Android kills off unencrypted CSV password dumps with new direct credential transfer system

Google has launched an operating system-level credential transfer system for Android designed to eliminate unencrypted CSV file exports when users migrate data between password management applications. The new migration framework shifts credential transfers to a direct, operating system-coordinated process.

The security update allows users to move stored login credentials and cryptographic passkeys directly between supported password manager applications without writing cleartext data to device storage. Transporting password vaults via comma-separated values (CSV) files creates local, unencrypted text files containing usernames, account URLs, and plain-text passwords on a device’s storage drive or download folder.

Initial support for the direct switching protocol is available through 1Password, Bitwarden, Dashlane, and Google Password Manager, with additional third-party password managers expected to adopt the functionality in future updates. The feature also addresses a primary technical hurdle in the industry-wide transition toward passwordless authentication.

When a user opens a destination password manager and selects the option to import credentials, Android identifies other compatible password manager applications installed on the device. The operating system then establishes a secure cross-app transfer path, prompting the user to review the credentials and passkeys selected for migration before confirming the transfer with a few taps.

Passkeys—which rely on public-key cryptography under the WebAuthentication (WebAuthn) standards established by the FIDO Alliance and the World Wide Web Consortium (W3C)—cannot be exported or structured into standard CSV spreadsheets. If users fail to permanently delete these export files, the sensitive data remains accessible to file-scraping malware, compromised third-party applications, or unauthorized physical access to the device.

Google confirmed the switching feature is supported on devices running Android 8.0 (Oreo) or higher. Android 8.0, released in August 2017, originally introduced the operating system’s native Autofill framework, which enabled third-party managers to populate saved credentials into web forms and applications.

Prior to the implementation of direct migration APIs, users who moved to a new password manager were forced to manually re-register their passkeys across every individual account and website. By deploying the new credential transfer framework across Android 8 and later versions, Google extends the feature across the vast majority of active Android devices globally through system components and Google Play Services updates.

The update integrates with Google’s broader Credential Manager API, introduced in Android 14 to consolidate passwords, passkeys, and federated sign-in methods into a unified system interface. By enabling direct app-to-app data exchange, the system resolves a major security flaw inherent to traditional credential migration.

It also aligns with ongoing standardization efforts within the FIDO Alliance, where industry member companies—including Google, Apple, Microsoft, 1Password, and Dashlane—have been working to establish open Credential Exchange Specifications (CXF and CXP) for secure credential portability across competing platforms and ecosystems.

![Image]