How to Export Passwords From Chrome (and What to Do With the CSV) (2026)

Chrome will hand you every password it has ever saved for you, in one file, in under a minute. That is convenient and slightly terrifying at the same time, because the file it produces is plain text. This guide covers the exact steps on every platform, what the file actually contains, and the clean way to move its contents into a proper password manager without leaving copies scattered behind you.

Exporting on desktop (Windows, macOS, Linux)

The wording of Chrome's menus drifts slightly from version to version, but the path has been stable for years:

1. Open Chrome's menu (the three dots, top right) and go to Settings.
2. Open the Autofill and passwords section and enter Google Password Manager.
3. In the Password Manager's own left-hand menu, click Settings.
4. Find Export passwords and click Download file.
5. Chrome asks you to authenticate with your computer's login: your session password, fingerprint or face. This is the operating system checking that the person at the keyboard is you.
6. Pick a location and save. The file arrives as a CSV, typically named something like Chrome Passwords.csv.

If your passwords are synced to your Google account rather than stored only on the device, the same export exists at passwords.google.com under the gear icon, which is useful when you are not at your own machine.

Exporting on Android and iPhone

On both platforms the option lives inside the Chrome app rather than the system settings: open Chrome's menu, go to Settings, then Password Manager, open its settings via the gear icon, and choose Export passwords. The phone asks for your screen lock first. The result is the same CSV, saved to your downloads or offered through the share sheet.

One honest note for iPhone users: if your passwords actually live in iCloud Keychain rather than in Chrome, exporting from Chrome gives you an incomplete file. Check both.

What is in the file, said plainly

Open the CSV in any text editor and you will see one line per login: site URL, username, password, all in readable text. No encryption, no protection, nothing. This is not a Chrome flaw; the file exists precisely so that other software can read it.

The practical consequence: the CSV is the most sensitive document on your computer for as long as it exists. The rules follow from that. Never email it to yourself. Never drop it into a synced cloud folder. Never park it on the desktop for later. Create it at the moment you need it, use it, delete it, and empty the trash.

Importing into a real password manager

The point of the export is almost always migration, and every serious password manager has a dedicated importer for Chrome's format. In Bitwarden, for example: log into the web vault, open Tools, then Import data, select Chrome (csv) as the format, point it at your file, and confirm. Entries land with their sites, usernames and passwords intact; folders and tags you can organise afterwards. The process is equivalent in 1Password, KeePassXC, Proton Pass and the rest.

Why bother, when Chrome already stores passwords? We laid out the full picture in our review of Google Password Manager's safety: the short version is that Chrome's storage is genuinely encrypted at rest, but it is tied to your Google account and browser, offers no independent vault password by default on most setups, and covers passwords rather than the wider set of secrets (notes, identities, 2FA seeds) a dedicated manager handles.

The cleanup, which is the step people skip

Once the import is verified (spot-check a few logins in the new manager, including one you use daily), finish the job:

1. Delete the CSV and empty the trash or recycle bin. On Windows, also check the Downloads folder history.
2. Delete the passwords from Chrome so you are not running two divergent stores: Google Password Manager, select all, remove. They remain in your new vault.
3. Turn off Chrome's saving offer in the Password Manager settings, so the browser stops rebuilding a parallel collection.
4. Point the browser at the new manager by installing its extension, which fills logins in Chrome exactly where the built-in manager used to.

Skipping step 2 and 3 is how people end up six months later with half their passwords in Chrome, half in the manager, and no idea which copy of a changed password is current.

Summary

Exporting passwords from Chrome takes a minute: settings, Google Password Manager, its settings, export, authenticate with your system login. The output is a plain-text CSV that deserves the shortest life you can give it: import it into a dedicated manager immediately, spot-check the result, then delete the file, clear Chrome's stored passwords and disable its save prompts. The export itself is the easy part; the discipline around the file is the actual security work.