LEAVING LASTPASS
Move out of LastPass without leaving anything behind.
Most of the work is not the import. It is finding what an export skips—attachments, one-time codes, custom fields—and deciding which passwords to change once you have moved.
START WITH THE SETUP
Before you export anything
- 01
Create the new password-manager account, save its recovery details, and test one low-risk login on each device you use.
- 02
Open LastPass and note anything with a file attachment, a stored one-time code, or a custom item type. LastPass says its CSV export does not include attachments or one-time passcodes, and does not support custom item types or fields.
- 03
If a work LastPass account manages your vault, ask the administrator first. LastPass documents a policy that can prohibit export.
- 04
Keep LastPass paid up and working until the move is finished. You may need to look something up after the import.
WORK THROUGH THE CHANGE
Import once, fill the gaps, then close
- 1
Check whether your destination can import from LastPass directly. Bitwarden documents direct import in its browser extensions and desktop apps; 1Password documents direct import in its desktop app. A direct import avoids creating a readable file.
- 2
If you need a file, export from the LastPass browser extension: Account → Fix a problem yourself → Export vault items → Export data for use anywhere. The CSV holds your passwords in readable form. Save it to a private local folder outside cloud sync.
- 3
Import once, using the destination’s LastPass option rather than a generic CSV option. Bitwarden warns that importing the same file twice creates duplicate items.
- 4
Move what the export skipped: upload attachments by hand, and set up two-step verification codes again in your authenticator for any account whose code lived in LastPass.
- 5
Sign in to your most important accounts from the new manager, on more than one device. Then delete the export file, empty the Recycle Bin or Trash, and check that no synced or backup copy remains.
- 6
Only then cancel LastPass renewal or close the account. Leave this step until last, after a few days of using the new manager normally.
PUT IT INTO PRACTICE
Three things a LastPass export can miss
Check these items specifically. An item count that matches is not proof that everything came across.
- A scanned passport in a secure note
- LastPass says attachments are not included in its export. Save the file securely and add it to the new vault yourself, or decide it no longer needs to be stored there.
- A two-step code generated inside LastPass
- LastPass does not export these one-time codes, and 1Password notes it cannot import them from LastPass Authenticator. Sign in to that account and set two-step verification up again with your new authenticator before you close LastPass.
- A shared family or team folder
- Shared items can come across differently. 1Password, for example, turns private folders into tags and handles shared folders according to account type. Check who can see each shared item after the import.
Should you change your passwords after moving?
In December 2022, LastPass reported that an attacker copied a backup of customer vault data. LastPass says the backup contained some unencrypted data, such as website URLs, as well as sensitive fields encrypted with a key derived from each user’s master password. It advised users without its default settings to consider changing their stored website passwords.
Our practical suggestion: after moving, start with the accounts that would do the most harm if someone else got in. That usually means email, banking, and anything that can reset other passwords. This is a prioritisation, not a finding about your account. Read LastPass’s notice; source checked September 21, 2026.
A GOOD REASON TO WAIT
Stop and fix it before continuing if
- You cannot sign in to your primary email from the new password manager on a second device.
- The export file ended up in cloud sync, an email, or a shared folder.
- An account still depends on a one-time code that only LastPass can generate.
When to use the provider’s instructions
This is a planning guide, not security, legal, or account-recovery advice. Use the provider’s current documentation and your organisation’s policy where they apply.
YOUR NEXT STEP
Not sure where to move yet?
List the devices, people, and sharing you need first. The checklist does not rank products; it tells you what to test in a trial.