Android adds secure passkey transfers between supported password managers

Android’s new system-level transfer mechanism replaces ad-hoc credential migration methods with a standardized, encrypted process. Previously, users had to export passwords as unencrypted text files or manually recreate passkeys in a new manager, both of which introduced security risks and operational friction. The change shifts responsibility for secure transfer from individual apps to the OS, which coordinates the process and enforces encryption. This reduces the attack surface for credential theft during migration but requires password managers to adopt the Credentials Transfer API to participate.

The feature’s initial rollout is limited to four major password managers, creating a two-tier ecosystem. For engineers working on smaller or niche credential managers, the API is available but adoption is not guaranteed. The material does not specify whether the API is open-source or if integration requires approval, which could affect smaller providers’ ability to participate. The lack of universal support means users may still need fallback methods for unsupported tools, complicating migration workflows.

The transfer process is designed to be seamless for users but introduces new dependencies for password managers. Android handles detection of installed managers, authorization, and data transfer, reducing the need for custom import/export UIs. However, this also means managers must trust Android’s implementation and cannot control the transfer experience. For engineers, this simplifies development but may limit flexibility in how credentials are handled during migration. The material does not clarify whether the API supports partial transfers or selective credential migration, which could be a limitation for users with large or complex credential sets.