Migrating from browser-saved passwords to a dedicated manager

Most people who switch to a dedicated password manager are switching from browser storage, not from another password manager. Chrome, Firefox, Safari, and Edge all have credential storage with autofill and sync. The migration path is technically straightforward — export from the browser, import to the manager — but there are specific steps that matter and one failure mode that trips up many users: the browser and the password manager extension both try to save new credentials, creating duplicate entries and autofill conflicts.

The important preparation step before migrating is understanding that you need to turn off browser password saving after completing the import. Leaving both systems active creates a split-brain situation where some credentials are in the browser, some in the manager, and new credentials may go to either place without consistency.

The migration itself is a one-time process that takes under an hour for most users. The post-migration discipline — consistently using the manager extension for autofill, not the browser's suggestion — is what determines whether the migration actually changes your security posture.

The assumption 'my browser passwords are already secure because they are encrypted' misunderstands browser password storage. Chrome encrypts stored passwords using the OS keychain (Windows Credential Manager, macOS Keychain, GNOME Keyring on Linux). This protects against someone reading the credential file directly. It does not protect against malware running in user context, which can access the OS keychain using the same mechanism the browser does. Dedicated password managers with a separate master password add an additional authentication layer that browser storage doesn't have.

A second assumption is that the browser password export includes everything — all your saved credentials across all sites. Browser exports typically include the site URL, username, and password. They do not include secure notes, payment card information, or other credential types. These don't exist in browser storage; a password manager stores them alongside passwords.

A third assumption is that turning off browser password saving will break something. It changes the autofill workflow — the browser will stop offering to save new passwords and will stop autofilling saved ones. The password manager extension takes over both functions. The transition is invisible in practice if the extension is properly installed and active.

Export process per browser: Chrome — Settings > Passwords > (three-dot menu) > Export Passwords. Firefox — about:logins > (menu icon) > Export Logins. Safari — Settings > Passwords > (three-dot menu) > Export All Passwords (requires macOS Ventura+). Edge — Settings > Passwords > (three-dot menu) > Export Passwords. Each creates a CSV file with URL, username, and password fields.

After export: import the CSV in your chosen password manager (most have a direct browser-source import option). Review the import count against the number of credentials you expect. Test autofill on your most-used sites. Then: turn off browser password saving (Settings > Autofill > Passwords > toggle off 'Save Passwords'), and remove the saved passwords from the browser after confirming the manager has them.

The CSV export file is the most sensitive part of this process. It contains all your passwords in plaintext. Keep it only for the duration of the import, delete it from your downloads folder and any locations where it may have auto-backed up (iCloud Desktop sync, Google Drive Backup and Sync, OneDrive Documents), and empty the trash after deletion.

Browser export formats change with browser updates. The menu paths described here reflect the current UI as of 2024; specific steps may differ in future browser versions. If these paths don't match your browser version, search within browser settings for 'export passwords.'