Android Now Transfers Passkeys Between Password Managers, No CSV Export
Google switched on a system-level way to move passwords and passkeys between password managers on Android, ending the long-standing situation where switching apps meant exporting an unencrypted CSV file — and where passkeys could not be moved at all. The feature was announced on 10 September 2026 and works on devices running Android 8 or newer, with Google Password Manager, 1Password, Bitwarden Password Manager and Dashlane supported at launch.
Passkeys were the part that could not move
Passwords have always been portable in a clumsy way. You exported them to a plain-text file, imported that file somewhere else, then hoped you remembered to delete it. Passkeys were worse: because the private key lives inside the manager, there was no export path at all. Changing managers meant deleting and re-creating the passkey on every site and app that used one, individually.
That is what changed. The credential now moves across, so the accounts you have already switched to passkey sign-in keep working from the new manager without you visiting a single account settings page.
How the transfer actually runs
The flow starts in the app you are moving to, not the one you are leaving:
- Open your new password manager and choose its import option.
- Android detects the credential managers already installed and lists the ones you can pull from.
- Tap Continue, and Android hands you to your existing manager to select and review what is being sent, then authorise it.
- The data moves between the two apps in a few seconds.
Both apps must support the feature — this is a two-sided handshake, not something the receiving app can do on its own. If your current manager is not on the list above, the import screen will not offer it yet.
What moves, and what stays put
The underlying Credentials Transfer API carries considerably more than sign-in details. Alongside passwords and passkeys it defines types for addresses, payment cards, secure notes, TOTP two-factor codes, Wi-Fi credentials, SSH keys and custom fields. How much of that actually crosses over depends on what each pair of apps has implemented, so treat the full list as the ceiling rather than a guarantee.
One limit is worth being clear about: this is a peer-to-peer transfer between two apps on the same phone. It is not a cloud sync and not a way to push credentials to a different device.
Why Android 8 devices are included
A nine-year-old minimum version looks surprising for a 2026 security feature, and it is worth explaining. The transfer is not part of an Android platform release — it rides on Google Play services, which is updated independently of the OS. The Credential Exchange support landed in Google Play services v26.21 back in June 2026, with the release notes describing the ability to import and export passwords and passkeys between Google Password Manager and third-party managers. What arrived on 10 September is the consumer-facing experience switched on with launch partners, not the plumbing itself. Play services updates reach phones on a staggered basis, so the import option may take a few days to appear on any given handset.
The security model
Transfers use the FIDO Alliance's Credential Exchange Format (CXF), a published standard rather than a Google-specific scheme, which is why third-party managers can adopt it. Android's framework passes the vault through a secure content URI backed by a temporary cache file — vaults routinely exceed the roughly 1MB limit on direct app-to-app data passing — and verifies the receiving app before releasing anything. Raw credentials are not exposed to the operating system or to unauthenticated apps, and providers can require biometric authentication before an export proceeds.
Do this after you migrate
Verify before you delete. Sign in to two or three accounts from the new manager, including at least one passkey account, and confirm the credentials came across intact. Only then clear the old vault, and if you previously exported a CSV file during an earlier migration attempt, find and delete it — that file is still sitting in plain text wherever you saved it.
Android's security tooling has been getting more granular this year; see our coverage of Advanced Protection's temporary pause option and of the Google Wallet transit card change delivered via Play services.
Frequently Asked Questions
Can I move my passkeys to a different password manager on Android?
Yes. As of 10 September 2026, Android supports transferring passkeys along with passwords directly between credential managers. Both apps must support the feature; at launch that means Google Password Manager, 1Password, Bitwarden Password Manager and Dashlane. The transfer happens on the device and takes a few seconds.
Which Android version do I need for password manager transfers?
Android 8 or newer. The feature is delivered through Google Play services rather than an Android platform update, which is why such old releases are covered. Support for the Credential Exchange standard shipped in Google Play services v26.21 in June 2026, and the option appears once that update reaches your phone.
Do I still need to export a CSV file to switch password managers?
No, not between supported apps. The point of the new flow is that credentials move app-to-app without ever being written to an unencrypted file on your storage. If you exported a CSV during a previous migration, delete it — it remains readable plain text.
Does the transfer copy my credit cards, notes and 2FA codes too?
The Credentials Transfer API defines types for addresses, payment cards, secure notes, TOTP codes, Wi-Fi credentials, SSH keys and custom fields as well as passwords and passkeys. Whether each of those actually moves depends on what the two apps involved have implemented, so review the summary Android shows you before authorising.
Can I use this to send my passwords to another phone?
No. This is a peer-to-peer transfer between two apps installed on the same device. Moving credentials to a different phone still relies on your password manager’s own account sync.
