Google has introduced an Android transfer system that lets users move passwords and passkeys directly between supported password managers without first creating a downloadable export file.
The transfer starts in the password manager receiving the credentials. Android detects other password managers on the device, sends the user to the existing provider to select and authorize the data, then coordinates the exchange between the two apps.
Google says the process completes in seconds and keeps the user in control of which credentials are transferred. The design also removes the need to save passwords in an unencrypted text file, which was a common part of older export and import procedures.
Passkeys presented a separate portability problem because they generally had to be recreated on individual websites and apps when a user changed credential providers. The Android mechanism can now include those cryptographic credentials in the same transfer as conventional passwords.
A passkey uses a cryptographic key pair instead of a shared password. The private key remains under the user’s control in a device or credential manager, while the website retains a public key that can verify a signed authentication response.
The first participating services are Google Password Manager, 1Password, Bitwarden and Dashlane, with additional providers expected to add support. Both importing credentials into Google Password Manager and exporting them to another participating service are supported.
The change applies to devices running Android 8 or later. It follows a broader push to make passkeys easier to use across devices and services as organizations move away from passwords. Singapore recently extended Singpass passkeys to Android users, bringing the national authentication service’s passwordless option to both major mobile platforms.
Credential portability also affects how users respond to security problems or provider changes. Research by Unit 42 identified attack paths around Google Password Manager passkeys that depended on account compromise or access to a synchronized device rather than a break in passkey cryptography.
Google’s new flow does not alter how an individual passkey authenticates a user to a website. It changes how the credential can be moved between managers, with Android acting as the coordinator and both the receiving and existing apps participating in the authorized exchange.
Sources: Google
–
By the ID Tech Editorial Team
