I’m trying to move my saved passwords out of my browser before I start using a shared desktop at home. I found the export option and created a file, but it appears to leave everything readable in plain text. What should I do next to transfer 37 logins safely and verify they’re stored correctly before deleting that file?
That export file is not a secure backup. Treat it as exposed until it is gone. Import it directly into Bitwarden’s free password manager, confirm all 37 entries appear, then open several at random and test their usernames, passwords, and URLs. Check for duplicates before emptying the browser’s saved-password list. Finally, delete the export, empty the trash, and remove any copy created by cloud sync or automatic backup. On the shared desktop, use a separate OS account and keep the vault locked when you step away.
16 Likes
Turn off browser password sync first. Otherwise the shared desktop may pull the saved logins straight back from your account after you delete the local copies.
Check where that export file landed before doing anything else. A CSV full of passwords may already be in Downloads, the recycle bin, or a cloud-synced folder. Import it into Bitwarden, verify that several logins work, then delete every copy you can find and empty the recycle bin. Don’t email it to yourself or leave it sitting around as a “backup.”
@vectorcraft8176flow is right about disabling browser sync, but I’d wait to remove the browser entries until the import has been checked. On the shared desktop, use separate operating-system accounts if possible, and only sign into the Bitwarden extension under your own account. A shared browser profile can still expose autofill suggestions or leave your vault unlocked if you walk away. Set a short vault timeout and require the master password again for sensitive logins.
Moving them into a vault will make future use safer, but it does not magically make that CSV harmless. If the file stayed on your private computer for a few minutes, was imported, and was then deleted, there is no need to panic. If it was emailed, copied to a shared machine, stored on a USB stick, or synced to cloud storage, treat the passwords in it as potentially exposed.
In that case, deletion is not enough. Change the important passwords after the import, starting with your primary email account because it can reset most of the others. Then handle banking, shopping accounts with saved cards, social media, and anything that reused the same password. Generate new, unique passwords inside the manager rather than editing the old ones by a character or two.
The sync warning from @crystalpilot6433 matters, but check whether deleting browser passwords affects your other devices before doing it. Browser sync can remove them everywhere, which is fine only after you have confirmed the vault import properly. Keep the old browser entries just long enough to verify the transfer, then remove them once rather than bouncing between two password stores indefinitely.
Do not rush the master-password setup either. It should be unique and long enough that you can remember it without reusing an existing password. Turn on two-factor authentication for the vault, save its recovery code somewhere offline, and make sure you can actually sign back in before logging out. Plenty of people lock down the vault and then discover their only recovery information was stored inside it.
On a shared desktop, lock the whole operating-system account when you walk away. A locked vault inside an open account still leaves browser history, downloaded files, email sessions, and other personal data available. If everyone is sharing one OS login, fix that first. No password manager can make a single communal desktop session private.
The shared desktop is the wrong place to do the migration. Import the CSV and finish cleanup on a computer you control, then install only the password-manager app or extension on the shared machine.
Separate operating-system accounts help with ordinary privacy, but they do not make an untrusted computer safe. Anyone with administrator access could install monitoring software, and a password manager cannot protect credentials after they are typed or autofilled into a compromised browser. I would avoid using that desktop for banking, your main email, or the password-manager account itself unless you trust both the machine and everyone who administers it.
For routine sites, disable automatic autofill and make the vault require confirmation before filling passwords. Do not enable “stay signed in,” and lock the OS account rather than merely closing the browser. Private browsing is not a substitute for any of this.
Keep another way to access your vault before depending on the shared computer, such as your phone or a personal laptop. That gives you somewhere trusted to approve logins, retrieve recovery information, and change credentials if the desktop later starts behaving suspiciously.
Deleting that CSV and emptying the recycle bin doesn’t actually scrub it off the disk. The file entry is gone but the raw data can sit in free space until something overwrites it. On a computer you fully control that’s usually fine. On anything that might get handed off or resold later, that leftover matters more than people think, so a proper secure-erase or wiping free space is worth doing if the machine won’t stay yours.
@greengeekpoint nailed the core of it. Do the whole export and cleanup on your own machine, then only put the extension on the shared box. I’d go a step further though. The plain-text problem everyone is circling isn’t really the browser export. Browsers store saved passwords in a way that’s trivial to read once someone is logged into that OS account. So if the household has been sharing a single login, those passwords were already exposed the whole time, export or no export. That’s the thing to sit with before worrying about a CSV that lived on your drive for two minutes.
The part I’d not skip is @retrothread_77’s point about reused passwords, because that’s where the real damage lives. If the same password backed your email and three other accounts, deleting files does nothing for the copies already saved elsewhere or already known. Rotate those, email first, and stop pretending the old ones are safe just because they’re in a vault now.
One thing nobody flagged clearly. Test that you can log back into the vault from a second device before you clean out the browser. People set up a strong master password, feel proud, close everything, and then realize the only place they wrote the recovery code was inside the vault they just locked themselves out of. Have your phone signed in as the fallback first.
Honestly, for a truly shared machine I wouldn’t sign into your main vault there at all. Use it for throwaway stuff and keep the accounts that can reset everything off that desktop entirely.
Don’t delete the browser data just because Bitwarden reports 37 imported items. Computers are excellent at counting rows, less so at telling you what never made it into the CSV.
Passkeys, authentication codes, saved notes, and “Sign in with Google/Apple” accounts may not transfer with ordinary passwords. Make a quick inventory of those separately, especially any account where the browser uses a fingerprint, PIN, or device prompt instead of showing a password.
Then test access from another trusted device before wiping the browser store. A successful CSV import proves the file was readable, not that every account can actually be recovered.