Switching password managers looks simple until export formats, shared vaults, and recovery codes refuse to line up. This checklist helps you compare tools before you commit, using questions you can verify in each product’s own docs and settings screens.
Review Rounds.com covers software choices with clear criteria. Use this as a buyer worksheet, not a ranked scorecard of every vault on the market.
Start with export and import reality
Open the current vault and confirm you can export logins in a format the next app accepts. Note whether attachments, secure notes, TOTP seeds, and folder structure travel with the export or stay behind.
Run a small pilot: ten logins, two shared items, one attachment if the tool supports it. Time how long import takes and whether fields map cleanly. A glossy marketing page rarely matches that pilot.
Sharing and emergency access
If you share credentials with a partner or a small team, check how invites work, whether recipients need paid seats, and how revoking access behaves. Emergency access for a spouse or executor matters as much as day-to-day sharing.
Ask who can see master-password reset paths. Some tools email recovery links. Others require a second device or printed kit. Write down the recovery steps before you delete the old vault.
Platform coverage and browser friction
List every place you log in: desktop browsers, phones, tablets, work machines that block extensions. Confirm the candidate has clients you will actually install, not only a web app you dislike.
Check autofill reliability on the sites you use most. A manager that fails on banking or government portals creates new risk because people fall back to sticky notes.
Security posture you can verify
Look for published security whitepapers, bug-bounty presence, and clear statements about zero-knowledge design. Prefer tools that explain where encryption happens and what the vendor can or cannot read.
Turn on two-factor authentication for the vault itself before you migrate. Store recovery codes offline. Do not keep the only copy of those codes inside the vault you are protecting.
Cost and lock-in
Price plans for the number of users and devices you need in twelve months, not the first month promo. Note whether premium features like file storage or advanced sharing disappear if you cancel.
Confirm you can export again later. Lock-in is real when exports omit TOTP seeds or shared folders. Keep a dated export in a safe place during the first week after migration.
FAQ
Do I need to wipe the old vault on day one?
No. Keep the old vault read-only until you confirm logins, shares, and recovery on the new tool.
What if export cannot move authenticator codes?
Re-enroll TOTP on critical accounts during the pilot. Treat missing seeds as a migration risk, not a minor quirk.
Is a free plan enough?
It can be for a solo user with few devices. Shared vaults and emergency access often need paid tiers; check that early.
Should I trust browser-built password tools?
They can work for light use. Evaluate the same export, sharing, and recovery questions before you rely on them for work accounts.
What is the fastest safe switch?
Pilot, enable vault 2FA, migrate in batches by priority, keep the old vault until a full week of clean logins.
Write a one-page migration plan with owners and dates. Include who resets work SSO passwords, who updates browser extensions on shared machines, and who stores the printed recovery kit. Treat the switch like a small IT project even if you are a household of two.
After cutover, watch for a week of login failures and autofill misses. Keep a short log. If the same site fails twice, fix it before you remove the old vault.
