You have 200 passwords saved in Chrome, and you have finally decided to do the responsible thing: move them into a real password manager. The good news is that Chrome lets you export everything in one shot, and every major password manager imports that file in minutes. The bad news is that the export is an unencrypted spreadsheet of all your passwords in plain text — handle it carelessly for five minutes and you have created the exact security disaster you were trying to prevent. Here is the safe way to do the whole migration.
Step 1: Export From Chrome (Carefully)
On a computer you trust (not a shared or public machine), open Chrome and go to Settings, Autofill and passwords, Google Password Manager. Click Settings on the left, then “Export passwords.” Chrome will ask for your computer’s login credentials — this is a security gate, not a formality — then save a CSV file, typically named “Chrome Passwords.csv,” to your downloads folder.
Understand what you now hold: every saved username and password, in readable plain text, in a single file. Anyone who opens that file owns your digital life. Do not email it to yourself, do not upload it to cloud storage, do not leave it in Downloads. The entire rest of this guide is about minimizing the minutes this file exists.
Step 2: Choose Your Password Manager
If you have not picked one: Bitwarden is free, open-source, and excellent — the default recommendation for most people. 1Password is the premium pick with the best user experience and family features (~$3/month). Apple’s Passwords app (built into current Apple devices) and Google Password Manager are fine free options if you live entirely in one ecosystem. All of them import Chrome CSVs, and all of them offer browser extensions plus mobile apps so your passwords follow you everywhere.
Create your account and — critically — set a strong, unique master password that you memorize (or write on paper stored safely). This single password protects everything; make it a long passphrase you have never used anywhere, ideally five or more random words strung together. Enable two-factor authentication on the password manager account immediately, before importing anything — the vault holding all your passwords deserves the strongest lock you have.
Step 3: Import the CSV
In your new password manager, find the Import option: Bitwarden — web vault, Tools, Import, select “Chrome (csv)”; 1Password — File, Import, Chrome CSV; Apple Passwords — File, Import from File. Select your Chrome Passwords.csv and run the import. A few hundred logins import in seconds.
Immediately after a successful import, verify: spot-check a dozen entries (especially banking and email) to confirm usernames, passwords, and URLs transferred correctly. Check the import count against Chrome’s saved-password count — a mismatch means something did not transfer, and catching it now beats discovering a missing login during an urgent sign-in later. Only when you are satisfied the import is complete do you move to the next step.
Step 4: Securely Delete the CSV (Do Not Skip)
This is the step people skip, and it is the most important one. Delete the CSV file, then empty the trash/recycle bin. On Windows, go further: the file’s data still lingers on disk — run cipher /w: on the folder to overwrite free space, or use your password manager’s own guidance. On a Mac with FileVault encryption enabled (default on modern Macs), emptying the trash is sufficient since the underlying storage is encrypted.
Also check: did your browser auto-upload Downloads to Google Drive, iCloud, or Dropbox? Did you email the file to yourself “temporarily”? Hunt down every copy — cloud sync, email attachments, USB sticks — and delete them all. The goal is zero plaintext copies of your passwords existing anywhere by the end of this step.
Step 5: Clean Up and Lock Down Chrome
Now decide Chrome’s role. Best practice: stop saving new passwords in Chrome (Settings, Autofill and passwords — turn off “Offer to save passwords”) and let the password manager handle everything via its browser extension. Install the manager’s extension in Chrome and any other browsers you use.
Then delete the saved passwords from Chrome itself: Google Password Manager, Settings, “Delete all data” — this removes the cloud copy Google held. Consider the tradeoff honestly: Chrome’s built-in manager is convenient and reasonably secure, but a dedicated manager gives you cross-browser portability, security audits, and features like breach alerts. Google’s password manager help pages document the export and deletion options.
Step 6: Audit What You Imported
Your new password manager can now do something Chrome never did well: audit. Run its security report (Bitwarden: Reports; 1Password: Watchtower) to find reused passwords, weak passwords, and credentials exposed in known breaches. Work through the critical accounts first — email, banking, primary social media — generating new unique passwords for each.
This audit is the real payoff of the migration. Most people discover they reused one password across 40+ sites. Fix the important ones this week; chip away at the rest over the month. The CISA password guidance confirms: unique passwords per site plus a manager is the single biggest account-security upgrade most people can make.
Export from Chrome’s Password Manager settings to a CSV, import it into Bitwarden or 1Password immediately, verify the entries transferred, then securely delete every copy of the CSV — it is your entire digital life in plain text. Finish by auditing for reused passwords and turning off Chrome’s password saving.
Conclusion
Moving passwords from Chrome to a password manager takes twenty minutes: export the CSV on a trusted computer, import into your chosen manager, verify, then destroy every copy of that plaintext file like it matters — because it does. The migration’s true value comes after: unique passwords everywhere, breach alerts, and never reusing a password again. For more security upgrades, explore our technology guides, meet the team, or ask us your password questions.
Frequently Asked Questions
Is the Chrome CSV export really unencrypted?
Yes — it is a plain-text spreadsheet readable by anyone who opens it. That is why speed matters: export, import, and securely delete in one sitting, on a trusted computer, without emailing or cloud-uploading the file.
Which password manager should I choose?
Bitwarden (free, open-source) for most people; 1Password (~$3/month) for the best experience and family sharing; Apple Passwords or Google Password Manager if you are fully committed to one ecosystem and want zero cost and zero setup.
Will my passwords still autofill in Chrome?
Yes — install your password manager’s Chrome extension, and it autofills logins just like Chrome did, across all your browsers and devices. Disable Chrome’s own password saving to avoid confusion between the two.
What if the import misses some passwords?
Compare counts between Chrome and the new manager. Common gaps: passwords saved on other Chrome profiles or devices that had not synced. Sign into Chrome on each device, let sync complete, then re-export — or export from each profile separately.
Should I delete passwords from Chrome after migrating?
Yes, once the import is verified. Keeping them in Chrome maintains a second copy outside your manager’s protection (and its audit features). Use “Delete all data” in Google Password Manager settings after you are confident in the new setup.










