Post by @rmondello@hachyderm.io

Here’s the blog post I promised y’all on how I recommend switching password managers in 2026! It covers:
- why your iPhone or iPad, and not your Mac, might be the place to start your switch
- when to make the switch and how to treat your “old” app going forward
- tips and tricks for switching to Apple Passwords, if that’s where you’re going (can be skipped!)
- the recent controversy in password management and some thoughts on values

https://rmondello.com/2026/09/07/switching-password-managers-2026/

0 Boosts

0 Likes

tylercheung

@tylercheung@mastodon.social 13 hr. ago

@rmondello I've mostly switched over from 1password 7 installs, just some secure notes/text fields didn't seem to make it over from whatever export file format I outputted from 1password

Now I just have to sit down and either use iCloud for windows for my windows firefox usage at work, or maybe figure out a way to regularly sync the work entries from Apple Passwords to Firefox's password manager....

Darren :verified: :verified:

@lywyn@mstdn.social 16 hr. ago

@rmondello I signed up for a year of NordPass and then was immediately blocked from using with work machines due to security policy. NO VPNs. Which is enforced by blocking the authentication websites for VPN services. NordVPN uses the same authentication site for NordPass so blocked. I was advised to use s service that did not offer a VPN service as well 🤦‍♂️🤦‍♂️

Ricky Mondello

@rmondello@hachyderm.io 15 hr. ago

@lywyn big oooof. hopefully you can get your money back?

Darren :verified: :verified:

@lywyn@mstdn.social 14 hr. ago

@rmondello I kept it and told them to provide me with an approved service for work devices. Now they get annoyed because I insist on waiting until I get home to do work that uses my own personal accounts. Which means if I get challenged for my password on GitHub, I have to find alternative things to do until I get home. Stuff gets delayed.

John Ulrik

@ujay68@mastodon.world 16 hr. ago

@rmondello Talking about features, also of other PW managers: 1. There’s an iOS feature that forces FaceID or TouchID for some access on stolen devices, disabling the device code. Does this extend to the Apple Passwords app? 2. Any chance of getting attachments on a list of possible features? That’s the one reason I use an extra local non-synced keepass db for some secret information.

J.P. Stewart

@jpsays@mastodon.social 16 hr. ago

@rmondello

Thank you for this!

I was delaying and thinking too hard about how to transfer.

I had no idea. But this really did make it easy and indeed covered passkeys too.

Thanks as well for your work making this possible and for sharing your thoughts. Technology, just as society, isn’t morally neutral, agree. (Hence, why I’m interested in this.)

Bitwarden Screenshot

Import successful!
1,213 items successfully imported
Passwords 1135
Passkeys 21
Cards 3
Identities 2
Secure notes 50
SSH keys 2 — Bitwarden Screenshot Import successful! 1,213 items successfully imported Passwords 1135 Passkeys 21 Cards 3 Identities 2 Secure notes 50 SSH keys 2

Farhan Ahmed

@macronaut@mas.to 16 hr. ago

@rmondello this is wonderful; thank you!

I have started the migration away from 1Password to Apple Password. This should fine in the interim.

The two things that isI don’t necessary like are that, 1.) the idea of the password manager updates tied to OS updates; to me that is a coupling that does not make sense. And 2.) Apple Password is bad at cross browser (Safari is not my primary browser) and platform interoperability.

Again, not really a deal breaker in the short term; but more than likely I will be looking at another migration to something that works better cross platform and cross browser.

cthos 🐱

@cthos@mastodon.cthos.dev 16 hr. ago

@rmondello Oh hey I didn't know you were responsible for breaking CXF into its own proposal. Neat.

John Ulrik

@ujay68@mastodon.world 16 hr. ago

@rmondello Thanks for the write-up and for taking such a clear ethical stance.

Chris Walker

@cwalkatron@mastodon.social 17 hr. ago

@rmondello This is great! Any possibility of an Apple Passwords app on Linux?

leo vriska :light2:

@leo@60228.dev 17 hr. ago

@rmondello out of curiosity (this wouldn't actually benefit me), are there plans for a web client for linux/chromeos like google's password manager has?

Ricky Mondello

@rmondello@hachyderm.io 17 hr. ago

@leo I can’t comment on future plans, but if that’s something that’d make your life better, you are not best served by Apple Passwords today. (I’m personally a fan of Bitwarden because of their cross platform flexibility while being a good citizen on platforms..)

vera grey :verifiedplural:

@QuietMisdreavus@squad.town 18 hr. ago

@rmondello i recently switched from Bitwarden to Apple Passwords. i learned firsthand about the iOS-native transfer functionality when i started off with the “old way” and realized that none of my passkeys moved over 😅

it bums me out that there’s no Linux or Android support, but right now those OSs are secondary experiences for me and i’m fine leaving them out

good post!

Ricky Mondello

@rmondello@hachyderm.io 17 hr. ago

@QuietMisdreavus I recommend Bitwarden for folks who spend non-trivial amounts of time on Linux and Android. Cross-platform, but they put the effort in to be a good platform citizen.

Mat Gadd

@Drarok@mastodon.social 12 hr. ago

@rmondello we’ve moved to Bitwarden at work and I must admit I am *not* inclined to migrate to it. The search only looks for the literal string you type, there are no search operators at all, and it doesn’t search all fields, making it useless for whole swathes of use cases.
My search for a better alternative continues.

Proxfox Virtual Environment 🦊

@tay@tech.lgbt 18 hr. ago

@rmondello
> Your credentials are yours to take and manage. [...] We just needed to figure out how to enable that in a phishing-resistant way. [...] I’m talking about manually exporting an unencrypted file and [...] that was going to be a non-starter for passkeys because a threat actor could trick someone into exporting their data and then uploading it to them. That’s called phishing.

So, they're _NOT_ mine to take and manage? I do understand the need for the general population to have these bulletproof anti-foot-gun mechanisms, but, and I don't like having to export to an unencrypted file, but the point about being locked in & controlled by your password manager is still valid because, I don't think 1P or Apple Passwords will give me my passkeys outside of an Apple Approved transfer. If I, a sufficiently savvy user device that, I do in fact want to upload my passkeys to a sketchy website, that should be my own mistake. Computer should not say no.

leo vriska :light2:

@leo@60228.dev 17 hr. ago

@tay @rmondello there's nothing stopping you from transferring to an app that uses a file-backed database (like Strongbox which is recommended on the KeePassXC site as a compatible iOS client)

Ricky Mondello

@rmondello@hachyderm.io 17 hr. ago

@leo @tay Computers shouldn’t say no to taylor. But there are so many people losing accounts and money every day due to phishing scams. As a society, we need to protect those people.

The workaround that vriska describes is available to you.

Benjamin Schmidt

@bluefirex@mastodon.online 18 hr. ago

@rmondello I was not aware of the secure transfer on iOS. That makes it easy for me switch to Apple Passwords once the 27 OSes are out (still running 15 on my Mac which misses new features there I need)

Thomas Fuchs

@thomasfuchs@hachyderm.io 18 hr. ago

@rmondello I don't personally need this, but I think a great addition to Apple Passwords (which I love) would be apps for Android and Linux. Let the powers that be know. :)