Four launch apps, with practical limits

The launch participants are Google Password Manager, 1Password, Bitwarden Password Manager and Dashlane, with more partners expected later. The framework works with Android 8 and newer, but that developer-level compatibility does not guarantee the feature is already available on every device, build or provider combination.

When credentials are imported into Google Password Manager, existing duplicate passwords are not added again. An import can still fail if the source manager returns no credentials or provides broken data.