Moving passwords to a password manager

Module 7: Collaborating, apps and security · Reading time: 10 minutes

Learning objective: After this lesson you can safely move passwords from your browser, notes and spreadsheets to a password manager that fits your new setup, including shared vaults for the team.

Key concepts: password manager, vault, master password, recovery key, passwords in the browser (Google, Edge, Apple), export as csv, shared vault or collection, self-hosting, open source, encryption on your own device (zero-knowledge), storing passkeys

The forgotten part

Passwords are missing from almost every inventory. They're not stored in a cloud service you're cancelling, so nobody thinks about them. Yet they're often right in the middle of things. At Bakkerij De Korrel, a quick check reveals:

• most passwords are stored in Chrome, saved in the person's Google account;
• the passwords for the bank, the wholesaler and the webshop are in a spreadsheet wachtwoorden.xlsx in Google Drive;
• the wifi password and the alarm code are on a note;
• two colleagues use the same password everywhere.

If the Google account disappears, the passwords in Chrome disappear with it. And a spreadsheet with passwords in the cloud is one of the first things a burglar looks for. So a switch is the right moment to fix this.

What a password manager does

A password manager is an encrypted vault for passwords, with an app on your phone and computer and an extension in your browser. You remember one strong master password; the manager creates a long, unique password for each site and fills it in for you.

What matters is where the encryption happens. With the well-known managers, the vault is encrypted on your own device using a key derived from your master password. The provider only stores the encrypted vault and cannot read your passwords. This is often called "zero-knowledge". The consequence: if you forget your master password and have no recovery key, even the provider can't help you.

A good manager also only fills in details on the genuine address. A fake site pretending to be your bank gets nothing, even if it looks exactly the same. That's an extra protection against phishing.

What types are there?

This isn't a ranking. For a sole trader, KeePassXC with the vault file in your own cloud can work perfectly well. For a team of twelve, a manager with shared vaults is more convenient. Use the five questions from lesson 2.1 here too (location, owner, data centre, sub-processors, key). For a password manager, the last question weighs heaviest: who has the key? If it's only you, it matters less where the encrypted vault is stored than it would for ordinary files.

Moving over: export, import and immediate deletion

Almost every browser and manager can export passwords as a csv file. That's a plain text file with a site, username and password on each line, unencrypted. Anyone who opens the file can read everything. So:

1. Do this on a computer you trust, not on a shared shop computer.
2. Export to your own computer, not to a synced folder or the cloud. Otherwise, the unencrypted file will be on the server, in the version history and in the recycle bin within seconds.
3. Import it into the new manager straight away.
4. Spot-check that it's correct (log in to a few sites).
5. Delete the csv file immediately, and also empty the computer's recycle bin.
6. Then turn off password saving in the browser, so a second, outdated copy doesn't get created.

You move over the spreadsheet with passwords by entering the details into the manager by hand (or by importing it as csv, following the same rules). Then delete the spreadsheet, including from the recycle bin and the version history of the old cloud. Change the most important passwords it contained, as you don't know who may have seen the file over the years.

Also watch out for passkeys (lesson 7.3). A passkey stored in your Google or Apple account can't always be exported. For important sites, create a new passkey in your new manager, or make sure you know your password and second step, before closing the old account.

Sharing within a team

Some passwords belong to the organisation, not to a person: the bank, the wholesaler, the social media accounts, the wifi. Use a shared vault or collection in the manager for these:

• Create a vault per group: "Shop", "Administration", "Management". Not everyone needs to see everything.
• Never share a password via chat or email. Not even "just quickly".
• If someone leaves, remove them from the shared vaults and change the passwords they had access to and may have remembered or copied.

The master password and the day something goes wrong

The master password is the only key. Choose a long phrase of four to six random words that you don't use anywhere else. Also turn on two-factor authentication for the manager itself.

Arrange recovery in advance:

• Keep the recovery key or emergency access your manager offers on paper, in a safe place.
• Agree, for the organisation, who gets access if the owner dies or is seriously ill for a long time. Many managers have a feature for emergency access.
• The backup codes for your most important accounts belong here too, or on paper (lesson 7.3). Not in a vault you can only access using those same accounts.

In practice: what it looks like with a provider

A WebOké Nextcloud doesn't include a separate password manager; you use a password manager of your choice. If you use KeePassXC, you can put the encrypted vault file in your Nextcloud, so it's available via the desktop app on all your computers and can be restored via versions. The file is then encrypted with your master password before it reaches the server. The guide on securing your WebOké Nextcloud itself recommends a password manager, and names it as a good place for your backup codes.

With other European cloud services it works in a similar way: the password manager is usually a separate service or app alongside your cloud.

Summary

• Passwords in the browser of your old account disappear with it when you close that account. Move them over beforehand.
• A password manager encrypts on your own device; the master password is the only key.
• A csv export is unencrypted: never put it in a synced folder, import it immediately, delete it immediately.
• Use shared vaults per group for the organisation's passwords, and change them when someone leaves.
• Arrange recovery and emergency access in advance, on paper.

Quiz

Exercise

Exercise E7.4: Mapping your passwords and a plan to move them. Find out where the passwords in your organisation are currently stored (browser per person, spreadsheets, notes, shared accounts), choose a password manager using the five questions from lesson 2.1, and write the migration plan: who exports what, on which computer, when the csv file is deleted, and which shared vaults will be created.

Further reading

The steps in these articles apply to WebOké's services; with other providers it works in a similar way.

• Nextcloud manual 3.1: How does WebOké secure your Nextcloud?
• Nextcloud manual 3.3: Setting up an authenticator app and saving backup codes
• NCSC, Getting started with cybersecurity (Dutch National Cyber Security Centre): https://www.ncsc.nl/beginnen-met-cybersecurity
• KeePassXC: https://keepassxc.org/