Android adds system-level tool to securely migrate passwords and passkeys

Google has launched a new system-level feature for Android that enables users to securely migrate passwords and passkeys between different password management services. This update aims to remove the security vulnerabilities associated with switching credential providers by integrating the transfer process directly into the operating system.

The new functionality replaces the traditional method of exporting sensitive data into CSV or text files, which are often stored in plain text and can be easily compromised. Instead, Android now facilitates a verified system-level transfer. The process requires Android to verify the user's identity before requiring a final confirmation within the destination password manager to complete the move.

A shift in credential management

Historically, switching password managers was a significant friction point for users. The standard workflow involved downloading a spreadsheet of all usernames and passwords, moving that file to a new service, and then manually deleting the plain-text record. This created a window of extreme vulnerability where a single compromised device or cloud backup could expose a user's entire digital identity.

Google is addressing this by moving toward a more integrated "credential manager" approach. By handling the migration at the OS level, the system ensures that sensitive data does not leave a secure environment during the transition. This feature is not limited to legacy passwords; it also supports the transfer of modern passkeys, which are increasingly becoming the industry standard for passwordless authentication.

Reducing vendor lock-in

This development is significant because it reduces the "lock-in" effect that often keeps users tied to a specific password manager despite preferences for other tools. By removing the technical and security hurdles of migration, Google is encouraging users to adopt the most secure tools available without fearing the migration process.

For the broader industry, this signals a move toward a more fluid ecosystem where the operating system acts as a secure broker for identity data rather than a passive observer. This shift makes it easier for users to migrate to services that offer better security features or better integration with their other devices.

Initial support and rollout

At launch, the feature is supported by a group of major industry players. Initial supported applications include Google Password Manager, 1Password, Bitwarden, and Dashlane. As more providers adopt the system-level API, the range of compatible services is expected to grow, further simplifying how Android users manage their digital credentials across different platforms.