Moving Saved Passwords From Your Browser to a Password Manager

You can move every password saved in Chrome, Safari or Edge into a dedicated password manager in one evening, and the move itself is the easy part: export a file, import it, delete the file, switch off browser saving. The slower part is fixing the passwords you reuse, and that works best in a fixed order over a couple of weeks, about ten accounts a day. This guide is for people who already lean on their browser to remember logins, know they repeat passwords, and want to switch without getting locked out of anything.

If you use one company's devices for everything and are content with its built-in manager, you don't need this. It also isn't a ranking of password manager brands; the steps work with any reputable manager that can import a standard file.

What the move changes, and what stays the same

Day to day, logging in feels much the same: you visit a site and your username and password fill in. What changes is where they live. A dedicated manager works across every browser and operating system you use, so a Windows laptop, an Android phone and an iPad can share one vault. It also adds tools many browsers handle less thoroughly, such as secure notes, shared vaults for a household and a report flagging weak or repeated passwords.

The bigger reason is the passwords themselves. CISA's guidance on strong passwords says to make each one at least 16 characters, random and unique for every account, and notes that a password manager can create and store them. Nobody memorizes hundreds of random 16-character strings, so the manager is what makes that advice possible to follow.

Step 1: Pick a manager that covers all your devices

Before comparing brands, list the devices and browsers you actually use. Then check that a candidate offers:

• Apps or extensions for every one of them, including your phone's operating system
• Import from a CSV file or directly from your browser
• Autofill inside phone apps, not just in the browser
• Multifactor authentication on your manager account
• A password health or audit report that lists reused and weak entries

Prices for paid personal plans typically run roughly $20 to $60 a year, and several reputable options have free tiers. Free tiers sometimes limit the number of devices, which matters if you want your phone and laptop in sync.

Step 2: Choose a master password you can actually remember

The master password unlocks everything, so it needs to be long and impossible to guess, yet something you can type from memory on a bad day. A passphrase of four or more random, unrelated words does both.

Take lantern-orbit-pickle-ferry as an illustration (don't use it, since it is now published). The words have 7, 5, 6 and 5 letters, which is 23, and the three hyphens bring it to 26 characters, comfortably past CISA's 16-character minimum. It is easy to picture, which helps you remember it, and the words have nothing to do with each other or with you.

A few rules keep a passphrase strong:

• Let chance pick the words: roll dice against a printed word list, or use your manager's passphrase generator. Words you choose yourself drift toward the familiar.
• Skip song lyrics, quotes, names of pets or children, and anything on your social media.
• Never use it anywhere else.

Many password managers cannot reset a forgotten master password for you, because they are designed so the company cannot see your vault. Write the passphrase on paper and keep it somewhere secure at home, such as with your passport, until it's firmly memorized. If your manager offers a recovery kit or recovery code, print it and store it the same way.

Then turn on multifactor authentication for the manager account. As CISA's page on MFA explains, it adds an extra step when you log in, such as a code texted to your phone or generated by an authenticator app, so a stolen master password alone isn't enough.

Step 3: Export your passwords from the browser

Every major browser can export saved passwords, and the result is usually a CSV file: plain text with one login per line and columns such as the site address, username, password and sometimes a note. The file is not encrypted. Anyone or anything that opens it sees every password you own in readable form.

Menus move between browser versions, so rely on each browser's own help pages rather than a screen-by-screen walkthrough. Search the help center of Chrome, Safari (or Apple's Passwords app on a Mac) or Edge for "export passwords". Expect to confirm with your computer's login password or fingerprint before the file is created.

Before you export, decide where the file will go. Save it to a local folder on your own computer, not a folder that syncs to cloud storage, a shared family computer or a work laptop. Don't email it to yourself or put it on a USB stick.

Two things usually don't come along in a password export. Saved payment cards and addresses are a separate store, so re-enter any cards you want in the manager by hand. Passkeys, the passwordless logins some sites now offer, generally stay where they were created rather than traveling in the CSV.

If you saved passwords in more than one browser, export each and import them one after another. You will have duplicates to clean up, which the next step covers.

Step 4: Import, then check before you trust it

Most managers have an import option that asks which browser the file came from, then reads the columns automatically. Some can pull directly from an installed browser without a file at all; if yours can, that skips the riskiest part of the process.

Once imported, run through this checklist before deleting anything:

1. The count matches. Open the CSV in a plain text editor and note the number of lines. Subtract one for the header row: a file with 313 lines should give you 312 logins. Compare that with the item count your manager shows.
2. Usernames and notes survived. Spot-check five or six entries, including one with a note and one with an unusual username such as a phone number.
3. Logins actually work. Sign out of two or three sites and sign back in using the manager's autofill.
4. Your phone can autofill. Install the manager's phone app, set it as the phone's autofill provider in the system settings, and test it inside a banking or shopping app, not just a web page.

For duplicates, sort the vault by site name. Where the same site appears twice with different passwords, the one saved most recently is usually current; test it, then delete the other. Entries for sites that no longer exist can go. If you find accounts you no longer want at all, closing them properly is part of a broader digital declutter, and every closed account is one fewer password to fix later.

Step 5: Delete the export file completely

Do this the moment the checks pass, not tomorrow. Delete the CSV, then empty the trash or recycle bin, because deleting alone only moves the file. Also check:

• Your Downloads folder, in case the browser saved a second copy there
• Any cloud-synced folder the file may have touched, plus that service's own trash or version history
• Recent-files lists in the text editor you opened it with

If you exported from several browsers, repeat this for every file.

Step 6: Turn off browser password saving

If the browser keeps offering to save passwords, new logins end up split between two places and the manager slowly goes out of date. In each browser on each device, find the setting that offers to save passwords and switch it off, along with password autofill. The browser's help pages name the current setting; it usually sits under the browser's passwords or autofill section.

Leave the old saved passwords in the browser for a week or two as a safety net while you confirm everything works from the manager. Then delete them from the browser too. If the browser syncs through your Google, Apple or Microsoft account, deleting on one device removes them from all synced devices, which is what you want at that point.

Step 7: Fix reused passwords in priority order

Open your manager's password health report. It will flag reused, weak and sometimes breached passwords, and the list can run into the dozens or hundreds. Trying to clear it in one sitting is how people give up halfway. Work in this order instead:

1. Email accounts. Password resets for almost everything else go to your inbox, so whoever controls your email can take over the rest. Fix these first and turn on MFA while you're there.
2. Financial accounts. Banks, credit cards, investment and retirement accounts, payment apps and tax portals.
3. Shopping accounts with saved cards. Large retailers, food delivery, ride-hailing and subscriptions where a thief could spend your money.
4. Everything else. Forums, newsletters, streaming and old hobby sites.

For each one, log in, go to the site's security or account settings, and let the manager generate a new password of at least 16 random characters. Confirm the manager saved the new password before you leave the page; a change that doesn't save is the main way people lock themselves out.

Worked example: pacing the cleanup

In this hypothetical vault, 85 accounts at ten a day takes 8.5 sessions, so nine. The 31 high-stakes accounts (4 + 12 + 15) are done by day four. Doing it only on weekdays stretches the whole job to about two weeks; skipping a few days stretches it to three, and that's fine because the risky accounts are already finished. Each session takes roughly 20 to 30 minutes. While you're working through accounts, the other security habits that matter most, such as keeping devices updated, pair naturally with this cleanup.

Keeping the manager itself safe from fake login pages

A password manager quietly protects you against phishing, because it matches saved logins to the exact web address. On a convincing copy of your bank's site at a look-alike domain, with one letter changed or an extra word added, the manager won't offer to fill anything in. Treat that refusal as a warning sign, not a glitch. Don't copy the password over by hand; close the tab and go to the site by typing its address or using a bookmark.

Scammers also go after the manager directly, with emails claiming your vault is locked or your subscription failed and asking you to sign in through a link. Open the manager app yourself instead. The FTC's guidance on phishing scams says to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, forward phishing texts to SPAM (7726), and report attempts to the FTC at ReportFraud.ftc.gov.

Finally, never type your master password anywhere except the manager's own app or extension, and never share it with anyone claiming to be support staff. A legitimate password company has no need to ask for it.