Switching Password Managers in 2026

Published on September 7, 2026.

Important Note: Although I work at Apple in the password management and app/website authentication spaces, in this post I am speaking only for myself, personally. There is no “news” in this post or any kind of “inside scoop”. Please do share this post, but if I see “Apple’s Ricky Mondello” anywhere, I’ll be sad. My intention is to help people benefit from data portability and interoperability work I’ve personally participated in. Nobody should feel locked into their password manager. :)

Would you believe me if I told you that the best device to switch password managers on might be your iPhone or iPad? For many pairs (exporter and importer) of apps, it’s true! Here’s a simultaneously boring and exciting video of me exporting 100 items from 1Password and into Apple Passwords.

To export from 1Password’s iOS app, navigate to Items › Settings › Advanced › Start Export. After approving the export, an iOS system interface confirms the data transfer request with Face ID and has me select the destination app. I pick “Passwords” (Apple Passwords), confirm my selection, and then Passwords opens to import the data. The data that’s exported from 1Password and imported to Apple Passwords includes passwords, passkeys, verification codes, notes, and more. No data is deleted from 1Password as part of the export.

Apps that support this mechanism include Apple Passwords, 1Password, Bitwarden, Dashlane, DuckDuckGo, Devolutions, and more.

You might be wondering how a mobile operating system (of all places!) got data interoperability for password managers that’s easier, more secure, and more comprehensive than on desktop.[1] You can thank passkeys and the passkey community for this. (But wait — didn’t you read on X or Hacker News that passkeys are just a trojan horse for platform and password manager vendor lock-in? Weird!)

I gave a keynote at the Identiverse conference this last June that, in part, tells the story of how delivering data interoperability for passkeys necessitated a bunch of standardization and innovation that’s made the password manager interoperability story better for everyone. (Here’s a timestamped YouTube link to the relevant portion, starting at 24:48.)

Transcribed, the story:

Back in 2022, when passkeys were first made available on iPhone, one of the most important bits of feedback that the community gave Apple was: “Are these my credentials? My credentials that I can move between apps like passwords and a password manager? Or are they locked to wherever I initially saved them?” The answer to this was easy. Your credentials are yours to take and manage in whatever software you want, on whatever platform you want, whenever you want.

We just needed to figure out how to enable that in a phishing-resistant way. At the time, the state of the art for transferring credential data wasn’t great. I’m talking about manually exporting an unencrypted file and then importing it into another app. And I think you all know that was going to be a non-starter for passkeys because a threat actor could trick someone into exporting their data and then uploading it to them. That’s called phishing.

For data interoperability for passkeys to maintain their phishing-resistant promise and their ease of use, we were gonna need to work together and innovate as an entire community. And so, some folks within the FIDO Alliance started working on a concrete data format and requirements around transfer. In May of 2024, the first draft of the Credential Exchange format was published.

That format, which is now published as an open spec that anyone can read, covers not just passkeys, but all of the rich data that you’ll find in a modern credential management app. At Apple, we started building on top of that work. And as of iOS 26 and macOS 26 released last fall, passkeys are now securely transferable between credential manager apps on Apple’s platforms. And that’s through a first-class mechanism that was built specifically for those apps.

Here’s how it works. In the first app, you select the data that you want to export, and then you initiate a system export. In a secure, isolated, and out-of-process picker, you choose which of the registered other apps you want to transfer that data to. Then you Face ID, and you’re done. The data is transferred directly between the two apps that you have trust of, without any intermediate files being created.

Then What?

A data transfer starting on an iPhone or iPad is genuinely a fantastic start, but I recommend thinking about switching password managers as a process. You can use the relatively rare and potentially disruptive event of switching password managers as a reason to clean house a bit. Back in September of 2024, I wrote a piece titled “Consider Slowing Down When Switching Password Managers” about this, but I’m going to summarize and update my advice in this post so you don’t have to go back and read that one.

My tips:

  1. If you’re fortunate enough to be able to, upgrading your phone is a great time to switch password managers! Many apps will, annoyingly, make you re-sign in. You can use that as an opportunity to stress test your new setup. You might also be in a mood to rearrange your apps, refresh your settings, and generally tidy up. I recommend you:
    1. Do your bulk transfer from your old app to your new app on your existing device, as described above, before you get your new device.
    2. Going forward, treat your new app as the source of truth for your information, and only consult the old app if something goes wrong. Do not spend time updating or deleting information from the old app; it’s only there as a safety net. Don’t try to keep multiple password managers in sync; with today’s technology, that’s folly.
    3. On your existing device, turn on AutoFill for your new app and turn off AutoFill for your old app. You’ll have a much better experience if you’re not having nearly identical suggestions duplicated from two apps.
    4. When you get your new device, let iOS copy your content and settings from your existing phone to your new one. Whether you do that or not, check to ensure that your data transferred in both your new and old apps, and then ensure AutoFill is only enabled for your new app.
  2. Wait as long as you can[2] to delete the exporting app and its contained data, which now serves as a backup. Although the data interoperability standard smooths over incompatibilities, software is still software. Deleting your old app could feel good, but you’re throwing away an important backup. Do stop paying for your old app whenever you’re able to, but don’t delete your account. Again, safety net.
  3. If you have time, visit the apps and websites that you have credentials saved for and log in to check if your account is still in good standing. If your password has any security issues, generate and save a new strong password, and then see if you can enable a passkey, or failing that, a verification code generator. You’ll sometimes learn that a website doesn’t exist anymore!

If You’re Switching to Apple Passwords

Here are a few things you might want to know:

  1. The Passwords app gets bug fixes, enhancements, and new features with Apple OS releases, so try to run the latest versions of those operating systems to make sure you’re not missing out. If you haven’t updated to macOS Tahoe yet, macOS Golden Gate’s Passwords app is a pretty big leap forward from version 1.x on macOS Sequoia!
  2. The app supports shared groups (like, a shared folder) and has password histories. The app does not support custom fields, although there is a single notes field on every item.
  3. When adding something new to Passwords, both a user name and password are optional. You can have an item that’s just a title and a note! For richer secure notes, Apple’s Notes app is great.
  4. The Mac app has a menu extra that can be enabled in the app’s settings. It’s handy!
  5. The Mac app supports AutoFill in non-Safari browsers with the iCloud Passwords browser extension. In the app’s “Passwords” menu, select “Get Browser Extension…” to see a list of your installed browsers with links to install the extension in that browser. (Fun fact: the data that powers this view is an open source JSON file.)
  6. The app has a Security tab that tells you about passwords that are weak, reused, or have appeared in a data leak. It’s similar to 1Password’s Watchtower feature, but is powered by an Apple service.
  7. Apple Passwords is available on Windows by installing iCloud for Windows. This link is also in the Help menu of the Mac and iPad apps.
  8. The Passwords app unlocks using Face ID, Touch ID, or your device passcode or Mac login password. You cannot set a different “master” password.
  9. Exporting your data from Apple Passwords works completely offline using the data present on your device. You don’t have to be signed in to an Apple Account.

About Values

I genuinely don’t care a lot about what password manager people use[3], but it’s important to me personally that people have ownership of their data and never feel locked into software. The now-legacy password manager data portability experience served as a user experience moat around software and was a non-starter for both passkeys and everyday computer users.

At a FIDO Alliance meeting in May of 2023, when folks from 1Password and Dashlane were demonstrating a proof of concept for transferring credential data from one app to another, I recommended breaking the data format and transport layers into two different work items, and my recommendation was adopted. The data format became the Credential Exchange Format, which is transformed into Swift structs for strongly-typed and versioned data interoperability on iOS, iPadOS, and macOS. I’m happy with how a collaboration on a data portability standard married nicely with an operating system capability, and it makes me happy to be able to directly contribute to work that aligns with my values.

1Password’s recent investment in the Omarchy Linux distribution, created by the outspoken and dangerous David Heinemeier Hansson, and the subsequent industry conversation, inspired me to “fast”-track publishing updated advice on switching password managers. This investment was justifiably criticized by many, including employees of 1Password. I feel for those employees because it’s a terrible feeling when the impact of your work is diminished by actions you had no say in and can’t control.

In this moment, where we’re globally reckoning with the influence of regressive ideas, organized far-right extremists, and the bottomless pockets of the ultra-wealthy, many people appreciated the ability to express their disappointment and freely move their data between password manager apps. Technology is not and has never been morally neutral or exempt from moral consideration.

  1. This OS-facilitated secure data transfer capability exists on macOS, and Apple Passwords supports it. 1Password and some other apps haven’t adopted it there yet.  ↩

  2. I personally switched away from 1Password and to Apple Passwords about ten years ago, but I still have an old copy of 1Password running on one of my Macs. I admit that this may have been easier to do before the advent of subscription software!  ↩

  3. You know, as long as it has a good track-record of responding to security issues.  ↩

How I’m Doing at the End of 2025

Published on December 30, 2025.

I am in the process of updating my résumé. Not because I’m looking for a job[1], but because I like to feature my résumé on my website and the current published copy doesn’t reflect my pivot from engineering management to an individual contributor role two years ago. I feel a little bit weird about the misrepresentation, and would rather update the document than take it down. While working on some edits, I was reflecting on how things have been going, and decided to write this “what’s been happening” post as my productive procrastination.

Caretaking

Two years ago, I wrote:

I’m living with my mom in upstate New York, somewhere between Poughkeepsie, NY and Danbury, CT. My mom has several health conditions, including chronic pain and memory impairment, that my sister and I have been helping her manage.

All of this is still the case, but it’s gotten progressively more difficult. Summoning the patience and grace, every day, to show up for someone else who is almost always in pain and is regularly in need of help navigating tasks involving any kind of bureaucracy — it’s hard. To tell you the truth, it’s been really hard. And before you ask, in my experience, it’s harder to find in-home help that actually helps than to shoulder this myself, if that makes sense. Especially in a rural area.

I don’t have much of a community or much in terms of friends where I live. In-person dating also isn’t viable here. I haven’t moved me and my mom closer to friends I have down in the city because her home is familiar to her and she says she’s comfortable here and doesn’t want to move. This is negotiable, but the thought of project managing a move is just too much for me to handle given my regular responsibilities. There’s also no other family besides me and my sister.

The way that I relieve the stress from my caretaking role is to travel to see friends domestically and visit new places internationally as often as I reasonably can. When I travel, my sister, who lives about a half hour away, steps in to take care of things with my mom. That’s hard on her, because as I know full well from doing it for a decade, caretaking is harder without having passive eyes and ears on the person being helped; phone calls and visits reveal less of the ground truth.

But my travels are fun! And travel is especially nice because I no longer use nearly all of my vacation time visiting home, and because I’m lucky enough to travel for work sometimes. This last year I was able to visit Australia, New Zealand, Türkiye, Japan, the SF Bay Area, Seattle, Denver, and Boston.

Putting this together, it feels like I’m living my life in a cycle. I spend a few weeks or months in upstate New York keeping everything on the rails at home while working my sometimes also stressful full-time software engineering job; and then I go somewhere else and feel like a young, vibrant person at the top of my game — funnier, hotter, and smarter than I’ve ever been at any other point in my life; until the point where isolating upstate for a couple of weeks sounds kind of nice.

The balance is very far from perfect, and I know I’ve made it sound difficult in this post, but I am profoundly grateful and happy that I’m able to be here for my mom. She doesn’t deserve her chronic illness. (In fact, nobody deserves chronic illness, and seeing the way that society treats the chronically ill first-hand has been one of the most impactful experiences in my life). She’s a sweetheart, I love her dearly, and being able to be here is meaningful to me. It’s just hard.

Oh, and don’t worry — I have a therapist, and they’re great. :)

Zepbound

I started taking Zepbound earlier this year, and it’s been one of the best things to happen to me in my entire life. With the help of this medication, the constant preoccupation with food I’ve felt my entire life is under control. If you’ve known me for a while, you’ve seen my body change in shape over time as I’ve oscillated between my “regular” state and a way of living where I was managing the stress-eating that I’m prone to at the cost of a wild amount of willpower — almost a singular focus of my being alive. This medication is helping me with my relationship with food more than anything else I’ve tried and I tolerate it extremely well.

Despite all of the bullshit shame that society wants us to feel around needing help with food, I am so happy to talk about this. My primary reason for starting the medication was to address some early signs of potential health issues my doctor and I could see on the horizon. My goal wasn’t and isn’t a target weight or appearance. Instead, it’s to consistently measure some better health markers. I’m happy to say that I’ve started hitting some of those goals!

My employer is paying for most of this very expensive medication, and I’m really happy about that. Early this year I was ready to start paying for it out of pocket ($1000+ a month, ~$500 with coupons), but I figured I’d check with my insurance one last time before ponying up, and it turns out, in 2025, my employer started offering a relevant benefit to employees. After going through a 90 day online course that coaches you through healthy eating, sustainable exercise, and habit building, you’re a candidate for medication like Zepbound.

I was legitimately devastated to have to wait another 90 days to try out this new-to-me form of help after a lifetime of being coached on healthy eating, sustainable exercise, and habit building. And the gatekeeping of it all is legitimately offensive to me. But no matter how devastated or offended I felt, I figured it’d be worth going through the program if I could potentially save hundreds of dollars a month on a medication that, other than the cost, I have no reservations about being on for the rest of my life. With my insurance, I pay roughly $25 a month.

(An aside: If you would benefit from getting help in this area of life, and your health insurance is provided by your employer, and you aren’t your own employer, and your insurance doesn’t cover it, keep checking to see if coverage has changed. I also recommend sending a quarterly letter to your employer’s benefits department making a case for coverage. I also wouldn’t blame anyone for leaving a job ever, but especially for leaving to get coverage on a life-changing medication. And if you work where I work, hit me up if you have questions or want details about the program.)

Career

The last two years have been good for correcting something important: making the work I do in the tech industry matter less to me, compared to other aspects of my life, than it used to. Living with and helping to take care of my mom has helped foster a sense of perspective I was struggling to grow by myself in California[2].

And yet, and I think this is a good thing overall, my work in tech still matters to me and motivates me. I surprised myself earlier this year when I finally accepted a standing invitation to speak at the FIDO Alliance’s “Authenticate” conference and started the difficult work of putting together a story, finding my emotional center around that story, and iterating on how I told that story with the help of my colleagues until it was a story I was excited to tell.

Said more directly, putting a good conference talk together is a shit-ton of work. I was asking myself, “Who is this Ricky? Am I happy that they’re back?” And during the more busy moments with the rest of my day job and the tougher moments of taking care of my mom, I was very seriously cursing myself. A feeling I find to be unpleasant, but also useful and validating, is when I have enough presence of mind to recognize that I’ve stretched myself too thin, and that some part of my life is merely getting the best I can give it right now and not what I wish I could give it right now. (What’s much worse than this feeling is to lose myself enough that I don’t even realize I’m letting people down!)

Fortunately, even I have convinced myself that the talk was good and worth doing. An ongoing project for me right now is iterating on the value proposition of passkeys by collecting and distilling feedback, advocating for changes internally where I work, and talking to my industry colleagues inside and outside of standards to address problems. This is challenging because although I deeply believe in passkeys, I cannot immediately effect change on the many websites, apps, and other passkey managers that make up the overall global experience of and sentiment around them. Despite any and all criticisms people have about passkeys, I am stunned by how well the industry transition away from passwords and to passkeys is going. The momentum is wildly outpacing my expectations.

Outside of passkeys, in 2025, I was really proud of the work my team did to polish the Passwords app after its 1.0, and I figured out how to bring two features to the world that I love because they’ll save people time and maybe make them smile. The first was to offer AutoFill of security codes contained in the contents of app push notifications, including apps like Gmail and WhatsApp, in iOS 26. The second was to offer AutoFill of security codes in all apps on macOS 26, including web browsers. The engineering on this last one was wild, and it wasn’t without complications at launch, but we got ‘em cleaned up, and now more people than ever can use their brains to do things other than manually type six digit codes.

:)

If you read this far, it probably means that you have supported or are supporting me in some way in my life, and I appreciate that! If we’re friend friends and we haven’t chatted in a while, reach out! And if we’re not, please do take me up on meeting up when I toot or skeet that I’m visiting near where you live. Please be kind to yourself, happy holidays, and happy new year!

  1. I’m not looking for a job! I’m happy with my role where I work right now. That said, everyone has a specific combination of both a price and a conscience. My hands aren’t perfectly clean, but I can live with a software job that resolves around saving people time, frustration, and some of the pain of having their online accounts compromised.  ↩

  2. This had a lot to do with the fact that the sole reason I was living in the bay area was for my career.  ↩

Authenticate Conference 2025 Keynote: Get the Most Out of Passkeys

Published on November 7, 2025.

I gave an opening keynote at the FIDO Alliance’s “Authenticate” conference a few weeks ago! Although it featured timely strategies and tips for professionals deploying passkeys, my primary goal was to explain, as clearly as I can, why passkeys are important and how we should use them to reduce the harm that passwords cause.

[ YouTube link ]

I’m really proud of this talk and I hope you’ll watch it and share it with others. I put care in to making it approachable while still delivering my perspective and insights to security professionals. If you don’t get the “why” behind passkeys, this talk will help fill that gap.