Bitwarden might be the most architecturally candid password manager in the mainstream market. The codebase is open source, the free tier is genuinely useful, and at $10 a year the paid tier reads more like fair pricing than a subscription tax. If you've been using Bitwarden, you've made a defensible choice.
You can also trade it for an even simpler architecture: one where the encrypted vault never syncs, never lands on a server, and doesn't need a paid plan to do its core job. SecureKeep reads a Bitwarden CSV directly, pulling every login across in one bulk transaction, TOTP secrets and URLs included, on your phone, with no cloud account in the middle.
If you've decided to switch, whether for the local-only architecture, the family-vault model, or both, this is the guide.
What you'll need
- A Bitwarden account you can sign into through the web vault.
- A computer. Bitwarden's mobile apps don't export to CSV; the web vault and desktop apps do, and the web vault is the easiest path.
- SecureKeep installed on your phone. iOS or Android. The CSV import lives at
Settings → Tools → Import from CSV, or behind the Import CSV button at the top of the credentials list.
That's the whole list.
Step 1: Export your Bitwarden vault
The cleanest path is the web vault.
- Open
https://vault.bitwarden.com/and sign in. - From the sidebar, choose Tools → Export Vault.
- Set the file format to
.csv. - Re-enter your master password.
- Bitwarden downloads a file named something like
bitwarden_export_<timestamp>.csv.
The file contains: folder, favorite, type, name, notes, fields, reprompt, login_uri, login_username, login_password, login_totp. Login items, secure notes, identities, and cards all share the same CSV, distinguished by the type column.
It's plain text throughout. We'll handle that in Step 4.
One note on Bitwarden's JSON options: it also offers a plain
.jsonexport and an encrypted.jsonexport. For SecureKeep's importer, choose the CSV path. The encrypted JSON is built for re-importing into Bitwarden itself, and SecureKeep doesn't read that format.
Step 2: Load the CSV into SecureKeep
On your phone:
- Open SecureKeep and unlock your vault. (If you don't have one yet, the first-run wizard walks you through creating one in about six minutes. Do that first, then come back here.)
- From the dashboard, tap Passwords, then tap the Import CSV button at the top of the credentials list.
- The picker that opens is the standard iOS or Android files picker. Find the
bitwarden_export_<timestamp>.csvyou saved in Step 1.
A small v3.0.0 detail: the document picker is exempt from SecureKeep's lock-on-background protection. Because the OS treats file-picking as sending the app to the background, we added the exemption so that choosing your CSV doesn't lock the vault and make you start over. It's a narrow carve-out, limited to known system pickers, and it ends the moment the picker closes.
Step 3: Review the detected format
SecureKeep auto-detects the format from the column headers. For Bitwarden, it looks for login_uri, login_username, and login_password. When all three are present, the parser is set to Bitwarden.
You'll see a banner: "Detected format: Bitwarden" along with the row counts.
Three things happen automatically:
- Type filtering happens first. Any row whose
typeis something other thanlogin(or is empty) gets skipped. Bitwarden's CSV folds secure notes, identities, and cards into one file, and the importer takes only the login items, since that's what SecureKeep's credentials section is for. Secure notes and identities you'll add by hand in SecureKeep's secure notes section. - Deduplication looks at hostname and username together. If a
gmail.comcredential under the same username already exists, a second import won't duplicate it. Keep the host and switch the username (work Gmail versus personal Gmail) and each imports on its own. - TOTP secrets get their own slot. Any
login_totpvalue becomes a structured TOTP secret on the credential, held separately from the password and from any backup codes. Bitwarden kept these in a single field; SecureKeep's v3.0.0 structured 2FA gives them a dedicated home.
Tap Import and confirm. The import is transactional and all-or-nothing: if a single row fails to encrypt and write to disk, the whole thing rolls back.
Step 4: Delete the CSV
The Bitwarden export is plain text. After the import succeeds:
- Delete the CSV from your Downloads folder.
- Empty Trash (macOS) or Recycle Bin (Windows).
- If you saved a copy anywhere else, delete it there too.
- Bitwarden's web vault names the export with a timestamp, which means you might have multiple exports if you've done this before. Check for those.
- If you use Time Machine, exclude the Downloads folder before the next backup, or remove the export before backup time.
Skipping this step is the single most common way a careful migration still leaks. So don't.
What gets imported, what doesn't
| Bitwarden field | Imported into SecureKeep |
|---|---|
name |
Credential label |
login_uri |
URL (normalized — first URI only if multiple are present) |
login_username |
Username |
login_password |
Password |
notes |
Notes |
login_totp |
TOTP secret (structured 2FA) |
folder |
Not imported in v3.0.0 — SecureKeep is flat with category filtering |
favorite |
Not imported in v3.0.0 |
type (other than login) |
Skipped: secure notes / identities / cards are not credential entries |
fields (custom fields) |
Not imported in v3.0.0 |
reprompt |
Not imported (SecureKeep applies vault-wide unlock policy instead) |
What lives outside the CSV in Bitwarden, and how to handle it:
- Secure notes. Bitwarden Note items aren't part of SecureKeep's credentials section, so copy them by hand into SecureKeep's secure notes; every vault has a dedicated section.
- Identities and cards. Copy these manually. SecureKeep's secure notes section is the right home for identity records, and cards can live there too.
- Custom fields. If you leaned on Bitwarden's custom fields, plan to fold them into the
notesfield of the matching SecureKeep credential. - Sends, attachments, and organizations. These fall outside SecureKeep's model. Sends are a Bitwarden-specific feature. Attachments map onto SecureKeep's encrypted documents, so upload them directly. Organizations are a Bitwarden Teams concept and don't translate to a local-only vault.
What draws Bitwarden users away
You don't need to be unhappy with Bitwarden to find this useful. Three themes come up repeatedly:
Start with the architecture trade. Bitwarden's encrypted vault syncs to Bitwarden's servers, or to your own box if you self-host. The encryption is real. The vault, though, still lives somewhere off your phone, on infrastructure that, however well secured, exists. SecureKeep doesn't sync. Your vault stays on your phone, encrypted under a key derived from your master password, and the only way it leaves the device is a backup you start yourself. There's no SecureKeep server keeping a copy of your vault around to be stolen, because we never built one.
Then the family model. Bitwarden Families ($40 a year) is a multi-user product: each member has an account, and shared organizations pass credentials between them. SecureKeep works differently. One device holds several vaults, one per trusted person, so the vaults for your spouse, a parent, and a child all sit on a single phone that one person manages. Whether that fits depends on what your family actually needs.
Finally, the pricing fit. Bitwarden's free tier is excellent, and Premium at $10 a year is about the cheapest mainstream option going. SecureKeep is $7.99 one time. If you don't need cross-device sync, because your vault lives on the one device you actually use, the one-time purchase lines up better with how you'll use the app.
None of this is a push to leave Bitwarden if it's working for you. It's a prompt to ask whether your password manager's architecture matches the way you actually use it.
After the import: a quick cleanup pass
- Open Password Health (Settings → Password Health) and run the analysis. Bitwarden's reports vary by tier; SecureKeep runs the same audit on every vault. Clear the top three offenders first.
- Walk through any TOTP codes you imported. Check one or two against your authenticator app. If they match, retire the authenticator for those sites, or keep both. Entirely your call.
- Set up your Emergency Card and name your trusted person. Collecting everything in one place only helps if the people who rely on you can reach it when they need to.
- Decide what to do with your Bitwarden account. If you're sure about the switch, archive or delete it. If you'd rather keep it as a fallback for 30–90 days, set a calendar reminder to revisit.
Frequently asked questions
Is the CSV import secure? The CSV is read on your device, parsed in memory, and each credential is encrypted with your vault's per-vault data encryption key (AES-256-GCM) before being written to disk. The plain-text CSV never touches disk; it exists only in memory for the length of the import.
What about my Bitwarden organizations / shared collections? SecureKeep doesn't model multi-user organizations the way Bitwarden does. If you need shared credentials across people, the SecureKeep approach is one device, one trusted person, and a separate vault per relationship. If you need true real-time multi-user collaboration, SecureKeep isn't the right tool for it; Bitwarden Teams is.
Can I import the encrypted JSON instead? No. SecureKeep reads CSV. The encrypted JSON is Bitwarden's own internal format, meant for re-importing into Bitwarden.
What if I self-host Bitwarden (Vaultwarden)? Same export path. The web UI is identical and the CSV format is identical.
Will the import overwrite my existing credentials? No. Host-and-username dedupe preserves existing credentials. Only new ones are added. To replace an existing entry, edit it manually after the import.
Does it import my Bitwarden Sends? No. Sends are a Bitwarden-specific shared-link feature. SecureKeep's family model uses backup files and the Emergency Card export instead.
Does the import work on iPad? Yes. Same Files-based picker, same flow.
Related reading: