Password managers migration

LastPass → Dashlane

Move vault items, custom fields, TOTP, passkeys, attachments, shared access, identity policy, recovery, and audit evidence from LastPass into Dashlane with an explicit exception ledger and evidence-based cutover.

Typical timeline10–25 business days45–90 hours active work

Statusneeds review

Source testedLastPass documentation reviewed 2026-07-19

Destination testedDashlane documentation reviewed 2026-07-19

Last reviewed2026-07-19

Sources2

Before you migrate

Should you make this move?

Both platforms have a case. Compare what you gain with what you give up before scheduling the cutover.

Current platform

LastPass

Reasons to stay

Familiar clients and broad enterprise deployment options reduce adoption friction
Centralized credential management improves sharing, recovery, and auditability

Reasons to leave

Past security incidents and product trust concerns remain a material decision factor
A migration mistake can affect access to every other critical system

New platform

Dashlane

What gets better

Polished credential sharing, monitoring, and business administration reduce adoption friction
Centralized credential management improves sharing, recovery, and auditability

What gets worse

Export fidelity, plan costs, and proprietary administration constrain portability
A migration mistake can affect access to every other critical system

Best of the move

Dashlane: Polished credential sharing, monitoring, and business administration reduce adoption friction. This removes a major source-side concern: Past security incidents and product trust concerns remain a material decision factor.

Worst of the move

What you lose: Familiar clients and broad enterprise deployment options reduce adoption friction. What you inherit: Export fidelity, plan costs, and proprietary administration constrain portability.

01At a glance

Know the shape of the move.

Transfer outcome12 features audited

Clean0

Partial8

Manual2

Lost2

Mapping route9 of 9 fields have a destination path

SourceLastPass9 mapped fields

Automatic1

Transform5

Manual3

Unsupported0

DestinationDashlane9 supported paths

This timeline assumes

Up to 1,000 users, 100 shared vaults, and 100,000 items
A security owner controls both platforms, identity policy, recovery, and user communications.
Exports are created on a trusted encrypted device with backup sync paused.
A small vault containing every item type is migrated before organization-wide rollout.
The migration team records evidence for every blocking verification check.

02Loss matrix

What survives the move.

“Partial” and “manual” are not footnotes. They are work that must be scheduled and verified.

Item	Outcome	Impact	What happens	Mitigation
Login items, secure notes, identities, cards, fields, folders, and TOTP	partial	critical	Core login items, secure notes, identities, cards, fields, folders, and totp can move, but LastPass and Dashlane use different models, limits, identifiers, and import behavior.	Pilot every feature class, preserve source IDs, and reconcile accepted, transformed, rejected, and excluded items.
Sharing, attachments, passkeys, history, recovery, policies, and audit evidence	manual	critical	LastPass-specific runtime configuration and historical evidence do not become native Dashlane behavior through the core data transfer.	Inventory every active dependency, approve its destination disposition, and test the replacement before source writes stop.
Login items	partial	critical	Websites, usernames, passwords, notes, and selected fields can move through supported formats.	Compare counts and high-value records without exposing secret values in evidence.
Vaults, collections, and folders	partial	critical	Organization, vault, folder, and collection models differ.	Design destination ownership and sharing before import.
Custom fields and item types	partial	high	Rich item types and custom fields can flatten or be excluded by CSV.	Use the richest supported format and test every item type.
TOTP secrets	partial	critical	One-time-password seeds may transfer as fields but must be proven safely.	Test codes for a controlled sample and rotate high-risk seeds.
Passkeys	partial	critical	Export support depends on platform, operating system, format, and credential-exchange compatibility.	Inventory every passkey and re-register any unsupported credential.
Attachments and documents	partial	high	Attachments may require a separate archive or manual upload.	Reconcile every attachment without placing it in an insecure working folder.
SSH keys, cards, identities, and secure notes	partial	high	Non-login items require richer formats and destination support.	Test each class and preserve an encrypted source backup.
Shared access and permissions	manual	critical	Membership, groups, policies, and item sharing do not transfer safely with personal data.	Rebuild least-privilege access and test every role.
Item history, trash, and deleted items	lost	high	Exports commonly omit revision history and deleted or trashed records.	Retain an encrypted source backup through the approved period.
Emergency access and recovery	lost	critical	Trusted contacts, recovery policies, and break-glass procedures are platform services.	Configure and rehearse destination recovery before cutover.

03Field and feature mapping

Where each thing goes.

Source	Destination	Method	Notes
LastPass account or organization	Dashlane account or organization	manual	Configure policy and recovery before data.
Vault, folder, or collection	Destination vault, folder, or collection	transform	Approve ownership and sharing.
Login	Login	automatic	Verify URL, username, password, notes, and favorite state.
Custom field	Destination custom field or note	transform	Preserve concealed status where supported.
TOTP secret	Destination one-time password	transform	Test current codes safely.
Passkey	Destination passkey or re-registration task	manual	Use credential exchange only where both clients support it.
Attachment or document	Destination attachment or document	transform	Transfer separately when required.
Card, identity, secure note, or SSH key	Destination supported item type	transform	Use the richest supported export.
Shared membership and permission	Destination member and access rule	manual	Apply least privilege after import.

04Before you begin

Make the move recoverable.

Backup procedure

Create the source-of-truth backup

Preserve LastPass data, configuration, and operating evidence before any destination write.

Create an encrypted administrative backup of LastPass personal and organization vault data.
Inventory item types, folders, shared vaults, attachments, passkeys, users, groups, policies, and integrations without logging secrets.
Record counts by ownership, item type, access group, attachment, and unsupported class.
Pause backup sync before any plaintext export and record secure deletion responsibilities.

Proof to capture: A signed manifest reconciles every scoped record class, runtime dependency, export file, count, and hash.

Transformation · Encrypted inventory and migration workbook

Vault and access map

Separate personal and organization ownership and rebuild least privilege.

Inventory source values and exceptions.
Define explicit destination mappings.
Reject unmapped critical records.

Proof to capture: Save the input, output, command or tool settings, warnings, and final item counts.

Transformation · Official exporter/importer and secure verification checklist

Rich-format import and exception ledger

Transfer supported items without silently dropping secret classes.

Normalize encoding, dates, identifiers, and blanks.
Run a representative pilot.
Reconcile accepted, rejected, and transformed rows.

Proof to capture: Save the input, output, command or tool settings, warnings, and final item counts.

05Handle with care

The things most likely to hurt.

These are operating limits. Treat every “Stop if” condition as a blocked migration, not a suggestion.

Export

Plaintext exports leak secrets

criticalpossible likelihood

An unencrypted file reaches cloud sync, backups, email, logs, or another user.

Consequence: The entire credential set is compromised.
Mitigation: Use the richest secure transfer path, isolate plaintext, and rotate if exposure is possible.

Stop if: The working file cannot be accounted for and securely deleted.

Import

A successful import omits high-risk item types

criticalpossible likelihood

Counts look plausible while passkeys, TOTP, attachments, or shared items are absent.

Consequence: Users are locked out or retain unsafe source dependence.
Mitigation: Reconcile by item type and test controlled credentials.

Stop if: Any critical credential lacks a verified destination or re-registration task.

Access

Source and destination sharing differ

criticalpossible likelihood

Imported items land in personal or broadly shared containers.

Consequence: Secrets become unavailable or overexposed.
Mitigation: Build and test destination access before organization rollout.

Stop if: Any test user gains unauthorized secret access.

06Precise timeline

Do the work in this order.

Estimate forUp to 1,000 users, 100 shared vaults, and 100,000 items

Total elapsed10–25 business days

Active work45–90 hours

BufferAdd time for large exports, unsupported LastPass features, destination limits, identity exceptions, regulated data, or strict downtime requirements.

Days 1–3Inventory and decisions2–3 days

Days 3–5Backup and reconcile1–3 days

Days 5–12Map and pilot3–8 days

Days 10–20Final delta and switch1–5 days

Days 12–40Observe and close3–10 days

1
Days 1–3 · inventory
Inventory and decisions
6–12 hours active2–3 days elapsedOwner review waiting
- Inventory LastPass data, features, users, domains, and integrations.
- Approve scope, owners, mappings, and exclusions.
Depends on: LastPass and Dashlane administrator access
Stop / go checkpoint
Export?
Go when: Every critical item has an owner and disposition.
Stop when: Consent, billing, access, or system ownership is unclear.
2
Days 3–5 · backup
Backup and reconcile
5–10 hours active1–3 days elapsedExport processing waiting
- Create immutable exports and configuration evidence.
- Reconcile counts, totals, and hashes.
Depends on: Approved inventory
Stop / go checkpoint
Transform?
Go when: Source totals and export manifests agree.
Stop when: Any critical dataset or configuration is absent.
3
Days 5–12 · pilot
Map and pilot
10–35 hours active3–8 days elapsedDestination processing and review waiting
- Configure Dashlane and transform representative data.
- Run a pilot containing normal records and every critical edge case.
Depends on: Verified backup
Stop / go checkpoint
Scale?
Go when: Pilot mappings, behavior, access, and evidence pass.
Stop when: Any critical check fails or produces unexplained variance.
4
Days 10–20 · cutover
Final delta and switch
5–25 hours active1–5 days elapsedDNS, import, or sync propagation waiting
- Freeze production writes in LastPass.
- Apply the final delta, switch ownership, and run blocking checks.
Depends on: Passed pilot and approved rollback
Stop / go checkpoint
Open production?
Go when: Counts reconcile and one destination system owns production.
Stop when: A source writer remains active or a blocking check fails.
5
Days 12–40 · observe
Observe and close
3–18 hours active3–10 days elapsedOperating-cycle evidence waiting
- Monitor one complete operating cycle.
- Sign the verification report and close rollback only after stability.
Depends on: Verified cutover
Stop / go checkpoint
Close rollback?
Go when: No trigger occurs during the agreed observation period.
Stop when: Data, access, delivery, routing, or business results regress.

07The point of change

Cut over with a way back.

Go live

Cutover

Make Dashlane the only production system without losing the final LastPass delta.

Recommended window: A low-volume weekday morning with platform, data, DNS, and business owners available.

Freeze production writes and scheduled actions in LastPass.
Export, transform, and reconcile the final delta.
Apply the approved delta to Dashlane.
Switch domains, forms, integrations, sending, or sync ownership as applicable.
Run every blocking verification check and keep the source intact.

Proof to capture: Dashlane owns production, totals reconcile, and every blocking check has durable evidence.

Return to safety

Rollback

Return production ownership to LastPass without losing destination-era changes.

Deadline: Within seven days and before source data, plans, credentials, domains, or billing are changed.

Stop new writes and scheduled actions in Dashlane.
Restore the prior LastPass routing, forms, integrations, sending, or sync ownership.
Export the Dashlane post-cutover delta.
Review and apply safe destination-era changes to LastPass.
Run the same blocking checks against the restored source.

Proof to capture: LastPass again owns production with current data and no duplicate destination action.

Rollback immediately when

Unexplained critical count or value variance
Missing or exposed critical data
Duplicate production action
Failed access, routing, delivery, or integration check
A critical feature has no safe destination replacement

08Verification report

Prove the migration worked.

Every blocking check must pass. Capture the evidence before cleanup begins.

ID	Check	Method	Expected result	Evidence
`V-01`Blocking	Item reconciliation	Compare counts by owner, vault, folder, item type, and attachment.	Every scoped item is imported or has a re-creation task.	Count ledger without secrets.
`V-02`Blocking	Credential operation	Test a controlled high-risk and stratified account set.	URL, username, password, and autofill work as approved.	Redacted test log.
`V-03`Blocking	TOTP and passkeys	Exercise controlled TOTP and passkey credentials.	Every tested credential works or is re-registered.	Redacted MFA report.
`V-04`Blocking	Fields and item types	Inspect every item class and custom-field pattern.	Required values and concealment are preserved.	Type matrix.
`V-05`Blocking	Attachments and documents	Compare counts and open controlled files.	Every required attachment is present and protected.	Attachment ledger.
`V-06`Blocking	Vault and collection permissions	Test representative members, groups, admins, and leavers.	Least privilege matches policy.	Access evidence.
`V-07`Blocking	Enrollment and break glass	Rehearse new-device, recovery, and offboarding paths.	Approved recovery objectives pass.	Recovery report.
`V-08`Blocking	Export deletion and source freeze	Account for working files, backups, clients, policies, and integrations.	Dashlane is authoritative and plaintext exports are securely deleted.	Security sign-off.

09Post-migration cleanup

Remove the scaffolding safely.

Safe after: One complete operating cycle, at least seven stable days, and owner sign-off on every blocking check.

Create final LastPass exports and archive verification evidence.
Revoke temporary credentials, API keys, webhooks, and elevated roles.
Remove obsolete embeds, forms, jobs, integrations, and DNS records.
Keep the source intact through the approved retention window.
Cancel paid plans only after billing, legal, and recovery review.
Schedule the next Dashlane backup, access, and migration-playbook review.

Sources and maintenance

Built to be reviewed.

Tested 2026-07-19. Next scheduled review: 2026-10-19.

LastPass: official migration documentationAccessed 2026-07-19
Dashlane: official migration documentationAccessed 2026-07-19

Know the shape of the move.

This timeline assumes

What survives the move.

Where each thing goes.

Make the move recoverable.

Create the source-of-truth backup

Vault and access map

Rich-format import and exception ledger

The things most likely to hurt.

Plaintext exports leak secrets

A successful import omits high-risk item types

Source and destination sharing differ

Do the work in this order.

Inventory and decisions

Export?

Backup and reconcile

Transform?

Map and pilot

Scale?

Final delta and switch

Open production?

Observe and close

Close rollback?

Cut over with a way back.

Cutover

Rollback

Prove the migration worked.

Remove the scaffolding safely.

Built to be reviewed.