Google has introduced an Android experience for transferring passwords and passkeys between supported password managers without requiring users to download an unencrypted text file. The company says the process is coordinated by Android and can be completed in a few steps, but its announcement does not provide details of the underlying transfer protocol or an independent security assessment.
The feature is available with Google Password Manager, 1Password, Bitwarden Password Manager and Dashlane. Google says more password-manager providers are expected to support it. The stated device requirement is Android 8 or newer, although availability may also depend on app versions and provider-specific implementation.
Contents
What changed
Password managers have traditionally used provider-specific export and import tools. Google describes the older transfer process as involving a downloaded, unencrypted text file. Such a file can remain exposed on device storage unless the user removes it and protects it appropriately.
For the supported Android workflow, users no longer need to download that intermediate file. Android provides a system-coordinated path for transferring data between compatible password-manager apps.
The change also covers passkeys. Google says passkeys previously could not be transferred through this process and often had to be recreated separately across websites and apps. The new experience is intended to let users transfer passwords and passkeys through the supported workflow when both password managers support the relevant transfer path.
A passkey is an authentication credential based on public-key cryptography. The private key is kept protected by the user’s device or credential manager, while a corresponding public key is used by an online service to authenticate the user. Because passkeys are not simply text strings like passwords, transferring them requires compatible support from the participating applications.
How the transfer works
Google’s described workflow starts in the password-manager app that will receive the credentials:
- The user chooses to import or copy data in the new password-manager app.
- That app hands the task to Android.
- Android detects existing password managers on the device and shows which ones can be used as transfer sources.
- The user selects a source manager and is taken to that app.
- The existing manager allows the user to select, review and authorise the transfer.
Google says the data is then transferred between the apps in a few seconds. That timing is a company claim rather than an independently measured result, and the actual duration may vary with the amount and type of data being transferred.
Android coordinates the supported workflow and may reduce reliance on provider-specific export tools. Interoperability still depends on both applications supporting compatible interfaces and agreeing on how credential data is exchanged.
Why passkey transfers matter
The practical benefit is choice. Switching password managers can otherwise mean exporting passwords, handling a plaintext file and manually rebuilding passkeys across multiple services. A common transfer path could reduce that friction and make it easier for users to change providers.
Avoiding an intermediate plaintext export can also reduce the period during which copied credentials might be exposed in device storage. That does not, by itself, establish that every transfer is secure: protection also depends on the implementation, the authorisation controls and how each application handles the credentials before and after the transfer.
Google frames the feature as giving users more control over their data and greater freedom to switch providers. Its initial usefulness, however, will depend on how widely other password managers adopt the system.