Why migrations fail at 2 a.m.
Families and small teams switch password managers after breaches, price hikes, or feature needs—shared vaults, travel mode, better TOTP UX. Failure mode: export CSV, import half-clean, delete old vault, discover missing TOTP seeds for email and banking. Lockout follows. Migrations need a reversible window where both tools run parallel with verified parity.
Never delete the old vault until you complete a week of daily logins from the new one.
Export and inventory first
Export encrypted JSON if the source supports it—CSV strips metadata and attachment files. Inventory categories:
- Logins with unique passwords (easy)
- Logins sharing reused passwords (fix during migration)
- TOTP entries (critical—confirm export includes seeds, not just otpauth URLs)
- Secure notes (Wi-Fi, router, safe combinations)
- Attachments (driver licenses scanned)
- Shared family folders with permission levels
Screenshot two-factor recovery codes for email before touching anything—they are not always inside the vault.
Import verification script
Manually open twenty high-value sites: email, bank, mobile carrier, cloud storage, employer SSO. Then run through every TOTP entry—codes should match between old and new apps for thirty seconds. Mismatches mean botched URI imports; fix before cutover.
For teams, assign each member to verify their own subset plus shared finance credentials together on a video call—boring, effective.
Phased cutover plan
| Day | Action |
|—–|——–|
| 0 | Export backup stored offline encrypted |
| 1 | Import to new manager, keep old read-only |
| 2–7 | Daily driver on new; note missing entries |
| 8 | Rotate passwords for any entry edited during window |
| 14 | Disable old subscription after second export archive |
Browser extension trap
Users migrate vaults but leave old extensions active—autofill fights, wrong TOTP pops up. Uninstall old extensions everywhere: work laptop, iPad, phone. Clear saved passwords in Chrome/Safari settings if you relied on dual systems.
Family sharing edges
Some managers charge per shared user; others include family plans with hidden admin recovery. Transfer ownership of shared vaults before canceling the paying account or relatives lose access mid-renewal.
Emergency kit
Print or store in a fire safe: master password hint (not the password), hardware security key registration sheet, and email recovery paths. Password managers increase security until one forgotten master string bricks everything.
Migration is a data move with authentication consequences—treat it like email provider switches: parallel run, paranoid verification, delayed deletion.
Business traveler edge cases
Travel Mode in some managers hides vaults at borders—configure before international trips so you are not locked out of email OTPs.
Executor access
Document emergency access for estate planning—some managers offer delayed release to trusted contacts.
Unicode master passwords
Emoji passphrases are memorable but break on some legacy import tools—stick to ASCII during migration week.
## Shared vaults for couples and roommates
Define who owns billing and who retains access after moves. Shared folders should not store sole copies of lease or utility credentials one roommate entered—duplicate critical items to personal vaults with consent.
Breach response mid-migration
If vendor announces breach during your migration window, accelerate rotation in new manager first, then audit old vault export for exposure dates.
## Enterprise vaults versus family plans
Teams mixing business and family vaults confuse offboarding—use business tier with admin recovery for work, separate family plan for personal. Compliance audits ask who can decrypt what; "my spouse shares the vault" fails SOC questions.
Hardware key registration order
Register two hardware keys in the new vault before removing SMS fallback in the old system—order matters when both apps run in parallel during migration week.
Migration FAQ
Parallel run how long? Minimum one week of daily use.
TOTP missing? Do not delete old vault until verified.
Family plan trap? Transfer ownership before cancel.
Browser passwords? Disable after migration—dual autofill fights.
Travel Mode? Configure before border crossings.
Emergency access? Set up before you need it.
Unicode master password? ASCII during migration week.
Breach mid-migration? Rotate in new vault first.
## Closing notes on password manager migration without lockout
Password manager migrations are identity migrations—treat them with the paranoia of email provider switches. Parallel runs, TOTP verification, and delayed deletion prevent weekend crises. Once stable, migrations often reveal how many reused passwords deserved rotation anyway—use the window to improve hygiene, not only move vaults.
## Extra context for password manager migration without lockout
Agencies managing dozens of client social accounts should migrate credentials into team vaults with role-based access, not shared spreadsheets exported to CSV. Migration week is ideal time to enable per-vault audit logs if the new manager supports them.
- Parallel vaults one week minimum.
- Verify every TOTP before old vault delete.
- Disable browser password save after cutover.
- Emergency access configured before crisis.
- ASCII master password during migration week.
- Rotate reused passwords during move.
- Team vaults use roles not shared CSV.
- Hardware keys registered before dropping SMS.
## Final checks for password manager migration without lockout
Migration weekends are cheaper than lockout Mondays—schedule accordingly.
Drill the runbook
Run a fake migration with one volunteer employee quarterly—discover TOTP edge cases before the real CFO migration weekend.
Couples migrating shared vaults should schedule a joint verification call for banking TOTP—async mistakes lock both people out of mortgage payments.
Extended scenario: nonprofit handoff
A nonprofit executive director migrated vaults before retirement but forgot board portal TOTP lived only in old manager trash—restored from emergency export tape kept in safe. Successor now tests restore quarterly. Migration includes succession, not only software.
Vault migration checklist
- Export encrypted backup offline.
- Verify twenty critical logins.
- Test all TOTP codes match.
- Parallel run seven days minimum.
- Disable old browser password saves.
- Update emergency access contacts.
- Rotate reused passwords during move.
- Document new vault owner for teams.
## Quick reference: password manager migration without lockout
Migrate vaults in parallel with TOTP verification before any deletion. Password manager switches are identity projects—schedule time, not lunch breaks.
University IT migrating thousands of students should stagger cohorts by class year—big-bang migrations generate helpdesk tsunamis when TOTP seeds fail at dorm move-in weekend.
Additional migration notes
Media companies with shared social credentials should migrate during low publishing weeks—election night is the wrong window to discover Instagram TOTP lived only in the old vault. Maintain a paper sealed emergency kit for master password fragments only if your org policy allows; otherwise use provider emergency contact flows tested in advance.
Video creators with dozens of platform logins should migrate before platform API token rotations—missing a rarely used live-stream key during vault cutover ruins scheduled events worse than losing a shopping site password.
Schedule migration away from peak travel weeks when TOTP for airline apps is constantly needed.
Athletes and performers with manager-shared logins should create separate vault entries per platform role—shared 'Instagram' item with one TOTP breaks when manager rotates without telling talent.
Journalists in hostile environments should migrate vaults before travel when old manager lacks travel mode—border searches differ from everyday threat models.
Shared credential ceremonies
Rotate shared finance passwords during migration while both approvers on video—async migration of wire transfer creds causes fraud review holds.