Taking your passwords with you: from the browser and Keychain to Bitwarden or KeePassXC

Your passwords are stuck in your browser or in iCloud Keychain, and you're switching to Linux. This article shows you how to move them to Bitwarden or KeePassXC — and where Apple gets in your way.

Requirements

• An account with Bitwarden (free, self-hosted, or paid) or a KeePassXC database (version 2.7.7 or newer for the Bitwarden import).
• Access to the computer where your passwords currently live — for Keychain, that's a Mac.
• Bitwarden Desktop app version 2024.12.0 or newer for direct browser import.
• Firefox or Chromium on Linux for the browser extension after migration.

Where your passwords currently live

Browsers like Chrome, Edge, and Safari store passwords in their own formats. That's convenient as long as you stay within that browser, but they're platform-bound. Chrome and Edge passwords can be exported as CSV. Safari stores everything in iCloud Keychain, and that's where the problem starts.

iCloud Keychain has no export function. There is no official way to generate a CSV or JSON file with your credentials. Apple simply doesn't allow it. The Bitwarden community confirms this: you can't choose Keychain as an import source, and there's no workaround that works directly.

There is a theoretical route: export passwords from another manager to CSV, import them into Chrome, sync with Safari — and that way they end up in Keychain. That route works in the other direction, from Bitwarden to Keychain, but if you only have Keychain and no export option, you're stuck.

Step 1: Export from your browser

Chrome and Edge can export passwords to CSV. You do this through the browser's settings, under 'Passwords and autofill'. Choose 'Export passwords' and save the file.

This file contains all your passwords in plain text. Treat it like a goldmine — because that's what it is. Don't keep it longer than necessary and delete it after the import.

Firefox works the same way: about:logins, the menu with the three dots, 'Export logins'. Here too you get a CSV.

Step 2: Import into Bitwarden

Bitwarden is an open-source password manager with clients for Linux, Windows, macOS, Android, and iOS. The import works through the desktop app, the web app, or the CLI.

For Chrome and Edge, use the desktop app. Install it, log in, and choose File > Import data. Select the correct browser format and check Import directly from browser. The desktop app then reads the browser data directly — the web app or extension can't do that.

For Firefox or your own CSV file, go to the web app at vault.bitwarden.com. Log in, choose Tools > Import, select the format, and upload your file.

A CSV from Chrome often contains fields that Bitwarden doesn't recognize, such as multiple URLs per entry. After the import, check that the most important logins are correct — username, password, and URL. Sometimes you need to manually rename a column to url, username, and password before the import succeeds.

Step 3: Import from KeePass

If you already have a KeePass database — .kdbx, KeePass 2 XML, or KeePassX CSV — the switch is simpler. Export from KeePass to one of these formats and import that file into Bitwarden via Tools > Import.

KeePass formats are structured and preserve metadata such as notes and custom fields. That makes them more reliable than the flat CSVs from browsers. Just check that your export contains all the fields you'll need later.

Step 4: The reverse route — Bitwarden to KeePassXC

KeePassXC, the cross-platform variant of KeePass that works fully locally, has been able to import a database from Bitwarden since version 2.7.7. You do this via the Import Wizard under Database > Import.

This functionality is relatively new. Not all versions support it, and it's not yet guaranteed that folders, tags, and custom fields are fully carried over. Test it with a small export file before moving your entire vault.

Why would you take this route? Bitwarden syncs via the cloud. KeePassXC doesn't — your database stays local, and you decide where your backups live. That does cost you the convenience of automatic synchronization between devices.

Step 5: Install the browser extension on Linux

After the import, install the Bitwarden extension in Firefox or Chromium on your Linux system. That extension communicates encrypted with your account and fills in logins automatically.

The extension only stores encrypted data locally. Your master password decrypts your vault with each session — without that password, the extension is useless, even to someone who steals your laptop.

Step 6: Clean up your old data

Delete the exported CSV file immediately after the import. A plain list of hundreds of passwords is a gift for anyone who can get to it.

Also remove the passwords from your old browser, or disable automatic saving. Otherwise, two copies of your passwords will exist, and the weakest link determines security.

Verification

Log in to your Bitwarden vault via the web app and check that the number of entries matches what you exported. Pick one random login and test it on the real website.

For KeePassXC, open the database and check a few entries for completeness — especially custom fields and notes.

Use the Bitwarden CLI to count the number of entries:

bw login
bw sync
bw list items | jq length

That last command requires jq; without jq, you'll see the count in the raw JSON output.

Frequently asked problems

Import from Chrome gives errors or misses entries. Chrome sometimes exports fields that Bitwarden does not recognize, such as multiple URLs per login. Open the CSV file in a spreadsheet, remove unnecessary columns, and rename the rest to url, username, password, and notes. Import again.

Keychain export remains impossible. There is no official route. The only workable workaround is manual: open Safari, view each password via the password settings, and copy it to your new manager. With dozens of logins, that is an afternoon of work — with hundreds, it is not realistic. Then consider which passwords you really need and replace the rest.

KeePassXC import from Bitwarden fails. Make sure you use KeePassXC version 2.7.7 or newer. Older versions do not have the Import Wizard. If the import starts but misses entries, first export from Bitwarden to JSON instead of CSV — JSON preserves more structure.

Migrating to a platform-independent manager is not a matter of one export button. It is a matter of knowing where your data is stuck and which route leads around it. Those who only use Keychain have the fewest options — and need the most time. Those who are already in a browser or KeePass are done within half an hour.