Setup guide · Last reviewed 10 November 2026

Moving off browser-saved passwords in one sitting

A practical migration from passwords saved in the browser to a real vault: export, import, the five accounts to change first, and the recovery plan nobody writes down.

A browser that offers to remember a password is convenient right up until you need that password on a different device, on a different browser, or after a profile reset. It also tends to store the same handful of reused passwords that show up in breach lists. Moving them into a dedicated vault is one of the highest-value half-hours in setting up a machine.

The difficult part is not picking a product. It is doing the migration without losing access to anything, and writing down what happens if you forget the master password. This guide is about the order of operations. Where we mention an audit or a review, it is named and linked rather than waved at as a badge.

Why browser storage is the thing to leave

Browser password storage is tied to a profile. It syncs only if you sign into that browser's sync service, it is awkward to share with one other person, and it rarely gives you a way to audit weak or reused entries. A dedicated vault is built around the opposite assumptions: encrypted at rest, portable between browsers, and able to tell you that a password has appeared in a breach.

There is also a mechanical problem. If you have been accepting 'remember this password' for three years, you do not know how many accounts you have. The export step below is the first time most people see the actual number, and it is usually larger than they expected.

• Export from the browser before you delete anything. A CSV on an encrypted volume is a backup; a deleted profile is not.
• Expect duplicates, old subdomains and accounts for services that no longer exist.
• Do not email the export to yourself. It is plaintext.

The tools this step calls for, with their real licence and platform details:

What a security audit actually tells you

Bitwarden publishes a dated index of third-party assessments. The earliest, a 2018 white-box review by Cure53, covered the core app, browser extension, desktop and web clients and the cryptographic design. It is worth reading the report rather than the headline: the auditors recorded eleven findings, initially rated three as critical, withdrew one after discussion with the maintainers, and left two in place. The same report praises the readability of the code and the speed of the team's responses.

That is what an audit looks like. It is a list of things to fix, not a certificate that nothing was ever wrong. What we take from it is the pattern: findings were disclosed, rated and addressed, and the exercise was repeated in later years. A vendor that publishes its reports gives you something to check; a vendor that only says 'independently audited' gives you a slogan. Wirecutter and PCMag have both written up the free tier in detail, and their reservations are mostly about interface polish and autofill behaviour rather than the cryptography.

• Prefer a dated list of reports to an undated claim that audits happen.
• Read the findings, not just the conclusion. A clean report with no findings is unusual; a report with fixed findings is normal.
• Publisher-hosted audit indexes are still publisher pages. Follow through to the report PDF where one exists.

The migration, in one sitting

Install the desktop app and the browser extension first, then create the vault with a master password you can actually type but did not use anywhere else. Export the browser's saved logins as a CSV, import it into the vault, and immediately delete the CSV from the unencrypted location. Do not close the browser's password manager yet.

Now change the five accounts that would hurt most: your primary email, your phone or cloud account, your bank, and the two services that hold payment details. Generate a fresh long password for each inside the vault. The reason for doing these first is that email is the recovery channel for almost everything else; if it still uses a reused password, the rest of the migration is decorative.

• Import before you disable browser autofill, so the two tools do not compete on the same login page.
• Change email first. It is the reset path for the other accounts.
• Turn on two-factor authentication for email and banking during the same sitting, while you still have both tools open.

The tools this step calls for, with their real licence and platform details:

The recovery problem nobody plans for

A vault with a forgotten master password is a locked box with no spare key, by design. That is the correct security behaviour and a genuine operational risk. Write down the recovery path before you need it: an emergency-access contact, a printed recovery code stored somewhere physical, or a separate offline vault for the handful of credentials that must survive a disaster.

Then test the boring parts. Sign out on a second device, sign back in, and confirm that a newly created login appears there. If you use an offline vault, copy the database to a second location and open it from there. A sync setup that has never been tested is a belief, not a backup.

The tools this step calls for, with their real licence and platform details:

Mistakes to avoid

• Creating a master password by varying a password you already use.
• Leaving the exported CSV on the Desktop because you meant to delete it later.
• Changing twenty low-value logins before changing the email account that resets them all.
• Enabling two-factor authentication without saving the recovery codes outside the vault itself.
• Assuming sync works because the app says it does, without signing in on a second device.

Questions people ask

Is a free password manager safe enough?

The distinction that matters is not free versus paid but whether the design is documented and reviewed. Look for published audits, a clear encryption model and an export path out. The paid tiers mostly add storage, sharing and reporting.

Can I keep using the browser's autofill too?

You can, but the two will compete on the same form. Turn off the browser's offer to save new passwords once the import is verified.

What if I forget the master password?

For most vaults there is no recovery. That is why the recovery plan is a step in the migration, not an afterthought: write down emergency access or recovery codes before you need them.

Should I self-host the vault?

Only if you are comfortable maintaining a server, its TLS certificates and its backups. For most people the operational risk outweighs the benefit.

Related guides

• New PC setup order
• Privacy-first setup
• Antivirus decision
• Browser privacy settings

Or see all guides and category explainers.

Sources and further reading

These are the published sources this guide leans on. We summarise the part that changes a decision rather than copying a review; see the full citation policy.

• Pentest Report: Bitwarden Password Manager 11.2018 ↗ — Cure53 · 2018 · Source code audit and penetration test. We cite this to make a point that a marketing page would leave out: an audit is a list of findings, not a certificate of perfection. What matters is what was found, how it was rated, and whether it was fixed.
• Compliance, Audits and Certifications ↗ — Bitwarden · Ongoing · Publisher's audit index. A dated list is more useful than the phrase 'regularly audited'. We use it to check whether the habit continued, and we link to it because the underlying reports are the evidence, not the claim.