Guides / Importing
Importing from another password manager
Bring what you already have. Every importer shows a preview first, and the report names each item it could not carry over.
What it reads
| Command | Reads |
|---|---|
unv import FILE | A .env file, or a full-vault JSON export with --json |
unv import-vault bitwarden | A Bitwarden plaintext JSON, or a ZIP with attachments |
unv import-vault onepassword | A 1Password JSON or .1pux export |
unv import-vault keepass | A KeePassXC or KeePass KDBX3 / KDBX4 database |
unv import-vault proton | A Proton Pass JSON export |
The same vendor importers live in the desktop app under Tools, Import, with the same rules. Authenticator apps (Ente Auth, Aegis, 2FAS, andOTP, Google Authenticator) are read from their plain-text exports, and a Nextcloud config.php can be imported too.
Durable migrations
Bitwarden, 1Password and KeePass are durable source migrations. The CLI plans first. With --apply it writes the entry rows, the source identities and an encrypted archive of the source in one transaction.
- Re-importing an unchanged source is a no-op.
- If the source and the vault entry both changed, the import stops with a named conflict instead of choosing a side.
- Attachments, documents, unsupported records and the original source stay encrypted in the vault archive, so an import never claims to have silently dropped them.
The readers keep Bitwarden cipher types 1 to 8, password history, every login URL, TOTP seeds and ZIP attachments; 1Password fields, one-time passwords and .1pux documents; and KeePass group metadata, history, protected custom fields, TOTP and attachments.
What is refused, and why
- Bitwarden encrypted or password-protected exports are refused by name. Export a plaintext copy, import it, then delete the copy.
- KeePass asks for its database password in memory. Use
--key-filefor a key component, or--no-password --key-file <path>for a key-file-only database. - Bitwarden individual exports omit organisation-owned and trashed items, and 1Password
.1puxexports do not carry passkeys. Both are named as missing at source in the report.
The three vendor readers are built from the published formats and have not yet been verified against sanitised exports from the current products. The desktop pane says so and points to the CLI.
Keeping a .env in sync
unv watch FILE keeps a .env in step with the vault while you edit it. It updates by provider, so saving the file twice never adds a second copy.
Lossless config migration
unv migrate imports a configuration file with a durable source identity. It reads .env, Docker Compose, WireGuard and nginx files locally, plans first and never touches the source.
unv migrate plan env ./app.env --template
unv migrate apply env ./app.env --template
unv migrate report
unv migrate verify <migration-id>Template mode stores a byte-preserving template in the encrypted vault. Imported values become ${UNV_MIG_...} references, and $${ keeps a literal ${. Verification renders the template and compares its SHA-256 with the imported bytes. Without template mode, comments and constructs a reader cannot operate are kept in an encrypted archive and named in the report (unv migrate archive ls, unv migrate archive export <id> --out <path>). Migration needs direct access to the local vault.