LastPass to Bitwarden Migration: Step-by-Step Guide 2026

📌 You can migrate to either vault: the procedure below (LastPass export → import) is identical for Bitwarden and for NordPass. Bitwarden stays in the title because it's the open source / self-host option, but follow that link if you want the "plug-and-play at $1.49/month" route. The steps stay valid - only the destination vault changes.

Wondering whether to stay? Read is LastPass safe? before deciding.

Want the case for switching first? Read Bitwarden vs LastPass before you migrate.

If you still use LastPass in 2026, it's urgent to migrate. The December 2022 breach exposed encrypted vaults of millions of users, and post-incident transparency was insufficient. This guide details the full procedure to migrate to NordPass (recommended for most users) or Bitwarden (power-users) in 30 to 60 minutes, with zero data loss.

Done right, a LastPass→Bitwarden migration takes well under an hour, with zero password loss and a transparent transition for the end user.

01 - Why Migrate Now

LastPass suffered in December 2022 one of the largest password manager breaches in history:

• Exfiltration of encrypted vaults of millions of users
• Weak master passwords potentially crackable offline by attackers
• Post-incident transparency deemed insufficient by security community
• Several real cases of compromised user accounts in the following months

Conclusion: as long as you use LastPass, attackers have all the time to brute-force your master password. Migration is not optional.

02 - Express Procedure (5 Steps)

1. Export your LastPass vault to CSV
2. Create a NordPass account (or Bitwarden) with strong master password (16+ characters)
3. Import the CSV into Bitwarden via web portal
4. Verify all is present + test 10 random sites
5. Permanently delete the LastPass account + shred the CSV

Total time: 30-60 minutes depending on vault size.

03 - Step 1: Export LastPass

Classic method: lastpass.com → My Vault → Account Options (user icon top-right) → Advanced → Export → CSV.

LastPass will generate a lastpass_export.csv file with all your passwords in plaintext. Keep this file safe (personal PC, ideally offline).

If classic export fails:

• Use the LastPass browser extension instead of web portal
• Export by folders (select Move → export subset)
• Briefly disable internet after export to avoid timeout

04 - Step 2: Create a Strong Bitwarden Account

Go to bitwarden.com → Get Started → Create Account.

Master password: 16+ random characters OR EFF passphrase of 5+ words (e.g., correct-horse-battery-staple-mercury - without dashes or memorize exactly, but as length example). This master password must NEVER be used elsewhere. If you want to generate a strong random candidate first, use our password generator.

Region: EU if European (GDPR data residency). US by default.

Plan: Free to start. You can upgrade to Premium later if needed.

05 - Step 3: Import the CSV

Log in to vault.bitwarden.com → Tools → Import Data.

File format: Select "LastPass (csv)". Bitwarden automatically recognizes the LastPass format and maps fields correctly.

Upload: Select your CSV file → Import.

With Bitwarden's official importer, a LastPass CSV export imports cleanly: folder structure preserved, identities and payment cards correctly recognized.

Limit: binary attachments (PDF, images stored in LastPass) are not exported by LastPass. You'll need to re-upload them manually after import (Premium plan for encrypted storage).

06 - Step 4: Verify

This is the longest but crucial step.

1. Counters: compare entry count (LastPass dashboard vs Bitwarden Tools → Statistics). Must be identical.
2. Test 10 random sites: try logging in via Bitwarden on 10 random vault sites. Autofill should work.
3. Sensitive accounts: priority test bank, primary email, admin/financial accounts. Verify 2FA if configured.
4. Folders/Tags: verify your folder structure is preserved.
5. Identities and cards: if you had any in LastPass, verify they're in Bitwarden Items → Identities / Cards.

If all is conforming, proceed to step 5.

07 - Step 5: Permanent Deletion

Enable 2FA on Bitwarden first: Settings → Security → Two-step Login → Authenticator app. Scan QR with Google Authenticator/Authy, back up recovery codes in safe place.

Delete the CSV:

• Linux: shred -uvz lastpass_export.csv
• macOS: srm -v lastpass_export.csv (or rm -P on HFS+)
• Windows: cipher /w:C:\path\to\folder (overwrite folder)

Delete the LastPass account: Account Settings → Delete Account → confirm by email → wait 24-48h. Verify 1 week after your LastPass login is refused.

08 - Post-Migration: Good Habits

• Bitwarden master password: never reuse elsewhere
• Bitwarden 2FA enabled (TOTP minimum, hardware YubiKey in Premium)
• Regular export of your Bitwarden vault (Tools → Export Vault) encrypted
• Monthly health audit if Premium (HIBP + weak + reused reports)
• Bitwarden auto-update on all your devices

09 - Going Further

• Complete 2026 Bitwarden review
• Bitwarden vs 1Password
• Vaultwarden self-host tutorial
• Best LastPass alternatives 2026 - full comparison of all migration destinations

This procedure follows Bitwarden's official LastPass import path. Note: binary file attachments are not carried over by the importer and require manual re-upload.