Start with the export, not the destination
A password-manager migration usually goes wrong at the same point: the temporary file. Chrome can move credentials through a CSV file, and that file is readable plain text. Before you choose a new manager, decide how the export will be created, stored, used and destroyed.
Chrome imports password records from CSV files with URL, username and password columns, and offers export from Google Password Manager settings. Source
That CSV is not a backup to keep. It is a transport file with a short life. Treat every minute it exists as exposure time.
An exported password file can be read by someone with access to that file. Source
Step 1: Decide whether you need a full export
A full export is the fastest way to move every saved login, but it is also the largest exposure. If you only need a handful of accounts, consider moving those individually. A full CSV is justified when you are changing managers completely or consolidating scattered records.
| Situation | Sensible approach | Main risk |
|---|---|---|
| Moving to a new password manager | Full CSV export, imported promptly, then deleted | The CSV sits in Downloads or cloud sync |
| Updating a few logins | Manual entry or per-account update | Typos and missed accounts |
| Cleaning up forgotten accounts | Review accounts first, then export only what you need | Exporting more than necessary |
| Sharing a device with others | Export only when alone, delete immediately | Another user opens the file |
If your goal is to find accounts you no longer use, start with the account-review workflow in Find Forgotten Online Accounts before you export anything. A smaller inventory means a smaller CSV.
Step 2: Prepare a controlled export location
Choose a folder only you can access. Avoid shared family folders, synced desktop folders and anything that automatically uploads to a cloud drive. If your Downloads folder syncs, pick a local folder instead.
Before exporting, close screen-sharing sessions and check that no one else is using the device. The export itself is quick; the handling afterward is what matters.
Step 3: Export from Google Password Manager
Chrome offers export from Google Password Manager settings. The exact menu labels can change, so navigate to the password manager settings and look for the export option rather than relying on a remembered path.
When the CSV appears, move it immediately to your controlled folder. Do not rename it to something that looks harmless and leave it on the desktop. Do not email it to yourself as a backup.
Step 4: Import promptly and verify
Open your destination password manager and use its import function. Chrome-style CSV files use URL, username and password columns, which most managers can map. Check a sample of entries after import: one social account, one email account and one financial login are enough to confirm the mapping worked.
If the import fails, fix the mapping and retry. Do not keep multiple copies of the CSV while you troubleshoot.
Step 5: Delete the CSV and clear traces
Google Password Manager import instructions say to delete the CSV password file after importing it. Do that as soon as the import is verified.
Google Password Manager import instructions say to delete the CSV password file after importing it. Source
Deleting the file is the minimum. Also empty the trash or recycle bin, and check whether your operating system keeps recent-file lists that point to the deleted file. If the CSV was ever synced to a cloud folder, delete it there as well and confirm the deletion in the cloud service.
Step 6: Check what the export revealed
An export is also an inventory. It shows which sites still hold a saved password, including accounts you forgot. Review the list for services you no longer use and for duplicate entries. This is the moment to close old accounts rather than carry them into the new manager.
A username search is not a complete account inventory, and public matches are leads rather than proof of ownership. If you want to review public handles associated with an old username, a tool such as TraceSeek can check 3,000+ platforms; its free first scan requires no registration or login, and the product states a scan time of 20-30 seconds. Use it to organize a review list, not as a substitute for your exported records.
Common mistakes
- Leaving the CSV in Downloads. Downloads is one of the first places someone looks on a shared or stolen device.
- Keeping the CSV as a backup. A plain-text password file is not a safe backup. The destination manager is the copy you keep.
- Importing into a cloud-synced folder. The file may be uploaded before you delete it locally.
- Deleting the CSV before verifying the import. Confirm the new manager works before you destroy the transport file.
- Assuming deletion ends the story. An edited or empty profile does not establish deletion of stored data, and removing a login connection is not account deletion.
- Uploading the CSV to a scanner. Never send a password export to a third-party checker. No legitimate review of your public footprint requires your credentials.
Protecting your own footprint after the migration
Once the CSV is gone, the remaining work is about the accounts themselves. Keep a recovery method you control until each closure is completed. Do not delete recovery email addresses or phone numbers before the account is fully closed, and do not rely on an inaccessible throwaway address.
Review public handles that may still point to old usernames. Matching photos, biographies and handles cannot independently prove identity, so treat any match as a lead to verify through the platform itself. The goal is a smaller, better-understood set of accounts, not a perfect map of everything online.
Key facts
Chrome imports password records from CSV files with URL, username and password columns, and offers export from Google Password Manager settings.
An exported password file can be read by someone with access to that file.
Google Password Manager import instructions say to delete the CSV password file after importing it.
TraceSeek covers 3,000+ platforms, and its free first scan requires no registration or login.