Android Passkey Transfer Ends the Unencrypted CSV Export

What Google Shipped on September 10

Android now has a system-level way to move passwords and passkeys from one password manager to another. Google announced the feature on September 10, and it closes a gap that has quietly been one of the worst security trade-offs in consumer identity: to leave a password manager, you had to export everything into a plaintext file first.

• Passwords and passkeys transfer directly between apps, with no file written to the device
• Works on every device running Android 8 or above
• Four managers at launch: Google Password Manager, 1Password, Bitwarden and Dashlane
• Other providers can join by supporting Credential Manager's Credentials Transfer API, with Google saying more partners will follow

The flow is short. You open the manager you are moving to, choose import, and Android detects the other credential managers installed on the device and shows you which ones you can pull from. You approve the transfer in the source app, review what is coming across, and the handoff completes in seconds.

Why the Old Export Was the Weak Link

Think about what the previous process actually produced. Every password you own, in cleartext, in a file sitting in the device's Downloads folder — created at exactly the moment a user is distracted by migrating apps, and very often never deleted afterwards.

That file is one of the highest-value artefacts an infostealer can find, and it requires no exploit to read. The malware does not need to break a vault or defeat a master password; it needs to find a document that the user was instructed to create by the migration process itself. Removing the file removes the window, and that is the entire security argument here.

Passkeys had the opposite problem: no export path at all. Because a passkey is a private key bound to the device and the credential manager, switching providers meant re-registering manually on every site and app you use — which, realistically, meant most people did not switch, or worse, kept passwords around as a fallback precisely so they would not have to. Lock-in that pushes users back toward weaker credentials is a security problem wearing a product-design costume.

Does This Change How You Should Manage Credentials?

For most people it removes an excuse rather than adding a task. If you have been putting off a move to a manager you trust more, or off passkeys entirely because you did not want to be stuck, the friction that justified waiting is gone on Android.

Two practical notes. The transfer is user-initiated and requires explicit approval in the source app, so it is not a background sync you need to audit — but that also means an attacker with an unlocked device and your attention elsewhere is the threat model worth thinking about, and device lock hygiene still does the heavy lifting. And if your manager is not one of the four launch partners, the API is the thing to ask them about.

The wider trend is portability arriving late but arriving. Passkeys have spent the year growing multi-device and multi-account features — WhatsApp took its passkeys multi-device for a billion users last month — and credential standards are consolidating in the same direction, as with the ORKS open standard for revocable API keys. Portable credentials are only genuinely portable when leaving is as safe as arriving. More defensive coverage in our AI security section.

Sources: Google Blog — September 10, 2026; Help Net Security — September 10, 2026; TechCrunch — September 10, 2026.