Migration · 2,800 words · 30-90 min walkthrough

How to migrate from LastPass to Bitwarden — complete walkthrough

Moving boxes in office — migration walkthrough from LastPass to Bitwarden after the 2022 breach

The 2022 LastPass breach pushed many users to consider switching. The technical details — encrypted vaults exfiltrated alongside unencrypted URL fields, slow disclosure, low Bcrypt iteration counts on legacy accounts — made the decision harder to walk back. Bitwarden became the most-recommended replacement: open source, free tier, no breach history, ~70% cheaper Premium tier.

This guide is the walkthrough I wish I'd had when migrating. Tested against current Bitwarden web vault (April 2026). Allow 30-90 minutes depending on vault size and complexity.

Why migrate now (or whether to)

The case for migrating in 2026 isn't urgency — it's accumulating value. Three years after the 2022 breach:

The case for staying on LastPass: minimal switching cost is your main barrier; if your vault is small (under 100 items) and you already pay LastPass Premium for the convenience, the migration time may not return its investment.

Pre-migration prep

Before exporting anything, take stock:

  1. How many items are in your LastPass vault? Open vault, check item count. <50 items = ~30 min migration. 50-500 = ~60 min. 500+ = budget 2 hours.
  2. Are you using LastPass Authenticator for TOTP? If yes, plan TOTP migration separately (covered below).
  3. Do you have file attachments? Secure notes with attached files require manual handling — CSV export doesn\'t include them.
  4. Are you in any LastPass shared folders? Shared folders don\'t migrate via CSV. Recreate as Bitwarden Organisations afterwards.
  5. Is this a workplace LastPass? If your employer manages LastPass, talk to IT before migrating. Workplace SSO and policies complicate things.

Plan ~5 minutes per shared folder for manual recreation, ~5 minutes per attached file. Most personal users have neither.

Step 1: Export your LastPass vault

Method A — Web vault export (most users)

  1. Sign in at lastpass.com.
  2. Click Advanced Options in the left sidebar.
  3. Click Export.
  4. If prompted, re-enter your master password.
  5. LastPass shows your data in CSV format in the browser. Right-click → Save As → save as lastpass_export.csv in a folder you control (not Downloads, which gets backed up to cloud).

Method B — Browser extension export

If web vault export fails (rate-limited, browser issues), use the extension:

  1. Click LastPass icon in browser toolbar.
  2. Account Options → Advanced → Export → LastPass CSV File.
  3. Re-enter master password.
  4. Save the .csv file.

Method C — LastPass CLI

For technical users with the lpass CLI:

lpass login [email protected]
lpass export > lastpass_export.csv
Critical: this CSV contains your passwords in plaintext

Treat the file as if it were a copy of every credential you own. Don't email it. Don't put it in cloud storage. Don't leave it in Downloads. Save to a folder you can wipe. After import, securely delete (covered later).

Step 2: Create your new Bitwarden account

  1. Open vault.bitwarden.com in a new browser window/profile (separate from where LastPass is signed in).
  2. Click Create account.
  3. Fill in: email, name, master password, master password hint.
  4. Pick a master password different from your LastPass master. The 2022 LastPass exfiltration included encrypted master-derived material; reusing the same master means assuming the new vault has the same exposure.
  5. Click Create. Verify the email link.

For master password rules, see our tutorial section on master passwords. Quick recommendation: 5+ random words from EFF diceware, 14+ characters total, never used elsewhere.

Step 3: Import the LastPass CSV

In Bitwarden web vault (signed in to your new account):

  1. Click Tools in the left sidebar.
  2. Click Import data.
  3. From the dropdown, select LastPass (csv).
  4. Click Choose File, select your lastpass_export.csv.
  5. Click Import data.
  6. Wait — Bitwarden parses the file and imports each item. ~5 seconds for 500 items, ~30 seconds for 5000.

You\'ll see a confirmation showing how many items imported and any errors. Check the error count — typically 0 for clean CSV exports. Errors usually mean malformed CSV rows (rare).

Step 4: Verify the import

Sample-check before assuming everything migrated:

  1. Browse a few login entries — confirm username, password, URL match what you had.
  2. Click into a few secure notes — content should be intact.
  3. Check credit card entries — number, expiry, CVV (if you stored those).
  4. Check the item count — should match your LastPass vault size approximately.
  5. Test autofill on 3 sites you know work in LastPass; confirm Bitwarden fills correctly.

If verification finds problems, you can re-import or restart. The web vault makes deletion easy: select all, delete, re-import.

Step 5: Migrate TOTP codes (if applicable)

The CSV export does not include TOTP secrets. They\'re stored in the LastPass Authenticator app separately. Three migration paths depending on what you used:

If you used LastPass Authenticator

  1. Open LastPass Authenticator app, enable cloud backup if not already.
  2. Export the encrypted backup file.
  3. Decrypt using community tool (search GitHub for "lastpass-authenticator-export"). Requires LastPass master password.
  4. Resulting file has TOTP secrets.
  5. For each Premium Bitwarden item: edit → set TOTP secret manually. Or keep using a separate authenticator and don\'t migrate TOTP into Bitwarden at all.

If you used Authy / Google Authenticator / Aegis

Easier — those tools have their own migration paths. Authy → Authy stays as-is, just keep it. Google Authenticator → can export to Aegis on Android. None of this requires touching Bitwarden.

Recommended: re-add TOTP fresh for high-value accounts

Most secure path: visit each high-value account (banking, email, social media), disable old TOTP, re-enable with the new authenticator. Slow but ensures you\'re not relying on potentially-exposed shared secrets from the LastPass era.

Step 6: Migrate file attachments

LastPass supports attaching files to secure notes (Premium tier). CSV export does not include attached files. Manual process:

  1. In LastPass: open each secure note that has attachments.
  2. Download each attached file.
  3. In Bitwarden Premium: open the corresponding imported secure note.
  4. Click Attachments → upload the file.

If you don\'t have Premium ($10/year), Bitwarden free doesn\'t support attachments. Two options: (a) upgrade to Premium for attachment support, (b) keep the files separately encrypted (e.g., 7-Zip with strong password, or VeraCrypt container) outside the password manager.

Step 7: Install Bitwarden everywhere

Now expand from the web vault to the full ecosystem:

Sign in to each with the same email + master password. Vault syncs automatically. Set up biometric unlock on each device.

Step 8: Clean up the export file

Critical security step often missed. Your lastpass_export.csv still exists on disk with all your passwords in plaintext.

macOS / Linux

shred -u -n 3 lastpass_export.csv
# or on macOS
srm -f lastpass_export.csv

Windows

Windows 11 with modern SSDs uses TRIM, so a regular delete + empty Recycle Bin is acceptable. For HDD or extra paranoia, use Eraser or sdelete:

sdelete -p 3 -s -z lastpass_export.csv

Step 9: Cancel LastPass subscription

If you\'re a paid LastPass user, cancel the subscription:

  1. LastPass web vault → Account Settings → Premium → Cancel renewal.
  2. LogMeIn (LastPass\'s parent) will offer to retain account on free tier — accept (your data stays for emergency reference) or fully delete (cleaner).
  3. If you want to fully delete: Account Settings → Delete account. Type confirmation, password, done.

Don\'t cancel until you\'ve verified Bitwarden has all your data and works correctly. ~1 week parallel use is reasonable buffer.

Step 10: Post-migration tasks

Recreate shared folders as Bitwarden Organisations

If you had LastPass shared folders, those don\'t migrate. In Bitwarden:

  1. Free tier supports a single 2-user organisation.
  2. Family plan ($40/year) supports 6-user organisations.
  3. Create the org, add members, share items via Move to Organisation.

Disable LastPass extension

Don\'t leave both extensions installed simultaneously — they fight over autofill. After verification week, remove the LastPass extension from each browser.

Change passwords for high-value accounts

If your LastPass master password was weak, the 2022 breach exposed brute-forceable encrypted vaults. Even on strong masters, a defence-in-depth move: change passwords on email, banking, primary social media accounts. Bitwarden\'s generator handles this in seconds per site.

Set up Bitwarden 2FA

Add 2FA to your new Bitwarden master account. Detailed walkthrough here. TOTP via authenticator app is free; FIDO2 hardware key via Premium.

Schedule periodic exports

Quarterly: export Bitwarden vault as encrypted JSON, save to offline backup (USB stick, encrypted external drive, or printed paper for absolute paranoia). Bitwarden cloud has redundancy, but personal backups are insurance against account lockout.

Final thoughts

Migration from LastPass to Bitwarden is straightforward but takes attention. The CSV path handles 95% of data automatically; TOTP and attachments need manual work; cleanup of the export file is the easy-to-miss security step.

Most personal users complete the migration in 30-60 minutes. Worth the time: better free tier, lower paid tier, open source verifiability, no breach history. The combination is the reason Bitwarden became the canonical "after LastPass" choice.