Important Note: Although I work at Apple and am deeply involved in the creation of its new Passwords app, in this post I am speaking only for myself and not for Apple. There is no “news” in this post, or any kind of “inside scoop”. My intention is to help the kind of person who would read a blog post about password managers think about and manage their credential data better.
You may find yourself wanting to move your passwords and verification codes to Apple’s new Passwords app from whatever app you’re using right now. If so, awesome! (And you have great taste!)
In this post I’ll discuss two different strategies for doing this: The Bulk Import Method and The Online Method. The Bulk Import Method involves exporting your data from your current password manager and importing it into Passwords, whereas The Online Method involves moving credentials over one-at-a-time by signing in to their associated accounts, cleaning up your collection in the process.
As you read through this post, I challenge you to consider slowing down when moving your data. Rather than expect the process to take ten minutes, use the once-every-ten-years event of switching password managers as an opportunity to scrub your data, create some passkeys, enable two-factor authentication, and touch base with old websites and apps that might have something to offer you. By using this process, you’ll have a clean start with your beautiful new app, prove to yourself that all of your data made it over, and expedite the process of actually, finally, for real, ditching your old password manager.
Okay, let’s define and discuss the two methods.
The Bulk Import Method
As of the publish date of this post (September 2024), it is only possible to do a bulk move of your data with a Mac. It is relatively uncommon for password managers for iOS and iPadOS to offer exporting and importing functionality. Although it’s possible to import your passwords into Apple Passwords from Safari or the Passwords pane in System Settings prior to macOS Sequoia, I strongly recommend doing it from the Passwords app on macOS Sequoia, because its importer is more robust than the one in older versions of macOS.
The Bulk Import Method is ideal when Passwords is not currently the canonical home of any of your data, but you want it to become that single source of truth. Why? Because if there is no data in the Passwords app, importing (and verifying) new data will go more smoothly. Consider this: if you don’t know, across multiple password managers, which of your entries is current and which are old-and-busted, you can’t really expect today’s software to know that for you. The messier your data, the more you should consider augmenting The Bulk Import Method with The Online Method.
Either way, I recommend starting clean in Passwords. Removing old, non-canonical entries will allow the import to go more smoothly. The Passwords app has a “Recently Deleted” section, so it’s always safe to delete something in the app.
In the Passwords app, you can trigger an import from the File menu › Import Passwords…
The software will ask you to provide a CSV file containing your passwords exported from your current app. Treat that plaintext CSV file of your data like a hot potato or contamination that you need to clean up! It has all your passwords in it! For you, being safe may involve not saving it to a cloud filesystem, putting it in a place where backup software won’t capture it, and deleting it as soon as you’re done with it.
The Passwords app may tell you that it could not import some of your data. If this happens, it’ll offer guidance for dealing with data that conflicts with data Passwords already has saved, and it’ll tell you when some entries weren’t able to be imported because the shape of the data didn’t fit with what Passwords supports.
If you’re like me, after you’ve imported your data, you’ll say to yourself, “That’s it? I’m done?” You’ll relax for a moment, and suddenly blurt out, “Wait, how do I know that all of my data correctly made it over? I guess I’ll have to keep my old password manager around forever, just in case?”
Good news! Applying The Online Method can give you the confidence to ditch the old app forever.
The Online Method
With or without a Mac, there is a straightforward but time-consuming way to move your data that will give you 100% confidence that you’ve moved it all over. I call it The Online Method because it encourages you to touch base with (read: sign in to) every online service you have an account saved for. The “algorithm” for this method, is, roughly:
- for each credential entry in your current password manager with a website:
- sign in to that website with the assistance of your current password manager
- accept Passwords’ offer to save your user name and password
- if you have a time-based one-time password or TOTP (a rotating verification code like you’d see in Google Authenticator) attached to the account:
- visit the security settings for the website
- turn off the current time-based one-time password enrollment
- set up a new time-based one-time password:
- if offered a QR code to scan with your phone, first try to right-click or tap and hold on it; in many cases you’ll be offered an option to “Set up Verification Code” or “Add Verification Code in Passwords”
- critical: sign out of the website and then sign back in, only with the assistance of AutoFill from the Passwords app, ensuring that your next sign-in experience will be effortless
- optional but recommended: fix up your account security while you’re there
- if your password is one that you created — that is, if it has any kind of emotional significance or human-readable pattern in it — upgrade it to a strong password
- create/add a passkey to your account, if the website offers it
- turn on “two-factor” or “multi-factor” authentication for the account; see the tip above for the easiest experience when setting up verification codes in Apple Passwords
- if the online service does not exist anymore:
- choose whether to delete or keep your old credentials; I recommend not being precious about them; if by some miracle the defunct service comes back, you’ll almost certainly be able to reset your account via your email address
- for each credential entry in your current password manager without a website:
- manually add the information to Passwords (the Passwords app accepts entries without websites)
- for each non-credential entry in your current password manager:
- find a home for it in Passwords or a password-protected note in Apple Notes
Benefits of The Online Method
- When you’re done, your collection of credentials will all be for valid accounts that you care about, eliminating that “wild west” or “junk drawer” feeling in your collection. Given that we live so much of our lives online, a clean password manager can be the difference between logging in to get the tickets and buying them aftermarket.
- If you go on the optional and recommended side quest, your accounts will have a better security posture!
- This one’s a little goofy and sentimental, but I mean it: you may remind yourself about things you care about or once cared about. If you’re like me, you’ll feel wistful when re-visiting the outposts of your online life.
The Online Method is almost Marie Kondo-like; you touch each of your saved items and ask yourself, “Does this spark joy?”
You Can Combine Both Methods
If you bulk-import your passwords, you can then clean them up using The Online Method. You’ll use the steps above, but now the “your current password manager” referenced in the first line is Apple Passwords. This can save you a lot of time while still delivering the benefits of slowing down.
I know, I know. I wrote an entire post advocating for manually doing work when there’s a more automatic, less involved alternative available. You might think I’m encouraging you to defrag your password manager. And if you’re not convinced, that’s totally okay! But I’ve found that there’s a special feeling that comes from knowing that any one of my mission critical systems is clean.
Anyway, I hope you found this post helpful! Take care, and enjoy the Passwords app!