What “import passwords into Chrome” really means .
Important detail: when you “import passwords into Chrome,” you’re typically importing into Google Password Manager (the password vault Chrome uses). That matters because it affects where the passwords live (local vs cloud), how they sync, and how you should secure the import file.
In most modern Chrome builds, importing passwords uses a CSV file. CSV stands for “comma-separated values,” and it’s basically a simple spreadsheet-like text file. That’s convenient for migrations, but it has one huge downside: a CSV export usually contains your passwords in plain text. If someone gets that file—even briefly—they can read your logins.
This guide focuses on secure import, not just “click the import button.” The secure workflow is: prepare → import → verify → delete → audit. If you follow it, you reduce the most common real-world risks: leaving the CSV on your desktop, emailing it to yourself, syncing it to cloud drives, or importing into the wrong Google account/profile.
Related: If you’re comparing Chrome’s built-in password vault to a dedicated manager, start here: Chrome built-in password manager review and Chrome password manager vs third-party.
Key terms (quick definitions) .
- Google Password Manager: The password vault connected to your Google account and used by Chrome for saved logins and autofill.
- Chrome profile: A separate browser “space” with its own history, extensions, and saved passwords (often tied to a Google sign-in).
- CSV file: A plain-text spreadsheet format. In password exports, it often includes URL + username + password.
- Sync: The process that copies passwords and settings across devices when you sign into Chrome with a Google account.
When importing is the right move (and when it isn’t) .
Importing into Chrome makes sense when you want: quick autofill on devices you already use, minimal setup, and a single Google-account vault you can access at passwords.google.com.
Importing may not be ideal if you need advanced features like team sharing, vault separation, SSO provisioning, detailed access controls, or policy enforcement. In those cases, a dedicated manager (especially for business/enterprise) can be the safer and more controllable approach.
Business angle: If you’re choosing for a team, see Best enterprise password manager for Chrome and Password manager for Chrome (business).
Before you start (security-first checklist) .
The import itself is easy. The risk comes from everything around it: how you export, where you store the CSV, and what happens after. Run these fast checks to avoid the most common “I regret this” outcomes.
- Use a trusted device: Avoid importing from public computers or shared workstations. If you must, use a temporary user account and clear downloads afterward.
- Confirm the correct Chrome profile: Click your profile avatar (top right) → verify the profile name and the signed-in Google account.
- Update Chrome first: Security fixes matter before handling sensitive files. Use Get or Update Chrome.
- Plan where the CSV will live (briefly): Pick a temporary folder you can clean later. Avoid Desktop, Documents, cloud-synced folders, and shared drives.
- Decide on sync behavior: Do you want these passwords to sync to all devices? If not, review your sync settings first: Chrome account sync settings and Disable Chrome sync.
- Know your threat model: If your device might be infected (popups, redirects, “Chrome is acting weird”), fix that first: Remove malware from Chrome.
CSV reality check: In most exports, the password column is readable text. Treat the CSV like you would treat a photo of your credit card: useful for a moment, dangerous if it sticks around.
Related: Want the bigger security picture? Read Are password managers safe for Chrome? and Chrome password storage security.
What you need (minimum) .
- A CSV export from your old password manager or browser (format matters—more below)
- Chrome desktop (Windows/macOS/Linux/ChromeOS) for the most reliable import path
- Access to the Google account you want to store passwords in
What you should avoid (common mistakes) .
- Emailing the CSV to yourself
- Uploading the CSV to cloud drives “just for a minute”
- Leaving the CSV in Downloads/Desktop after import
- Importing into the wrong Chrome profile or the wrong Google account
- Assuming “import finished” means “everything imported correctly” (always verify)
Step-by-step: import passwords into Chrome (desktop) .
This method imports passwords into Google Password Manager through Chrome. The exact labels can vary slightly by platform, but the workflow is consistent.
- 1 Export your passwords from your previous password manager or browser as a CSV. (If you’re exporting from Chrome itself, use: Export passwords from Chrome securely.)
- 2 Move the CSV to a temporary local folder (not Desktop, not cloud-synced). Rename it to something boring like import.csv so it’s easier to find and delete.
- 3 In Chrome, open the menu (⋮) → Passwords and autofill → Google Password Manager → Settings.
- 4 Under Import passwords, click Select file (or Import), then choose your CSV file.
- 5 Follow the on-screen prompts. If Chrome asks you to confirm your device password/biometric, do it (this helps prevent silent imports by other users on the machine).
- 6 Verify the import: open passwords.google.com (or the Password Manager list) and check a handful of critical accounts (email, banking, work tools).
- 7 Delete the CSV file immediately, then also empty Recycle Bin/Trash. (Details below.)
- 8 Run a safety audit: Password Checkup and basic security settings (also below).
What “success” looks like: You can see imported items in Google Password Manager, log in successfully to at least 2–3 test sites, and the CSV file no longer exists on your device (including in the bin/trash).
Related: If you’re importing because you’re leaving another tool, you’ll also want: Migration guide (Chrome ↔ third-party managers).
Common variations (Windows, Mac, ChromeOS) .
- Windows / ChromeOS: You may see “Passwords and autofill” → “Google Password Manager” directly in the main menu.
- macOS: You may be asked for your Mac user password or Touch ID to confirm import/delete actions.
- Linux: Password storage can depend on your keyring setup. If autofill behaves strangely after import, see Troubleshooting.
After import: delete the CSV safely (do this every time) .
Deleting is not optional if you care about security. A password CSV sitting in Downloads is one of the easiest “instant account takeover” assets on a machine. Do all three steps:
- Delete the CSV from its folder
- Empty Recycle Bin / Trash
- Remove duplicates (some exports create copies like import (1).csv)
Security angle: If your device is shared (family PC, work laptop used by multiple people, remote support sessions), consider importing on a personal device instead. CSV exposure risk rises fast when other users can access the filesystem.
Android & iPhone: what’s possible (and what isn’t) .
Password importing is most reliable on desktop Chrome, because selecting local files and managing cleanup is simpler. Mobile can work, but it depends on your device, where the CSV is stored, and whether the Password Manager UI exposes import on your build.
Android: best practice workflow .
On Android, Google Password Manager is integrated into Chrome and system settings on many devices. In general: export your CSV on desktop, transfer it securely to the phone (preferably via cable, not email), import, then delete it from the phone’s storage and Downloads.
iPhone/iPad (iOS): what to expect .
On iOS, Chrome integrates with Google Password Manager, but file import availability can be more limited and sometimes pushes you to do the import via web (passwords.google.com) on a desktop. If you’re unsure, the safest and least frustrating approach is: import on desktop → sync to iPhone by signing into Chrome with the same Google account.
Related: If your real goal is multi-device access, read Password manager multi-device sync.
Advanced: CSV formatting, de-duplication, and safer workflows .
“Import failed” problems usually come down to CSV structure. The good news: you can fix most imports by correcting headers, URL formats, and quote/escape issues.
Related: If you’re doing this in a company environment, start here: Enterprise password manager (Chrome) and Chrome password manager deployment guide.
CSV must-haves (the “boring but critical” details) .
Many imports expect columns like: url, username, password. Some exporters add extra columns (name, note, folder). Extra columns aren’t always a problem, but malformed CSV is.
| Field | What it should look like | Common mistake | What happens |
|---|---|---|---|
| url | https://example.com | Missing scheme (example.com) | Imports but doesn’t match autofill reliably |
| username | Email or login name | Blank values for some sites | Account may import but won’t autofill cleanly |
| password | Actual password text | Quoted/escaped incorrectly | Import fails or passwords get truncated |
| notes (optional) | Short text | Newlines not escaped | Can break rows and corrupt parsing |
How to avoid duplicates (clean migrations) .
Duplicates often happen when: (1) you import multiple times while troubleshooting, (2) you export from two sources (old manager + browser) and combine them, or (3) you have multiple entries for the same site (different subdomains, different usernames).
- Best practice: Import once, verify, then fix the CSV and re-import only if necessary.
- If you must re-import: Consider deleting the newly imported set first (or importing into a fresh profile to validate, then importing for real).
- URL normalization: Use consistent URLs (prefer https://) to improve autofill matching.
Safer workflow for security-conscious users .
If your threat model is higher (shared computers, travel, remote support, sensitive work accounts), use a “minimal exposure” workflow:
- Export offline (disconnect network if your exporter allows it).
- Store CSV in a temporary folder you can confidently delete afterward.
- Import immediately—don’t let the file sit around.
- Delete + empty bin/trash right away.
- Run audits: Password Checkup, device security review, and Chrome safety checks.
When a dedicated password manager is a better “import destination” .
Chrome’s vault is good for many people, but there are real scenarios where importing into a dedicated manager first is smarter:
- Teams: role-based access, shared vaults, audit trails, offboarding
- High-value accounts: stronger policy control, advanced MFA workflows, admin enforcement
- Compliance: where you need documented controls and formal processes
Related comparisons: Password manager vs built-in browser passwords and Password manager vs Chrome passwords.
Privacy & security notes (CSV risk, sync, and audits) .
Importing passwords isn’t just a convenience task—it’s a security operation. The biggest danger is almost never Chrome itself. It’s the CSV file and the environment around it.
Impact: Affects account access, sync behavior, and exposure of credentials if CSV is leaked.
Related: If you’re assessing risks and limitations, read Chrome password manager security risks and Chrome password manager limitations.
Recommended baseline settings after import .
- Run Password Checkup: Find weak, reused, or compromised passwords: Chrome password checkup and Chrome password leak detection.
- Enable strong account protection: Use 2FA on your Google account: Chrome two-factor authentication guide.
- Review sync: Decide whether passwords should sync everywhere: Chrome account sync settings.
- Sanity-check autofill settings: Confirm you’re not over-sharing: Chrome autofill security settings.
Recommended settings by goal .
| Goal | Recommended approach | Tradeoff | Best for |
|---|---|---|---|
| Balanced | Import on desktop, delete CSV, run checkup, keep sync enabled on personal devices | Passwords sync to signed-in devices | Most users |
| Maximum privacy | Import on a trusted device, limit sync, audit extensions, avoid shared machines | More manual management | Tracking-sensitive or high-risk users |
| Enterprise control | Use dedicated manager + policies; use Chrome vault only if governance supports it | Higher cost/complexity | Teams, regulated orgs |
Don’t forget: extensions can see more than you think .
While your password vault is protected, a risky extension can still cause trouble (phishing overlays, redirecting logins, capturing typed data on compromised pages). After a major password migration, it’s a great time to audit extensions—especially those with “read and change data on all sites.”
Related: Audit your add-ons here: Chrome extension security check and Chrome extension permissions guide.
Troubleshooting (imports failing, wrong URLs, duplicates) .
Related: If the issue smells like malware (redirects, popups, weird home page), fix that first: Remove malware from Chrome.
If Chrome says “Can’t import” or nothing happens .
The top causes are: wrong file type, bad CSV formatting, or blocked UI (managed devices). Try this in order:
- Confirm it’s CSV: The file should end with .csv and open like a spreadsheet.
- Check headers: Make sure you have at least url, username, password.
- Open in text editor: Look for broken lines/quotes. Fix, re-save as CSV.
- Split large files: If you have thousands of entries, import in batches (separate CSVs).
- Try a different profile: Create a temporary Chrome profile to test if the issue is profile-specific.
- Check enterprise policy: On managed devices, import/export might be restricted by admin policy.
If imported passwords don’t autofill on the right sites .
Autofill matching is heavily influenced by URL consistency. If your CSV has domains without https://, or has unusual login URLs, Chrome may not match the login form you expect.
- Normalize URLs: Prefer https://example.com over example.com.
- Watch for subdomains: accounts.example.com is different from www.example.com.
- Multiple logins: If you have several usernames for the same site, Chrome may not guess the one you want—click the key icon and choose.
If you get duplicates after re-importing .
This usually happens when you import multiple times while fixing CSV issues. The clean approach:
- Stop importing until you fix the CSV in one go.
- Remove duplicates by searching for the domain and deleting the extra entries.
- For big messes: Consider using a fresh Google account/profile to validate the CSV, then import once into your real vault.
If you need to “reset safely” after a bad import .
A safe reset depends on the damage:
- Minor issue: Delete a handful of wrong entries and re-import a corrected CSV.
- Major issue: Pause, protect your Google account, change critical passwords, and run a full security review.
Related: If your concern is “what if my passwords were exposed,” start here: Chrome browser passwords stolen — what to do.
FAQ .
-
helpIs it safe to import passwords into Chrome?It can be safe if you treat the CSV export as sensitive data, import it immediately, delete it afterward, and protect your Google account with strong security (2FA, device protection, and password audits). The highest risk is usually the CSV file sitting on your device—not the import feature itself.
-
helpWhat CSV format does Chrome/Google Password Manager expect?Most imports work best with columns named url, username, and password. If your exporter uses different headers, you may need to rename them. Always check the CSV in a text editor to make sure rows aren’t broken by unescaped quotes or newlines.
-
helpWhere do imported passwords go—my device or my Google account?In most modern Chrome setups, importing goes into Google Password Manager tied to the Google account you’re signed into. That means passwords can sync across devices (depending on sync settings). Confirm the correct profile/account before importing.
-
helpShould I delete the CSV file after importing?Yes—always. Password CSV exports are commonly plain text. Delete the file and also empty Recycle Bin/Trash. If you don’t, anyone with access to your device (or a backup/sync service) may be able to read your passwords.
Sources & further reading .
- Google Chrome Help: Import or export passwords with Chrome (Desktop)
- Google Chrome Help: Import or export passwords with Chrome (Android)
- Google Account Help: Import passwords to your Google Account
- Google Password Manager overview
- Chrome Releases blog (version context)
Disclosure: Some pages may mention tools or services. Recommendations are editorial and based on practical testing and security best practices.