Android Makes Password and Passkey Transfers Safer Across Managers

MOUNTAIN VIEW, Calif. — Google has launched a native, operating system-level tool for Android that allows users to transfer passwords and cryptographic passkeys directly between competing credential managers. The feature is designed to eliminate a persistent and dangerous gap in digital credential hygiene by avoiding the traditional method of exporting sensitive data into unencrypted text files.

The tool is supported on devices running Android 8 or later through Google Play Services. It negotiates the transfer directly between the source and target applications under the supervision of the Android operating system.

For years, users switching services generally had to export their entire database into a Comma-Separated Values (CSV) file because password managers lacked a unified, secure way to communicate with one another. Plain-text files left in local storage or a downloads folder became prime targets for “infostealer” malware such as RedLine or Vidar, which specifically scan file directories for unencrypted credential dumps.

The migration process begins when a user downloads a new password manager and selects the option to import or copy data from another provider. Android automatically detects compatible password managers installed on the device and displays which ones support direct transfer. After the user selects the source manager, Android allows the credentials being moved to be reviewed before the transfer is executed and authorized.

Google confirmed that the initial rollout supports Google Password Manager, 1Password, Bitwarden, and Dashlane. Additional third-party password management platforms are expected to adopt the protocol in the coming months.

The same operating system-level transfer addresses the technical bottleneck involved in moving passkeys. Built on the FIDO2 and WebAuthn standards, passkeys use public-private key cryptography tied to a user’s physical device or security hardware. Unlike traditional passwords, they cannot be easily copied, written down, or exported to a text file.

Previously, moving passkeys to a new manager required users to log into every individual online account, revoke the existing passkeys, and register new ones with the new provider. Android’s automated transfer allows passkeys to be securely mapped and relocated alongside standard passwords.

The development comes amid heightened scrutiny over centralized credential vaults. Cybersecurity agencies and experts globally recommend password managers as the single best defense against credential-stuffing attacks, while simple sequences such as “123456” and “password” remain among the most commonly used passwords worldwide.

Centralized storage has also become a high-value target for sophisticated cyber threats. In late 2022, hackers stole encrypted customer vault backups from cloud storage during a massive breach at LastPass, prompting a wave of users to seek alternative providers.

Security researchers have more recently identified memory-extraction vulnerabilities in popular platforms including Bitwarden, Dashlane, and LastPass, as well as in native web browser tools. Microsoft Edge, for instance, was found to be storing saved user credentials in unencrypted system memory. Dashlane was targeted by brute-force attacks over the summer, and LastPass experienced a separate intrusion that resulted in the theft of subscriber metadata.

Passkeys, despite being widely considered phishing-resistant and vastly more secure than passwords, have also faced emerging threat vectors. Researchers recently demonstrated a methodology for harvesting passkeys directly from Google Chrome’s active memory. Session hijacking techniques continue to bypass biometric and physical security keys by stealing authenticated browser sessions.

The push for direct credential portability aligns with broader initiatives led by the FIDO Alliance, an industry association dedicated to reducing the world’s reliance on passwords. The alliance has been drafting standardized specifications for credential exchange to eliminate vendor lock-in, ensuring that consumers can quickly and safely migrate their cryptographic credentials if a provider suffers a breach or service outage.