Spearworks AI
Free consult

Free guide, nothing to sign up for

Get every password into Apple Passwords

Your passwords are scattered across Chrome, Firefox and maybe an old manager. This moves them into the Passwords app that already comes with your Mac, deletes the export files, and stops the browsers from collecting new ones. Tested on a Mac running macOS 15, October 2026.

This page has no forms and asks for nothing. Every step is something you click yourself.

Finish this guide and every login you saved in Chrome, Firefox, or Opera Air lives in the Passwords app on your Mac. iCloud Keychain syncs it to your iPhone and iPad. The browsers fill from Passwords and stop keeping their own copies. The export files are deleted, and you have checked the places a copy can linger.

This guide moves passwords and nothing else. No rotating, no duplicate hunting, no breach checks, no strength scoring. The Passwords app already watches for compromised passwords and suggests strong ones [A3].

If you work through this with an AI assistant, the assistant walks you through the clicks. Do not let it open an exported file, and never paste a password into it. If it asks for either, stop.

How to read the tags. A step that ends in a tag like [A3] comes from that vendor's own support page, listed at the end of the section and again under Sources. A is Apple, G is Google, M is Mozilla (Firefox), O is Opera. A step marked tested was followed on a real Mac running macOS 15 in October 2026, and the screen matched what is written. A step marked unverified has no vendor page for this exact product on a Mac and was not tested. "Expected:" tells you what you will most likely see. Confirm the wording on your screen before you click.

Set aside an afternoon. Do the exports, the import, and "Destroy the export files" in one unbroken stretch, so no export file exists for more than an hour.

Sources for this section

Before you start

You need:

  • A Mac on macOS 15 Sequoia or later. The Passwords app arrived with Sequoia [A11][A12].
  • Your Apple Account signed in, with iCloud Keychain on. Check it: Apple menu > System Settings > click your name > iCloud > Passwords and Keychain. "iCloud Keychain" should be on [A11].
  • Your Mac login password or Touch ID. Firefox may ask for one of them before it exports [M1][M5]. unverified Expected: Chrome asks too.
  • The browsers installed and able to open.

Write down your starting count:

  1. Open the Passwords app [A1].
  2. Click "All" in the sidebar [A6].
  3. tested The sidebar shows tiles for All, Passkeys, Codes, Wi-Fi, Security, and Deleted, each with a count. Write down All and Security. Treat the counts as a rough guide only: after the imports, All rose by less than the number of passwords Apple said it imported. You will confirm each import by searching for a few sites you know were only in a browser.
Sources for this section

Where your passwords are hiding

Go through this list and write down every place you find something. Each one becomes an export file.

Chrome, every profile. Chrome keeps a separate password list for each profile [G4]. To see your profiles, click the profile picture at the top right of Chrome. Pick one to switch to it. Under "Other Chrome profiles", click "Manage Chrome profiles" for the full list [G4]. unverified Expected: the picker shows a Google account email under each signed-in profile. A profile with no email is not signed in.

For each profile, open its password list: click More (the three dots, top right) > "Passwords and autofill" > "Google Password Manager" [G2]. If the list is empty, cross that profile off. Give each profile with passwords a nickname you will use in the file name (work, personal, kids).

One rule about whose passwords they are. A profile you use on someone else's behalf, such as a family member's account you help with or a client's account you manage, holds their passwords, not yours. Leave those where they are. If that person wants them in their own Passwords app, they run this guide on their own Mac. Your Passwords app is for your logins. Check it too: in testing, the lists of skipped rows showed other family members' logins already saved there. Leave those alone for now; they are not part of this job.

Each Google Account. When a Chrome profile is signed in, new passwords save to that Google Account [G2][G3]. You can see them at passwords.google.com [G3]. unverified One export from passwords.google.com should cover everything saved to that account from any signed-in profile or device. It will not include passwords stored only on this Mac in a profile that is not signed in. To check whether a profile is saving to its account: More > Settings > "You and Google" > click your account name > "Choose what to save in your Google Account", and look at Passwords [G6]. Write down each distinct Google Account you find. Give each a nickname.

Firefox. unverified Expected: one list. If you set up more than one Firefox profile, check each. Open it from the menu button (three lines, top right) > "Passwords" [M1].

Opera Air, or any other browser. Open its password list. If it is empty, cross it off. See "Export from Opera Air" for where the list should be.

An old password manager. LastPass, 1Password, Bitwarden, Dashlane, or another app. Apple imports from a CSV file that another passwords app exported [A1]. Follow that app's own export instructions, save the file in the Password Move folder, and name it for the app (lastpass.csv). Then treat it like any other file in this guide.

Notes, spreadsheets, sticky notes, a paper notebook. These do not import. Add each one by hand in Passwords after the imports are done. unverified Expected: click the + (New Password) button in the Passwords toolbar, fill in the site, user name, and password, then Save. Keep the note until you have signed in once with the new entry, then delete it. Or wait for "Thirty days later" and delete them all at once.

Safari. unverified Expected: already in Passwords. Nothing to do [A12].

Sources for this section

Make a safe folder for the export files

Every export file is plain text. Anyone who opens it reads every password. Apple, Google, and Mozilla each say so and each say to delete the file when you are done [A2][G1][M1].

Your Mac copies files to other places without asking. Know where before you save anything:

  • iCloud Drive. If "Desktop & Documents Folders" is on, your Desktop and Documents folders live in iCloud Drive and sync every time you are online [A15][A16]. A file deleted from iCloud Drive sits in Recently Deleted for 30 days [A16]. Check the switch: System Settings > click your name > iCloud > Drive [A15].
  • Other cloud apps. macOS 15 lets a third-party service take over Desktop and Documents too, through Finder > Settings > General, "Sync Desktop & Documents folders with" that service [A17]. Cloud apps may also mirror other folders through their own settings; Apple's pages do not cover that [A17]. Keep export files out of any folder a cloud app watches.
  • Time Machine. tested If System Settings > General > Time Machine shows no backup disk, skip the exclusion and frequency steps below. Local snapshots can still exist, so the real defense is still speed. If it shows a disk: it backs up everything that was not part of the macOS install, every hour, when it is on [A18]. It also keeps local snapshots on your Mac's own disk, hourly, for up to 24 hours, even with no backup disk attached [A18][A20]. You can exclude a folder from the backup disk: System Settings > General > Time Machine > "Options" > click the add button, choose the folder, click "Done" [A19]. Excluded items still appear in local snapshots [A19]. The real defense is speed: the less time the file exists, the less chance a snapshot catches it. unverified Apple gives only the hourly cadence, not where your Mac is in that hour.
  • Spotlight. It indexes files as they change, and the index stays on your Mac [A22]. Spotlight's own examples search for a word inside documents [A23], so unverified the file's contents are likely in the index too. A Spotlight search for a file name is a quick way to spot a copy you forgot about, nothing more. The checks that count are in "Destroy the export files".
  • FileVault. Apple says data deleted before FileVault is turned on may be recoverable with forensic tools [A25]. Check System Settings > Privacy & Security > FileVault [A24]. unverified Expected: a "Turn On" button means it is off. Turn it on before you export [A24].

Make the folder:

  1. unverified Expected: in the Finder, choose Go > Home. Choose File > New Folder. Name it Password Move. It sits in your home folder beside Desktop, Documents, and Downloads, not inside any of them.
  2. Save every export file there. Not the Desktop, not Documents, not Downloads.
  3. If Time Machine has a backup disk, keep it away from the folder. System Settings > General > Time Machine > "Options" > click the add button, choose Password Move, click "Done" [A19]. In the same Options sheet, set "Backup Frequency" to "Manually" and click "Done" [A20]. Leave it that way until "Destroy the export files" tells you to set it back.
  4. Delete the files within the hour. Run every export section, the import, and "Destroy the export files" in one sitting.

Name the files this way, and never put an email address in a file name:

  • chrome-<profile nickname>.csv, for example chrome-work.csv
  • google-<account nickname>.csv, for example google-personal.csv
  • firefox.csv
  • opera-air.csv

Do not export what is already in Passwords "as a backup" first. Apple says the import will not replace passwords already in the app [A1], and iCloud Keychain already keeps a copy on your other Apple devices [A11]. Writing every password you own to a plain-text file, to guard against a loss Apple says cannot happen, adds risk and removes none. Passwords does have File > "Export All Passwords to File" [A2]; leave it alone for this job.

Sources for this section

Export from Chrome

Do this once for every Chrome profile that has saved passwords.

  1. Open Chrome. Click the profile picture at the top right and choose the profile [G4].
  2. Click More (the three dots, top right) > "Passwords and autofill" [G1].
  3. Click "Google Password Manager" > "Settings" [G1]. (Inside Google Password Manager, "Settings" is on the left [G2].)
  4. Scroll to "Export passwords" [G1].
  5. Click "Download file" [G1][G2].
  6. unverified Expected: a prompt for Touch ID or your Mac login password.
  7. tested Chrome gave no choice of location: the file landed in Downloads with a name like "Chrome Passwords.csv" (it may include the profile name). Move it to Password Move right away and rename it chrome-<profile nickname>.csv.
  8. Switch to the next profile and repeat.

Two things that can get in the way:

  • A work or school account. Its administrator may manage password settings for you [G3]. unverified If "Download file" is missing or grayed out, the administrator has turned export off. Skip that profile and ask them.
  • On-device encryption. If you turned it on for your Google Account, Chrome may ask for an extra unlock before it shows your passwords [G9].

Google Password Manager on the web

Do this once for every Google Account on your list.

  1. In any browser, go to passwords.google.com and sign in to the account [G7].
  2. Click Settings (the gear) at the top right [G7]. Google says the export for your Google Account lives on this Password Manager Settings page [G8].
  3. unverified Expected: under "Export passwords", click "Download file". Google may ask for your Google Account password first.
  4. unverified Expected: a save dialog. Name the file google-<account nickname>.csv and choose the Password Move folder. If it lands in Downloads, move it.
  5. unverified Sign out, sign in to the next Google Account, repeat.

If you set up a sync passphrase in Chrome, you cannot see your passwords at passwords.google.com [G6]. Export from Chrome itself instead.

Sources for this section

Export from Firefox

  1. Click the menu button (three lines, top right) [M1][M7].
  2. Click "Passwords". The about:logins page opens in a new tab [M1]. unverified Typing about:logins in the address bar and pressing Return gets you to the same page.
  3. Click the three-dot menu at the top right of that page, then "Export Passwords…" [M1][M2].
  4. A warning says your passwords will be saved as readable text. Click "Continue with export" [M1].
  5. If asked, enter your Primary Password, or use Touch ID or your Mac login password [M1][M5]. The prompt comes from the "Require device sign in to manage passwords" box on the Passwords and autofill page [M5]. When it is checked, Firefox asks on every export, even right after you unlocked it [M5]. unverified Expected: no prompt if that box is unchecked and no Primary Password is set.
  6. Name the file firefox.csv and click "Save" [M1]. tested The save location defaulted to Downloads. If the file lands there, move it to Password Move right away.

A Primary Password protects the passwords inside Firefox. It does not protect the exported file [M1][M3].

If Firefox is signed in to a Mozilla account with Sync on, an encrypted copy of your passwords also sits on Mozilla's servers [M8]. You deal with that in "Thirty days later".

Sources for this section

Export from Opera Air

Opera relaunched Opera Air on October 15, 2026 [O2], and ships it for Mac [O3]. Opera's help site documents the regular Opera desktop browser; Opera Air does not appear there [O5]. Opera's only published word on Opera Air and passwords is that you can import them [O1]. So every step below is the Opera desktop browser's documented path, applied to Opera Air. Confirm each label on your screen.

Open the password list first. If it is empty, skip this section.

  1. unverified Expected: click "Opera" (or "Opera Air") in the menu bar, then "Preferences" or "Settings". Command-comma also opens settings. This is the Opera desktop path [O6].
  2. unverified Expected: click "Advanced" in the left sidebar, then "Privacy & security". Under "Autofill", click "Passwords". Opera's FAQ labels the same place "Autofill and passwords" then "Password Manager" [O4][O5].
  3. unverified Expected: inside Password Manager, click "Settings" in the left sidebar [O4].
  4. unverified Expected: under "Export passwords", click "Download file". Opera says this saves a CSV and tells you to delete it afterward [O4].
  5. unverified Expected: a save dialog. Name the file opera-air.csv and choose the Password Move folder. If it lands in Downloads with no dialog, move it right away.
Sources for this section

Import into Apple Passwords

One file at a time. Start with the biggest.

  1. Open the Passwords app [A1].
  2. Choose File > "Import Passwords from File" [A1].
  3. Click "Choose File" and pick one CSV from the Password Move folder [A1].
  4. Click "Import" [A1].
  5. When the import finishes, a results window appears with one "OK" button tested. Apple's page says it also offers to delete the file [A1]; on the test Mac the file was still in the Password Move folder afterward, so delete it yourself (see "Destroy the export files"). The passwords are still in the browser you exported from, so you lose nothing.
  6. Repeat for every file.

What the results window says tested: "479 of 533 passwords were successfully imported. 54 passwords couldn't be imported because you already have passwords saved for those accounts." Your numbers will differ. Under it, a section called "Passwords Not Imported" lists each skipped row, for example "Line 5: Already have item for example.com (you@example.com)".

What that means tested: Apple skips a row when it already has an entry for the same site and the same user name, ignoring upper and lower case. It does not add a second copy, so a matching row never creates a duplicate. unverified Because the match uses the exact site and user name, a login saved under a different site address or a different user name is probably not matched, so you can end up with two entries for what you think of as one account.

One catch: the match uses the site and user name only, not the password. If a browser held a newer password than Passwords did, Passwords kept the old one. You will only notice when a sign-in fails. Then copy the newer password from the browser and edit the entry in Passwords. The window itself says you can delete outdated items and import the file again, or edit the items you already have.

The skipped passwords are already in Passwords, so there is nothing to retype.

Check the result:

  1. Click "All" in the sidebar [A6].
  2. tested Do not rely on the number. After three imports, All rose by 257, 120, and 61 while Apple reported 479, 626, and 95 imported. The gap was not explained.
  3. Search for two or three sites you know were only in a browser. Confirm each has an entry with the right user name. This is the real check.
  4. If something seems missing, click "Deleted" in the sidebar first [A12].

A no-file alternative, for a simple setup: Safari can pull passwords straight from Chrome or Firefox. In Safari, choose File > "Import From Browser" > "Google Chrome" or "Firefox", select the items you want, and click "Import" [A13]. Imported passwords go into iCloud Keychain [A13]. The same page says "Use Passwords to import and export passwords on Mac," so treat this as a shortcut, not Apple's preferred route, and Chrome or Firefox must be installed [A13]. Apple does not say which Chrome profile it reads. unverified Expected: it reads one profile, probably the default. If you have more than one Chrome profile, stay with the CSV route.

Sources for this section

What does not come across

Apple's import brings in passwords for apps and websites from a CSV file [A1]. Everything else on this list needs a hand.

Passkeys. Apple's import page covers passwords only. Passkeys are stored in iCloud Keychain and created one site at a time [A9]. unverified A passkey saved in Chrome or Firefox does not travel through a CSV. What to do, one site at a time: open the site in Safari and let Passwords fill the login. Open the site's security settings and create a new passkey. It lands in iCloud Keychain [A9]. unverified Expected: the site then lists two passkeys. Remove the old one from the site's list once the new one works. Passwords has a setting called "Automatically Create Passkeys" under Passwords > Settings [A3].

Verification codes (the six-digit codes). Passwords sets these up per account: select the account, click "Edit", click "Set Up Code", paste the setup key into "Setup Key", click "Use Setup Key" [A8]. unverified A CSV does not carry them. If your codes live in Google Authenticator or another app, re-enroll each site: open the site's security settings, start a new authenticator setup, and get the setup key as text. unverified Expected: most sites offer a "can't scan" link next to the QR code that shows the key. Paste it into Passwords [A8].

Notes. Passwords has a Notes field on each account [A7]. Whether a notes column in a CSV gets imported, Apple does not say [A7]. Check one imported entry. If the note is missing, add it: select the account, click "Edit", type in the "Notes" field, click "Save" [A7].

Wi-Fi passwords. Apple's import page does not mention them [A1]. Passwords already lists the networks your Mac knows under "Wi-Fi" in the sidebar [A10]. Browsers never held these. Nothing to do.

Payment cards. The Passwords app does not hold cards [A5]. Safari keeps them: Safari > Settings > AutoFill > "Credit cards" > "Edit" [A14]. Google documents three columns in its CSV, a site address, user name, and password [G1], so cards do not come across. Enter them in Safari by hand [A14].

Addresses. Not on Apple's list of what Passwords holds [A5]. unverified Expected: Safari fills addresses from your own card in Contacts, controlled under Safari > Settings > AutoFill. Keep your Contacts card current and there is nothing to import.

Sources for this section

Destroy the export files

tested Deleting a file in Finder only moves it to the Trash. The file, and every password in it, stays readable until you empty the Trash. On the test Mac all three export files were still in the Trash after the person deleted them. What is left to destroy: every export file, anything you skipped, and anything a browser dropped into Downloads.

  1. Open the Password Move folder. Select every file. Press Command-Delete, or drag them to the Trash in the Dock [A21].
  2. Click the Trash icon in the Dock [A21].
  3. Either delete each file on its own or empty the whole Trash. One file: Control-click it, choose "Delete Immediately", click "Delete" in the warning [A21]. Everything: click "Empty" at the top right of the window, or choose Finder > Empty Trash, then click "Empty Trash" [A21]. Both are permanent. Apple documents no difference between them beyond one item versus all [A21].
  4. Delete the empty Password Move folder the same way, if you like.
  5. Open the Password Move folder, Downloads, and the Trash in the Finder. None should hold a .csv named chrome-, google-, firefox, opera-air, or the name you gave an old password manager's file. A Spotlight search for each of those names is an extra look, not the check.
  6. Open your Downloads folder in the Finder and look for any .csv a browser left there. Delete it the same way.
  7. If a file ever touched the Desktop or Documents while iCloud Drive was syncing them, it may sit in iCloud's Recently Deleted for 30 days [A16]. unverified Expected: sign in at iCloud.com, open Drive, open Recently Deleted, select the file, and delete it there too.
  8. If you changed Time Machine settings earlier, put them back. Skip this step if Time Machine had no backup disk. "Backup Frequency" has been set to "Manually" since you made the folder. Wait a few minutes, then go to System Settings > General > Time Machine > "Options", set "Backup Frequency" back to what it was, and click "Done" [A20]. Time Machine remembers its backup disk [A20].
Sources for this section

Stop the drift

The goal: Chrome and Firefox fill from Passwords and save new logins to Passwords, and their own password stores stop growing.

Two system switches first:

  1. iCloud Keychain on (see "Before you start") [A11].
  2. System Settings > General > "AutoFill & Passwords" > turn on "AutoFill Passwords and Passkeys" [A11]. Apple documents the switch. unverified Whether the browser extension needs it on is not stated, so turn it on anyway.

Install Apple's iCloud Passwords extension:

  1. In the Passwords app, choose Passwords > "Get Browser Extension" [A4]. tested A window titled "AutoFill in Your Browsers" lists Safari, Google Chrome, and Firefox. Safari says "AutoFill works automatically". Firefox says "Available from Firefox Browser Add-ons" with a "View" button. Chrome says "Extension installed" if it is already in one of your profiles.
  2. Firefox: click "View". It opens the extension's page on Firefox Add-ons [A27]. It needs Firefox 128 or newer and macOS Sonoma or later [A27][A30]. tested Add it, then click the puzzle-piece icon in the toolbar and pin iCloud Passwords so you can see it.
  3. Chrome: add "iCloud Passwords" by Apple Inc. from the Chrome Web Store, macOS Sonoma or later [A26]. Install it in each Chrome profile separately. Then open chrome://extensions and check that the iCloud Passwords toggle is on. On the test Mac it was installed but switched off, and the "Extension installed" check mark in the Passwords window did not mean it was working. Pin it from the puzzle-piece menu.
  4. Pairing tested: no six-digit code appeared on a Mac, unlike the Windows steps [A28]. Click the toolbar icon. A working extension says "Your passwords are synced with iCloud Keychain", with buttons "Open Passwords App" and "Open This Page in Safari". That is the text to look for. Extensions cannot run on some pages, such as the Firefox Add-ons store, so do not test there.
  5. Test it tested: open the sign-in page of a site you saved, click in the user name field (typing the first letters helps), and look for a drop-down headed "iCloud Passwords" listing your accounts. Pick one and it fills.
  6. unverified New logins: Apple's store pages say the extension saves new passwords to iCloud Keychain [A26][A27]. Create one test login and check which save prompt appears.

Turn off each browser's own saving tested. With the extension on, both browsers hand this setting over to it.

Firefox: Settings > "Passwords and autofill". A banner reads "iCloud Passwords controls this setting." with a "Disable Extension" button. "Ask to save passwords" is off and grayed out. Leave it, and do not click "Disable Extension". "Save and autofill usernames and passwords" still shows a check mark but is grayed out, so you cannot change it.

Chrome, in every profile: More > "Passwords and autofill" > "Google Password Manager" > "Settings". "Offer to save passwords and passkeys" is off, with a row reading "iCloud Passwords is controlling this setting" and buttons "Manage" and "Disable". Do not click "Disable". "Sign in automatically" stays on, because the extension does not control it. Turn it off yourself.

Google Password Manager on the web, for each Google Account: unverified Expected: passwords.google.com > Settings (gear) > turn off "Offer to save passwords" and "Sign in automatically". The labels may differ slightly from Chrome's.

Opera Air: unverified Opera Air appears to be built on Chromium, so the Chrome Web Store may show an "Add to Opera" button for iCloud Passwords. Whether the extension pairs with the Passwords app inside Opera Air is untested, and Apple does not list which browsers it supports [A4]. unverified Expected: in Password Manager > Settings, turn off "Offer to save passwords" [O4]. If the extension will not pair, use Safari, Chrome, or Firefox for anything with a login.

Sources for this section

Thirty days later

Use your Mac for a month. If every sign-in worked from Passwords and nothing turned up missing, clear the browsers' own stores so there is one copy of each password.

Chrome, in every profile:

  1. More > "Passwords and autofill" > "Google Password Manager" > "Settings" [G2].
  2. Next to "Delete all Google Password Manager data", click "Delete data", then "Delete" [G2].

Google says this removes passwords and passkeys [G2]. It does not say whether copies in your Google Account on other devices go too [G2]. For browsing data in general, deleting while signed in removes it from your other devices and your Google Account [G10]. unverified Check passwords.google.com for each account afterward. If passwords remain there, Google also offers account-side wipes: chrome.google.com/data, "Delete data" [G5], and chrome.google.com/sync, "Clear Data", which Google says resets Chrome data that "includes bookmarks and Chrome settings in addition to your saved passwords and passkeys" [G9]. Use either only if you accept losing those too.

Firefox:

  1. Menu button > "Passwords" > three-dot menu > "Remove All Passwords" [M2].
  2. If Sync is on: menu button > "Settings" > "Account and sync" > scroll to Sync > "Manage synced data" (some versions say "Manage Sync…") [M7][M6]. Uncheck "Passwords" (some versions say "Logins and passwords") and click "Save" [M6][M7]. Mozilla deletes a data type from its servers when you uncheck it [M8]. Just disconnecting Sync deletes nothing [M10].

Opera Air: unverified Expected: Password Manager > Settings has a delete-all option, or Settings > Privacy & security > "Clear browsing data" removes saved passwords, both as documented for the Opera desktop browser [O4][O5].

Passwords app: nothing to delete.

Sources for this section

Sources

Apple's Passwords and Mac User Guide links are the macOS Sequoia 15 editions. The other Apple links are dated support articles, the Safari guide as served for macOS 15, the Platform Security guide, and two iCloud for Windows pages. Apple's unversioned guide links now open the newest macOS edition, where some labels differ.

Apple

Google

Mozilla (Firefox)

Opera

Opera Air has no page of its own on Opera's help site. [O4] through [O6] document the Opera desktop browser and are the basis for the unverified Opera Air steps.

Why an AI consultancy wrote this

Most of what I do at Spearworks AI is practical help for owner-operated businesses that have no IT person. Passwords are the one piece of IT every one of them has and almost none of them manage.

I moved my own passwords from three browsers into Apple Passwords while writing this, and I kept notes on every screen that did not match what Apple, Google and Mozilla document. Those notes are why some steps say tested and some say unverified.

There is nothing to buy here. If you would rather have a hand doing it, that is part of what I do.

Nathan Spear, Spearworks AI