Moving passwords to a password manager

Module 7: Collaborating, apps and security · Reading time: 10 minutes

Learning objective: After this lesson you can safely move passwords from your browser, notes and spreadsheets to a password manager that suits your new setup, including shared vaults for the team.

Key concepts: password manager, vault, master password, recovery key, passwords in the browser (Google, Edge, Apple), export as csv, shared vault or collection, self-hosting, open source, encryption on your own device (zero-knowledge), storing passkeys

The forgotten part

Almost every inventory leaves out the passwords. They aren't in a cloud service you're cancelling, so nobody thinks of them. Yet they are often right in the middle of it. At The Granary Bakery, a quick round of questions reveals:

most passwords are in Chrome, saved in each person's Google account;
the passwords for the bank, the wholesaler and the webshop are in a spreadsheet wachtwoorden.xlsx in Google Drive;
the wifi password and the alarm code are on a note pinned to the wall;
two colleagues use the same password everywhere.

If the Google account disappears, the passwords in Chrome disappear with it. And a spreadsheet of passwords in the cloud is one of the first things an intruder looks for. A switch is therefore the right moment to sort this out.

What a password manager does

A password manager is an encrypted vault for passwords, with an app on your phone and computer and a browser extension. You remember one strong master password; the manager creates a long, unique password for every site and fills it in for you.

What matters is where the encryption happens. With the well-known managers, the vault is encrypted on your own device with a key derived from your master password. The provider only stores the encrypted vault and cannot read your passwords. This is often called "zero-knowledge". The consequence: if you forget your master password and have no recovery key, the provider can't help you either.

A good manager also only fills in passwords on the real address. A fake version of your bank's site gets nothing, even if it looks exactly the same. That is extra protection against phishing.

What types are there?

Type	Examples	Behind the software	Watch out for
Local file, not a service	KeePassXC (and other KeePass programs)	Open source community project	You store and sync the vault file yourself, for example in your new cloud. Sharing within a team is harder
Service, open source, can also be self-hosted	Bitwarden	Bitwarden Inc., an American company. Also offers an EU data location; you can also run the server yourself	With the cloud service the provider remains American, even with EU storage (lesson 2.1). Self-hosting removes that
Service, open source, aimed at teams	Passbolt	Passbolt SA, Luxembourg	Strong at sharing per group; self-hosted or as a service
Service from a European privacy provider	Proton Pass	Proton AG, Switzerland (not EU, but covered by an adequacy decision). Servers in Switzerland, Germany and Norway	Generous free version, works on all your devices. A good fit if you already use other Proton services
Service with an EU region, non-American	1Password	AgileBits, Canada (covered by an adequacy decision). With an account on 1password.eu your vault is stored in the EU	Very easy to use, no free version
Built into the browser or operating system	Google Password Manager, Edge, Apple Passwords	Google, Microsoft, Apple (US)	Convenient, but tied to that account and that ecosystem

Our advice for most people and small businesses: Proton Pass, or 1Password with an account on 1password.eu if you want the easiest option. Both work on your Mac, your Windows PC, your phone and in all browsers, and both have shared vaults for a team. Bitwarden remains an American company, even with EU storage. KeePassXC only works on computers; on your phone you need a different app. In the guide Password manager in practice we compare 23 password managers on ease of use, security and EU/GDPR (see Further reading). Use the five questions from lesson 2.1 (place of establishment, owner, data centre, sub-processors, key) here too. For a password manager the last question carries the most weight: who holds the key? If that's only you, where the encrypted vault is stored matters less than it does for ordinary files.

Moving across: export, import and delete straight away

Almost every browser and manager can export passwords as a csv file. That is a plain text file with a site, username and password on each line, unencrypted. Anyone who opens the file can read everything. So:

Do it on a computer you trust, not on a shared shop computer.
Export to your own computer, not to a synced folder or the cloud. Otherwise the unencrypted file ends up on the server, in the version history and in the bin within seconds.
Import it into the new manager straight away.
Spot-check that it's correct (log in to a few sites).
Delete the csv file immediately, and empty the computer's bin too.
Then turn off password saving in the browser, so that no second, outdated copy builds up.

To move the password spreadsheet, enter the details in the manager by hand (or import them as csv, following the same rules). Then delete the spreadsheet, including from the bin and the version history of the old cloud. Change the most important passwords that were in it, because you don't know who has seen the file over the years.

Also pay attention to passkeys (lesson 7.3). A passkey stored in your Google or Apple account can't always be exported. For your important sites, create a new passkey in your new manager, or make sure your password and second step are known, before you close the old account.

Sharing within a team

Some passwords belong to the organisation, not to a person: the bank, the wholesaler, the social media accounts, the wifi. Use a shared vault or collection in the manager for these:

Create a vault per group: "Shop", "Administration", "Management". Not everyone needs to see everything.
Never share a password by chat or email. Not even "just quickly".
When someone leaves, remove them from the shared vaults and change the passwords they had access to and could have remembered or copied.

The master password and the day things go wrong

The master password is the only key. Choose a long phrase of four to six random words that you don't use anywhere else. Turn on two-factor authentication (2FA) for the manager itself as well.

Arrange recovery in advance:

Keep the recovery key or emergency access your manager offers on paper, in a safe place.
Agree, for the organisation, who gets access if the owner dies or is ill for a long time. Many managers have an emergency access feature for this.
The backup codes for your most important accounts belong here too, or on paper (lesson 7.3). Not in a vault you can only get into with those same accounts.

In practice: what it looks like at a provider

A WebOké Nextcloud does not include a separate password manager; you use a standalone password manager alongside your cloud, such as Proton Pass or 1Password. The guide Password manager in practice explains both step by step: creating an account, installing, moving your passwords, sharing and emergency access. The guide on securing the WebOké Nextcloud also recommends a password manager, and names it as a good place for your backup codes.

Other European cloud services work in a similar way: the password manager is usually a separate service or app alongside your cloud.

Summary

Passwords in the browser of your old account disappear when you close that account. Move them beforehand.
A password manager encrypts on your own device; the master password is the only key.
A csv export is unencrypted: never in a synced folder, import it straight away, delete it straight away.
Use shared vaults per group for the organisation's passwords, and change them when someone leaves.
Arrange recovery and emergency access in advance, on paper.

Quiz

Exercise

Exercise E7.4: Mapping your passwords and a plan to move them. Find out where the passwords in your organisation are currently kept (browser per person, spreadsheets, notes, shared accounts), choose a password manager using the five questions from lesson 2.1, and write the migration plan: who exports what, on which computer, when the csv file is deleted, and which shared vaults will be created.

Exercise E7.4: Mapping your passwords and a plan to move them

Find all the places with passwords and move them safely to a single password manager. Never paste passwords here.

CSV imported.
Spot check done.
CSV deleted and recycle bin emptied.
Saving passwords in the browser switched off.
Spreadsheet deleted, including from version history and the recycle bin of the old service.
Two-factor authentication enabled on the manager.

Where are passwords currently stored? (browser per person, spreadsheets, notes, shared accounts)

Which manager do you choose, and how do you answer the five questions for that manager?

Which shared vaults will you set up, and who gets access to which one?

On which computer do you do the export, and how do you make sure the CSV file doesn't end up in a synced folder?

Which passwords will you change after moving, and where will you keep the recovery key or emergency access?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing