🚀 We're launching on Product Hunt on July 22. Follow along
migration chrome apple-passwords csv-import password-manager family-finance securekeep

How to Move from Chrome or Apple Passwords to a Real Vault

Your Chrome passwords are one lost Google account away from gone, and Apple Passwords doesn't travel well outside Apple's ecosystem. Here is how to export from either one and import every entry into SecureKeep, a vault your family can rely on when a browser can't.

A laptop and an iPhone, mid-migration from a browser-based password store to a vault.

The most popular password manager in the world is Chrome. The second most popular is Apple Passwords. Most people using either one don't think of it as a password manager at all. To them it's just the thing that fills in a password automatically.

That works fine until the day it doesn't.

Then something breaks. A Google account gets locked, say, or a Mac gets wiped and set up fresh. A browser's password store is great at autofill, but it was never meant to be the place your family turns when they need into your accounts. It's designed to stay out of the way, and staying out of the way is the opposite of what a digital legacy needs.

If you've decided to move your passwords out of a browser and into a real vault, this is the guide. SecureKeep's CSV import handles both Chrome (which covers Edge and Brave too, since they share the same export format) and Apple Passwords.

With the CSV exported, the import itself is quick, well under five minutes.

What you'll need

  • A computer signed into the browser or system you're exporting from. Neither source supports export from mobile alone.
  • SecureKeep installed on your phone. iOS or Android. The CSV import lives at Settings → Tools → Import from CSV, or behind the Import CSV button at the top of the credentials list.

That's it.

Step 1A: Export from Chrome (or Edge, or Brave)

Chrome, Edge, and Brave all use the same Chromium-based password export. The path is essentially identical.

In Chrome:

  1. Type chrome://password-manager/settings into the address bar.
  2. Find Export passwords and click Download file.
  3. Re-enter your computer's login password (Chrome uses your OS password to authorize the export).
  4. Save the file. It downloads as something like Chrome Passwords.csv.

In Edge:

  1. Type edge://wallet/passwords into the address bar.
  2. Click the three-dot menu near the top of the passwords list.
  3. Choose Export passwords.
  4. Re-enter your OS password.
  5. Save the file (Microsoft Edge Passwords.csv).

In Brave:

  1. Type brave://settings/passwords into the address bar.
  2. Click the three-dot menu next to Saved Passwords.
  3. Choose Export passwords.
  4. Re-enter your OS password.
  5. Save the file.

All three produce the same column structure: name, url, username, password, note. SecureKeep auto-detects this as the Chrome format and imports accordingly.

The file is plain text. We'll get to that in Step 4.

Step 1B: Apple Passwords export

Apple Passwords (the dedicated app introduced in iOS 18 / macOS Sequoia, formerly part of Safari and System Settings as iCloud Keychain) supports CSV export from the Mac.

On macOS Sequoia or later:

  1. Open the Passwords app.
  2. Authenticate with Touch ID or your Mac's login password.
  3. From the menu bar, choose File → Export → Export All Passwords to File.
  4. Choose CSV format.
  5. Confirm the export warning.
  6. Save the file (Passwords.csv).

On older macOS (Safari-only Keychain access):

  1. Open Safari → Settings → Passwords.
  2. Click the more-options icon and choose Export All Passwords.
  3. Save the file as CSV.

On iOS / iPadOS: Apple Passwords on iOS doesn't currently expose a CSV export. Use the Mac to do the export, then move the CSV to your phone via AirDrop, iCloud Drive, or email-to-yourself.

The Apple Passwords CSV columns are: title, url, username, password, notes, and otpauth for any entries where you stored a verification-code seed in the app. SecureKeep's importer maps all of those.

Step 2: Open SecureKeep and pick the CSV

On your phone:

  1. Open SecureKeep and unlock your vault. (No vault yet? The first-run wizard walks you through creating one in about six minutes.)
  2. From the dashboard, tap Passwords, then tap the Import CSV button at the top of the list.
  3. The picker that opens is the standard iOS or Android files picker. Find the CSV you saved.

Quick v3.0.0 note: the document picker is exempt from SecureKeep's lock-on-background protection. Opening a file picker looks like backgrounding the app to the OS, and we didn't want the simple act of choosing your CSV to lock the vault and send you back to square one. The exemption is narrow, limited to known system pickers, and it ends as soon as the picker closes.

Step 3: Review the detected format

SecureKeep auto-detects the format from the column headers.

  • Chrome, Edge, and Brave are detected when the columns name, url, username, and password are present without the Apple-specific title column.
  • Apple Passwords is detected when the columns title, url, username, and password are present.

You'll see a banner: "Detected format: Chrome" or "Detected format: Apple Passwords" along with the row counts.

Two things happen automatically:

  • Deduplication matches on hostname and username together. If a gmail.com credential under the same username is already there, the importer skips the duplicate. Same host with a different username (work Gmail and personal Gmail, for instance) comes in as its own credential, which is what you want in a family vault.
  • TOTP secrets carry over from Apple Passwords. If you'd saved verification-code seeds on any entries, they arrive as structured TOTP secrets under v3.0.0's structured 2FA. (Chrome doesn't store TOTP at all, so a Chrome export has nothing to migrate here.)

Tap Import and confirm. The import is transactional and all-or-nothing: any failure rolls back the whole thing, so you never get a partial import.

Step 4: Delete the CSV

The export from either source is plain text. Don't leave it sitting in Downloads.

After the import succeeds:

  • Delete the CSV.
  • Empty Trash (macOS) or Recycle Bin (Windows). Files in the trash are still recoverable.
  • If you transferred the CSV to your phone via email-to-yourself or iCloud Drive, delete the email and the file in iCloud Drive.
  • If you use Time Machine, exclude the Downloads folder before the next backup, or remove the export before backup time.

If there's a place this goes wrong, it's the CSV that lingers in Downloads for months after you've moved off Chrome or Apple Passwords. SecureKeep can't reach into your computer to clean that up, so the cleanup is yours to do.

What gets imported, what doesn't

From Chrome / Edge / Brave:

Browser CSV field Imported into SecureKeep
name Credential label
url URL
username Username
password Password
note (or notes) Notes

Browsers don't store TOTP secrets, so there are no authenticator codes to migrate.

From Apple Passwords:

Apple CSV field Imported into SecureKeep
title Credential label
url URL
username Username
password Password
notes Notes
otpauth TOTP secret (structured 2FA)

What's not in either CSV at all:

  • Passkeys. Apple Passwords and Chrome both store passkeys, and the CSV exports leave them out. Passkeys are device-bound by design and don't travel via CSV. That's simply how the passkey standard works.
  • Wi-Fi passwords (Apple Passwords). Wi-Fi credentials live in iCloud Keychain but aren't part of the standard CSV, so add them to SecureKeep by hand.
  • Family-shared passwords (Apple Passwords). Items another family member shared with you appear in the export only if they were saved to your own account.
  • Verification-code seeds in Chrome. Chrome doesn't have this concept, so there's nothing to migrate.

Why a browser-based password store isn't enough

Most people who use Chrome or Apple Passwords didn't choose them as password managers; they went with whatever the browser put in front of them. That holds up fine until a family-impact moment arrives:

Chrome is tied to a Google account. If that account is locked, suspended, or compromised, the whole password store goes with it, or worse, goes to whoever now controls the account. Most people never made a backup, and Chrome's export is the only recovery path, which you tend to discover only after the account is already locked.

Apple Passwords is tied to the Apple ecosystem. It's excellent inside Apple and awkward outside it. A family member on Android can't reach your Apple Passwords vault, and a non-Apple device (a borrowed laptop, a work computer) can't autofill your stored credentials. For a family preparing for "if something happened to me," that's a real limit.

Neither was built for legacy. Each stores the credentials of whoever is logged into the browser or the iCloud account, and neither models multiple people, structured emergency information, family vaults, voice messages, or document attachments. They're autofill products.

A real vault is built for the people who'll need it, which is the whole idea behind SecureKeep. (More on the family-vault model.)

After the import: tidy up in five minutes

  1. Open Password Health (Settings → Password Health) and look at reuse and age. Browser stores never run this audit, so you'll spot things you didn't realize were a problem.
  2. Set up your Emergency Card with medical information, contacts, insurance, and physician. It's the piece most people end up opening most often.
  3. Decide whether to keep using browser autofill. Plenty of people run both through a transition, leaning on SecureKeep for anything that matters and the browser for low-value sites. Others switch the browser's password manager off entirely once they've moved. Either choice is reasonable.
  4. If you turned off browser password storage, clear the saved passwords too, so no stale plain-text copy lingers. Chrome: chrome://password-manager/settings → Clear browsing data → Passwords. Edge and Brave: the equivalent path. Apple Passwords: Passwords app → Settings → Delete All Saved Passwords.

Frequently asked questions

Is the CSV import secure? The CSV is read on your device, parsed in memory, and each credential is encrypted with your vault's per-vault data encryption key (AES-256-GCM) before being written to disk. The plain-text CSV stays in memory for the import and nowhere else.

Can I migrate passkeys? No. Passkeys are device-bound by design and don't migrate via CSV. SecureKeep currently stores credentials and TOTP secrets, not passkeys.

Will my browser still autofill after the import? Yes. SecureKeep doesn't touch anything in your browser. If you want autofill to stop, turn off the browser's password manager separately.

What if I'm exporting from an old Mac? Same Apple Passwords export path on macOS Sequoia and later. On older macOS, use Safari → Settings → Passwords → Export.

Can I export from iPhone directly? Not right now. Apple Passwords on iOS doesn't expose a CSV export. Use a Mac for the export, then move the CSV to your phone (AirDrop, iCloud Drive, email-to-yourself) before the import.

Does the import overwrite existing credentials? No. Host-and-username dedupe preserves existing credentials. Only new ones are added.

Does this work for Brave? Yes. Brave is Chromium-based and uses the same CSV format as Chrome, so the importer detects it as Chrome.

Related reading: