pass-import(1)

📦 version 3.5, in fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0

💖 NAME 💖

okay so bestie, welcome to the manual for pass-import(1) — she's a pass(1) extension for importing data from most of the existing password manager. yes, most. we get into the numbers down below. 🫶

✨ SYNOPSIS ✨

pass import [options...] src [src]

🦋 DESCRIPTION 🦋

okay so pass import is a password store extension that lets you import your password database into a password store repository, conveniently, like a little queen. 👑

it natively supports import from 62 different password managers. sixty-two!! and more manager support can easily be added, so the roster only grows. 💅

passwords get imported into the existing default password store, so the password store must have been initialized before with pass init. no store, no import, that's the vibe check. ✨

by default, pass imports entries at the root of the password store and only keeps the main data (password, login, email, URL, group). want more? that behaviour can be changed using the provided options. 😌

pass import handles duplicates and is compatible with browserpass. it imports OTP secret in a way that is compatible with pass-otp. obsessed. 🎀

pass-import also provides a pimport script that allows importing passwords to other password managers. for instance, you can import passwords from Lastpass to a Keepass database. it currently supports password export from 8 managers. iconic. 🌈

👑 COMMAND 👑

pass import [options...] src [src]

the arguments & options, one by one 🍓

  • src [src] — bestie this can mean two things: either the path to the data you want to import, or the password manager name followed by the path to the data to import. if you only hand over the path, pass-import auto-detects the data format for you like the main character it is. the complete list of supported managers lives in the SUPPORTED MANAGERS section, and you can also get it with pass import --list.
  • --root=<path>, -r <path> and --path=<path>, -p <path> — specific root source and destination directory to use in the password store. --root refers to the source repository and will only import the password from a specific subfolder. --path refers to the destination repository and will import the passwords to a specific subfolder. source vs destination, don't mix them up. 💅
  • --key=<path>, -k <path> — if a password manager requires it, you can pass a key file using --key or -k along with the path to the keyfile to use. 🔑
  • --all, -a — conserve and import all the data present in the backup file. otherwise, only title, password, login, URL, comments, and group data are imported. all-or-default, pick your fighter. ✨
  • --force, -f — the import process will overwrite an existing password entry if it already exists. bold move, but okay. 😭
  • --clean, -c — clean the password path in order to be more command line friendly.
  • --convert, -C — convert the invalid characters present in the paths before import. invalid characters for both Windows and Unix systems are supported. the default separator replaces the invalid characters: -
  • --sep=<char> — provide a character of replacement for the path separator. default: -
  • --del=<char> — provide an alternative CSV delimiter character. default: ,
  • --cols=<char> — set the expected CSV columns to map columns to credential attributes. only used for the generic csv importer. 🍓
  • --config=<path> — pass-import will consider this config file instead of the default one .import.
  • --list, -l — print the list of the available password manager. with the verbose option (-v) it provides the python class name to use to be given as src. it can be useful to bypass the automatic format detection. also supports the quiet option (-q). 💜
  • --help, -h — print the program usage. if the option is specified along with an argument and if this argument is a supported password manager, it prints usage for that manager. per-manager help, so fancy. ✨
  • --verbose, -v — be more verbose. this option can be specified multiple times to set the verbosity level. stack it like a filter, bestie.
  • --quiet, -q — be quiet 🤫

🌸 BASIC USAGE 🌸

to import password from any supported password manager, simply run:

pass import path/to/passwords

if pass-import is not able to detect the format, you need to provide the password manager you want to import data from:

pass import <pm> path/to/passwords

if you want to import data to a password manager other than pass, run:

pimport <new_pm> <former_pm> path/to/passwords --out path/to/destination/pm

🧚 EXAMPLES 🧚

Import password from KeePass 🎀

pass import keepass.xml
(*) Importing passwords from keepass to pass
 .  Passwords imported from: keepass.xml
 .  Passwords exported to: ~/.password-store
 .  Number of password imported: 6
 .  Passwords imported:
          Social/mastodon.social
          Social/twitter.com
          Social/news.ycombinator.com
          Servers/ovh.com/bynbyjhqjz
          Servers/ovh.com/jsdkyvbwjn
          Bank/aib

this is the same as: pimport pass keepass.xml –out ~/.password-store

Import password to a different password store 💜

export PASSWORD_STORE_DIR="~/.mypassword-store"
pass init <gpg-id>
pass import keepass.kdbx

Import password to a subfolder 🦋

pass import bitwarden.json -p Import/
(*) Importing passwords from bitwarden to pass
 .  Passwords imported from: bitwarden.json
 .  Passwords exported to: ~/.password-store
 .  Root path: Import
 .  Number of password imported: 6
 .  Passwords imported:
          Import/Social/mastodon.social
          Import/Social/twitter.com
          Import/Social/news.ycombinator.com
          Import/Servers/ovh.com/bynbyjhqjz
          Import/Servers/ovh.com/jsdkyvbwjn
          Import/Bank/aib

Other examples ✨

  • if the manager is not correctly detected, you can pass it at source argument
pass import dashlane dashlane.csv
  • import NetworkManager password on default dir
pass import networkmanager
  • import a NetworkManager INI file
pass import nm.ini
  • import a One password 1PIF
pass import 1password.1pif
  • import a One password CSV
pass import 1password.csv
  • import a Passman JSON file
pass import passman.json
  • import Lastpass file to a keepass db
pimport keepass lastpass.csv --out keepass.kdbx
  • import a password store to a CSV file
pimport csv ~/.password-store --out file.csv

🔑 GPG KEYRING 🔑

before importing data to pass, your password-store repository must exist and your GPG keyring must be usable. in order words you need to ensure that:

  • all the public gpgids are present in the keyring. 💅
  • all the public gpgids are trusted enough.
  • at least one private key is present in the keyring.

otherwise, you will get the following error: invalid credentials, password encryption/decryption aborted. 😭 to set the trust on a GPG key, one can run gpg --edit-key <gpgid> then trust.

🛡️ SECURITY CONSIDERATION 🛡️

Direct import 🌟

passwords should not be written in plain text form on the drive. therefore, when possible, you should import it directly from the encrypted data. for instance, with an encrypted keepass database:

pass import keepass file.kdbx

Secure erasure 💀

otherwise, if your password manager does not support it, you should take care of securely removing the plain text password database:

pass import lastpass data.csv
shred -u data.csv

Encrypted file 🔒

alternatively, pass-import can decrypt gpg encrypted file before importing it. for example:

pass import lastpass lastpass.csv.gpg

Mandatory Access Control (MAC) 🛡️

AppArmor profiles for pass and pass-import are available in apparmor.d. if your distribution supports AppArmor, you can clone the repository and run:

make
sudo make install pass pass-import

to only install these apparmor security profiles.

Network 🌐

pass-import only needs to establish network connection to support cloud based password manager. if you do not use these importers you can ensure pass-import is not using the network by removing the network rules in the apparmor profile of pass-import.

Password Update 🔄

you might also want to update the passwords imported using pass-update(1).

🎀 CONFIGURATION FILE 🎀

some configurations can be read from a configuration file called .import if it is present at the root of the password repository. the configuration read from this file will be overwritten by their corresponding command-line option if present. 💅

example of the .import configuration file for the default password repository:

zx2c4@laptop ~ $ cat ~/.password-store/.import

---

# Separator string
separator: '-'

# The list of string that should be replaced by other string. Only activated
# if the `clean` option is enabled.
cleans:
  ' ': '-'
  '&': 'and'

# The list of protocol. To be removed from the title.
protocols:
  - http://

# The list of invalid characters. Replaced by the separator.
invalids:
  - '<'
  - '>'

okay that's part one bestie, there's literally more coming ✨

✨ SUPPORTED MANAGERS ✨

Okay bestie, here's the full rundown of every single manager we can import from. Each one has its own little setup, but don't stress — we got you. 💅

🔐 1password (csv) v8

🔐 1password (1pif) v4

🔐 1password (csv) v4

🔐 1password (csv) v6

🛡️ aegis (json) — plain export

🛡️ aegis (json) — encrypted export

📱 andotp (json)

🍎 apple-keychain (keychain)

🔒 bitwarden (csv)

  • Website: https://bitwarden.com
  • Export: Tools> Export Vault> File Format: .csv
  • Command: pass import bitwarden file.csv

🔒 bitwarden (csv) — again

  • Website: https://bitwarden.com
  • Export: Tools> Export Vault> File Format: .csv
  • Command: pass import bitwarden file.csv

🔒 bitwarden (json)

  • Website: https://bitwarden.com
  • Export: Tools> Export Vault> File Format: .json
  • Command: pass import bitwarden file.json

🔒 bitwarden (json) — again

  • Website: https://bitwarden.com
  • Export: Tools> Export Vault> File Format: .json
  • Command: pass import bitwarden file.json

🌫️ blur (json)

  • Website: https://abine.com
  • Export: Settings: Export Data: Export Blur Data
  • Command: pass import blur file.json

🌫️ blur (csv)

  • Website: https://abine.com
  • Export: Settings: Export Data: Export CSV: Accounts: Export CSV
  • Command: pass import blur file.csv

🧈 buttercup (csv)

  • Website: https://buttercup.pw
  • Export: File > Export > Export File to CSV
  • Command: pass import buttercup file.csv

🌐 chrome (csv)

🌐 chrome (csv) — guide edition

📋 clipperz (html)

  • Website: https://clipperz.is
  • Export: Settings > Data > Export: HTML + JSON
  • Command: pass import clipperz file.html

📊 csv (csv)

You should use the –cols option to map columns to credential attributes. The recognized column names by pass-import are the following: title, password, login, email, url, comments, otpauth, group. The title and group fields are used to generate the password path. If you have otp data, they should be named as otpauth. These are the standard field names. You can add any other field you want.

  • Export: Nothing to do
  • Command:
pass import csv file.csv –cols `url,login,,password'

🚀 dashlane (csv)

  • Website: https://www.dashlane.com
  • Export: File > Export > Unsecured Archive in CSV
  • Command: pass import dashlane file.csv

🚀 dashlane (json)

  • Website: https://www.dashlane.com
  • Export: File > Export > Unsecured Archive in JSON
  • Command: pass import dashlane file.json

🕷️ encryptr (csv)

🔐 enpass (json) v6

  • Website: https://www.enpass.io
  • Export: Menu > File > Export > As JSON
  • Command: pass import enpass file.json

🔐 enpass (csv)

🦊 firefox (csv)

🦊 firefox (csv) — exporter edition

🔑 fpm (xml)

🆓 freeotp+ (json)

🐚 gnome (libsecret)

You can provide a gnome-keyring collection label to import. It can be empty to import all collections.

  • Export: Nothing to do
  • Command: pass import gnome-keyring

🐚 gnome-auth (json)

🚀 gopass (gopass)

🦍 gorilla (csv)

🔑 kedpm (xml)

🔐 keepass (kdbx)

🔐 keepass (csv)

🔐 keepass (xml)

🔐 keepassx (xml)

🔐 keepassx2 (kdbx)

🔐 keepassx2 (csv)

🔐 keepassxc (kdbx)

🔐 keepassxc (csv)

  • Website: https://keepassxc.org
  • Export: Database > Export to CSV File
  • Command: pass import keepassxc file.csv

🗝️ keeper (csv)

🚀 lastpass (cli)

🚀 lastpass (csv)

🌸 myki (csv)

🌐 network-manager (nm)

Support import from the installed network configuration but also from a specific directory of NetworkManager configuration file or from a given file.

Example:

- From directory of ini file: pass import networkmanager dir/.
- From ini file: pass import networkmanager file.ini.
  • Export: Also support specific networkmanager dir and ini file
  • Command: pass import networkmanager

🧊 nordpass (csv)

🔒 padlock (csv)

  • Website: https://padloc.app
  • Export: Settings > Export Data and copy text into a .csv file
  • Command: pass import padlock file.csv

🚀 pass (pass)

🚀 passman (csv)

  • Website: https://passman.cc
  • Export: Settings > Export credentials > Export type: CSV
  • Command: pass import passman file.csv

🚀 passman (json)

  • Website: https://passman.cc
  • Export: Settings > Export credentials > Export type: JSON
  • Command: pass import passman file.json

📦 passpack (csv)

🥧 passpie (yaml) v1.0

🔑 pwsafe (xml)

  • Website: https://pwsafe.org
  • Export: File > Export To > XML Format
  • Command: pass import pwsafe file.xml

📖 revelation (xml)

🤖 roboform (csv)

  • Website: https://www.roboform.com
  • Export: Roboform > Options > Data & Sync > Export To: CSV file
  • Command: pass import roboform file.csv

☁️ safeincloud (csv)

🔒 saferpass (csv)

  • Website: https://saferpass.net
  • Export: Settings > Export Data: Export data
  • Command: pass import saferpass file.csv

📦 upm (csv)

☁️ zoho (csv)

☁️ zoho (csv) — again

👀 SEE ALSO

💖 AUTHORS

pass import was written by Alexandre Pujol (alexandre@pujol.io).

And that's the tea, bestie! This page is from February 2024 and it's for pass-import(1). Now go forth and import those passwords like the icon you are. 💅✨

📦 where this page comes from