You Can Now Move Passkeys Between Password Managers: What Actually Works

The most common objection to passkeys was never about the cryptography. It was about the exit. Enrol passkeys in one password manager and, until recently, moving to another meant going account by account and creating every passkey again by hand. People noticed, and it kept them on passwords.

That objection is now being dismantled. The mechanism is the FIDO Alliance's Credential Exchange Protocol (CXP), with a companion data format called Credential Exchange Format (CXF). If passkeys are new to you, start with what is a passkey.

Why passkeys were stuck in the first place

A password is a string. Whatever you think of CSV exports, they work, because a password can be written down.

A passkey is a private key that is designed never to leave its secure store in readable form. That property is exactly what makes passkeys resistant to phishing and to database leaks, and it is also what made them impossible to move. There was no safe way to hand one to a different manager, so there was no way out except re-enrolment.

So the lock-in was not a business decision by any one vendor. It was a direct consequence of the security model. Fixing it needed a standard rather than a feature.

What CXP and CXF actually are

The two pieces do different jobs:

• CXF, the format. A standardised structure describing how credentials are represented, so that what one manager writes another can read.
• CXP, the protocol. The secure transfer itself, moving the credentials directly between two providers.

The FIDO Alliance's stated goal is that transfers are not made in the clear and are secure by default. In practice that means the migration is not a file sitting in your Downloads folder.

According to Bitwarden, the work began as a proof of concept in early 2023 involving 1Password, Dashlane, Bitwarden and NordPass, and grew into a collaboration of nine organisations: Apple, Bitwarden, Dashlane, Google, Microsoft, NordPass, 1Password, Samsung and SK Telecom. That list matters. A portability standard is worthless if the largest credential stores stay out of it.

What has actually shipped

This is where the reporting and the reality tend to drift apart, so here is the state of play rather than the announcements.

The Android piece is the one that changes the picture, because it is where most of the world's credentials live. Google's Play services release notes put the support in version 26.21, which began rolling out on 1 June 2026. Developers wire it up through the ProviderEventsManager APIs, importCredentials and registerExport, in the androidx.credentials library.

Note the shape of the requirement: it is a Play services version, not an Android version upgrade. Your phone does not need to be new. It needs Play services to be current, which is why this arrived quietly on a lot of devices without an OS update.

The honest caveats

Mobile first, desktop later. Outside Apple's ecosystem, desktop is behind. If you live on Windows, the transfer is a phone job for now.

Support is per-vendor, not universal. Being one of the nine organisations that built the standard is not the same as having shipped it. NordPass and Samsung are in the first group and not yet in the second. Check your manager's own release notes.

"Compatible apps" is doing real work in that sentence. Both ends have to implement it. A manager that can export is useless to you if the one you want to move to cannot import yet.

It is still moving. Treat any table of vendor support, including the one above, as a snapshot rather than a permanent state.

What this changes for you

Not much today, and quite a lot over the next year.

If you have been holding off on passkeys because you did not want to be trapped, that specific reason is weakening. The right response is not to rush a migration. It is to stop weighting lock-in so heavily when you choose, and to pick a manager on the things that actually matter: how it encrypts your vault, whether it has been audited, whether it works everywhere you work, and what happens if you lose your device.

If you are setting up passkeys across several ecosystems for the first time, our passkeys setup guide for Google, Apple and Microsoft covers the basics. For a vendor that already advertises Credential Exchange imports, see our note on the ExpressKeys update.

How to move passkeys, in practice

The exact menus differ per app, and they will keep changing, so treat this as the shape of the process rather than a fixed recipe.

1. Update both apps and Play services. On Android, confirm you are on Play services 26.21 or later. This is the step people skip.
2. Confirm the destination can import. Export support on its own gets you nowhere.
3. Transfer, do not export to a file. If the only option offered is a CSV, you are not using CXP, and you now have a plain text file of your secrets to destroy.
4. Verify before you delete anything. Sign in to two or three accounts with the new manager first.
5. Only then remove the old copies. And check what the old manager retained.

Point four is the one that costs people accounts. A passkey you deleted before testing is a passkey you re-enrol by hand, which is the exact problem this standard was written to solve.

Sources

• FIDO Alliance Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) specifications
• Bitwarden, "Security vendors join forces to make passkeys more portable for everyone" (participating organisations, origin of the proof of concept)
• Google Play services release notes, version 26.21 (Android import and export of passwords and passkeys)
• Android developer documentation, androidx.credentials ProviderEventsManager (importCredentials, registerExport)