🚀 We're launching on Product Hunt on July 22. Follow along
migration 1password csv-import password-manager family-finance securekeep

How to Migrate from 1Password to a Family Vault (Step-by-Step)

1Password is excellent. So is owning your data outright, paying once, and keeping everything on your phone. Here is how to export your 1Password vault and import every entry, TOTP secrets and all, into SecureKeep in just a few minutes.

A laptop and an iPhone on a desk during a deliberate, unhurried data migration.

1Password is a genuinely excellent password manager. This isn't one of those guides that pretends otherwise.

It is also $36 a year, or $60 for a family plan, or $96 for a teams plan, paid every year, in exchange for storing an encrypted copy of your vault on someone else's servers. For plenty of people that trade is worth it. For a growing number it no longer is: maybe the yearly cost finally registered, maybe the family wants something simpler than everyone logging into a shared plan, or maybe it just sank in that "encrypted on someone else's server" still means on someone else's server.

If that's you, if you've decided to move from 1Password to a vault that lives on your phone, costs $7.99 one time, and never syncs to a cloud you don't control, then this is the guide.

Once you have the CSV in hand, the move itself takes only a few minutes.

What you'll need

  • A 1Password account you can still sign into through the desktop app.
  • A Mac or PC. 1Password's mobile apps don't export to CSV; the desktop apps and web clients do.
  • SecureKeep installed on your phone. iOS or Android. The CSV import lives at Settings → Tools → Import from CSV, or behind the Import CSV button at the top of the credentials list.

That's the whole list. You won't need a bridge tool, a second account, or any in-between stage.

Step 1: Export your 1Password vault

1Password 8 (the current version) supports a CSV export of your Logins items. Here's the path:

  1. Open the 1Password 8 desktop app and unlock your vault.
  2. Click the vault you want to export from in the sidebar (most users have a "Personal" vault; if you have multiple, decide whether you want them merged or kept separate before you export).
  3. From the menu bar, choose File → Export → CSV (macOS) or Settings menu → Export → CSV (Windows).
  4. Re-enter your 1Password Account Password.
  5. Save the file. It downloads as something like 1Password Export.csv.

The file is plaintext and includes: title, url, username, password, notes, and an otpauth URI for any items where you stored a one-time-password seed in 1Password.

It's also completely readable as it sits. We'll come back to that in Step 4.

Worth knowing what the 1Password CSV covers: Login items, and only those. Documents, secure notes, identities, and software licenses stay out of the export, so you'll bring them over separately, or store them in SecureKeep as secure notes or document attachments. SecureKeep handles those data types, just through a different path than this CSV.

Step 2: Bring the CSV into SecureKeep

On your phone:

  1. Open SecureKeep and unlock your vault. (If you don't have one yet, the first-run wizard walks you through creating one in about six minutes. Finish that first, then come back here.)
  2. From the dashboard, tap Passwords, then tap the Import CSV button at the top of the list.
  3. The picker that opens is the standard iOS or Android files picker. Find the 1Password Export.csv you saved in Step 1.

This is a deliberate v3.0.0 design choice: the document picker doesn't count against SecureKeep's lock-on-background protection. From the OS's point of view, file-picking sends the app to the background, and we didn't want the act of choosing your CSV to lock the vault and force a restart. The exemption stays narrow, limited to known system pickers, and it lifts the instant the picker closes.

Step 3: Review the detected format

SecureKeep auto-detects the format from the column headers. For 1Password, it looks for the columns archived, tags, and title. When all three are present, it sets the parser to 1Password.

You'll see a banner reading "Detected format: 1Password" along with three numbers: total rows, skipped rows (empty entries and duplicates), and the final count ready to import.

Two things happen automatically here:

  • Deduplication works on hostname plus username. If you already have a credential for gmail.com under the same username, importing it again won't create a duplicate. Keep the same host but change the username (your work and personal Gmail, say) and it imports as its own credential, which is exactly what you want inside a family vault.
  • TOTP secrets end up where they belong. Any otpauth:// URI in the CSV becomes a structured TOTP secret on the credential, kept apart from the password and from any backup codes. With v3.0.0's structured 2FA, your authenticator codes stop getting jammed into the password or notes field and finally get a place of their own.

Tap Import and confirm. The whole thing is transactional and all-or-nothing: if a single row fails to encrypt and write to disk, the entire import rolls back. You won't be left guessing which 13 of 200 entries didn't make it. There are no partial states.

Step 4: Delete the CSV

Here's where most walkthroughs go quiet. Don't skip it.

1Password Export.csv is a plain-text copy of every login you own. It's sitting in your Downloads folder, indexed by Spotlight, quite possibly synced to iCloud Drive or Google Drive, and maybe already captured in a Time Machine backup.

After the import succeeds:

  • Delete the CSV from your Downloads folder.
  • Empty Trash (macOS) or Recycle Bin (Windows). Files in the trash stay recoverable until you do.
  • If you stashed a copy anywhere else (a USB stick, a folder named 1password-temp, an email to yourself), delete those too.
  • If you use Time Machine and you're cautious, exclude the export folder before the next backup runs, or remove the CSV before backup time.

The place people actually trip up when leaving 1Password comes weeks after the migration, when a stale CSV is still parked in Downloads. SecureKeep can't reach into your computer to tidy that up. That part is on you.

What gets imported, what doesn't

1Password field Imported into SecureKeep
title Credential label
url URL (normalized — http:// upgraded to https:// where applicable)
username Username
password Password
notes Notes
otpauth TOTP secret (structured 2FA)
tags Not imported in v3.0.0 — folders and tags are flat in SecureKeep today
archived Read for detection only

What's not in the CSV at all:

  • Documents (PDFs, identity scans). Export them separately, or upload them straight into SecureKeep as encrypted documents; every vault has a built-in document section.
  • Secure notes, the ones stored as 1Password Note items (as opposed to the notes field on a Login). Copy these by hand into SecureKeep's secure notes section.
  • Identities and addresses. Copy these manually.
  • Software licenses, SSH keys, and server credentials. Copy these manually.
  • Watchtower history. This doesn't travel with the export, but SecureKeep's Password Health dashboard runs its own analysis on the imported data and flags reuse, weak passwords, and aging credentials.

What's pushing people off 1Password

You don't have to dislike 1Password for this to be worth reading. Three reasons come up again and again in our inbox:

Start with the recurring cost: $36 a year for the Personal plan, $60 a year for Families. Ten years in, that's $360 to $600, for software whose core job hasn't really changed in a decade. SecureKeep is $7.99 one time. (We wrote a longer post on the no-subscription angle here.)

Then the architecture: 1Password is a beautifully built app with a thoughtful security model, and it still keeps an encrypted copy of your vault on its servers. The encryption is real. So is the vault, sitting on infrastructure you don't control, reachable by subpoena, exfiltration, or ransom. SecureKeep doesn't sync. Your vault lives on your phone, encrypted under a key derived from your master password, and it never leaves the device unless you export a backup yourself. On our side there's no server holding a copy of your vault to be stolen in the first place.

Last, the family model. 1Password Families is a multi-user product: everyone has their own account, vaults are shared between those accounts, and recovery runs through a designated family organizer. SecureKeep takes a different route. One device holds several vaults, one for each trusted person, so you might keep one for your spouse, one for a parent, and one for a child, all on the same phone. You unlock with your master password and work inside whichever person's vault you're preparing. It's a different model with a different fit, and which one suits you depends on what your family actually needs. (Read more about the family vault model here.)

None of this means you should abandon a manager that's serving you well. It's just worth knowing what you're actually paying for, and why.

After the import: five minutes of cleanup

  1. Open Password Health (Settings → Password Health) and look at the reuse and age summary. Watchtower won't have caught everything; SecureKeep runs its own analysis and hands you the top three things to fix this week.
  2. Walk through any TOTP codes you imported. Open one and check the 6-digit code against your authenticator app. If they match, you can retire the authenticator for that site, or keep both running. Your call.
  3. Set up your Emergency Card and name your trusted person. Gathering credentials in one place only pays off if the people who depend on you can reach them when the time comes.
  4. Decide whether to keep paying for 1Password. If the answer is no, pull your payment method and archive or delete the account. If the answer is yes (plenty of people run both through a transition), set a calendar reminder to revisit in 90 days.

Frequently asked questions

Is the CSV import secure? The CSV is read on your device, parsed in memory, and each credential is encrypted with your vault's per-vault data encryption key (AES-256-GCM) before being written to disk. The plain-text CSV lives only in memory for the duration of the import, then it's gone once the transaction completes.

Can I import to a specific vault if I have multiple? Yes. The import lands in whichever vault is currently open. Switch vaults from the picker before tapping Import CSV.

What happens to my 1Password tags and folder structure? Tags and folders aren't imported in v3.0.0. SecureKeep is currently flat with category-based filtering. Tagging is on the roadmap; if it lands, we'll backfill.

Will the import overwrite my existing credentials? No. Host-and-username dedupe means existing credentials are preserved. Only new ones are added. To replace an existing entry, edit it manually after the import.

What about my 1Password secure notes? Note items in 1Password aren't part of the CSV export. Copy them by hand into SecureKeep's secure notes; every vault has a dedicated section.

Does the import work on iPad? Yes. Same Files-based picker. Same flow.

Can I run 1Password and SecureKeep in parallel for a while? Of course. Some people do this for 30–90 days while they get comfortable. Just remember the CSV goes stale the moment you change a password in either app, so re-export and re-import (or update by hand) when that happens.

Related reading: