Export Bitwarden to LitePassword (small-team migration)
If you stopped wanting to babysit a Vaultwarden instance, or your team is under 12 and Bitwarden Teams has more surface than you use — here is the clean exit.
Step-by-step migration from Bitwarden
- 01
Export your Bitwarden vault
Web vault: Tools → Export Vault. Pick "JSON (Encrypted)" if you want to preserve encryption during transit, or ".json" unencrypted for easier import. Both work; the unencrypted version is faster to read but requires more care after.
- 02
Note your Bitwarden organization layout
Before you touch LitePassword, jot down your Bitwarden Collections and group permissions. LitePassword maps "Collections" to "Vaults" and replaces granular group permissions with three roles + per-vault access. Plan the mapping on paper first.
- 03
Create your LitePassword account
app.litepassword.com/sign-up. Strong master password, save the recovery key to a physical location (sealed envelope, fireproof safe). Different from your Bitwarden master password.
- 04
Recreate vault structure
Create empty shared vaults matching your Bitwarden Collections — "Production credentials", "Marketing tools", "Client X". One per Collection is the cleanest mapping.
- 05
Import secrets by category
Bitwarden JSON groups items by folder. Open it in any JSON viewer, walk through each item, and create the matching LitePassword secret. Logins → Login type. Cards → Credit Card type. Identities → Custom. Secure Notes → Secure Note. Skip Bitwarden Send / Sends if you have any (LitePassword does not have an equivalent).
- 06
Move TOTP seeds out of Bitwarden
If you have Bitwarden Premium with TOTP generation, those seeds need to move to a dedicated authenticator app — LitePassword does not generate TOTP codes today.
- 07
Invite your team
Users page → Invite user. Set role: Admin for org admins, Manager for collection managers, View only for read-only collection members.
- 08
Map per-vault access
In Bitwarden you had Collections with group permissions. In LitePassword, open Manage Vault Access for each user and toggle on the matching vaults. The wrapping happens automatically; on their first unlock the vault key re-wraps with their master-derived key.
- 09
Securely delete the export
The Bitwarden JSON contains your secrets in (possibly) plaintext. Securely delete: srm, shred, SDelete. Empty trash. Don't keep "just in case."
- 10
Decommission Bitwarden
If cloud: cancel the Teams/Enterprise subscription in admin. If self-hosted (Vaultwarden): once team has confirmed migration, take the container down. Keep DB backup for 30 days as belt-and-suspenders before deleting permanently.
Bitwarden is great — and might still be the right tool
Bitwarden is one of the best password managers in the category, especially at small scale where the free tier and the open-source codebase make it genuinely cheap to run. Most teams who switch away from Bitwarden do so for one of two reasons:
- They self-host Vaultwarden and got tired of managing the deployment, upgrades, and backups.
- They’re on Bitwarden Teams or Enterprise and find the feature surface (groups, custom roles, SSO, SCIM, secrets manager) larger than what their 5-12 person team actually uses.
If neither of those applies, stay on Bitwarden. The product is excellent for the right team.
What the migration buys you
If you do switch:
- No server to run. Managed cloud, ~60 second setup.
- Three roles, no permission matrix. Faster to onboard a non-technical teammate.
- Recovery key, no admin reset. Stricter zero-knowledge posture.
- Flat pricing with hard caps. Family $5/mo flat for up to 5 users, Business $10/mo flat for up to 12. Not per-seat — dramatically cheaper than Bitwarden Teams ($4/user/mo) at every team size from 3+ users.
What you give up
- Open source. LitePassword is not open-source.
- CLI and SDK. Not in v1.
- Secrets manager (Bitwarden’s recently-launched dev-secrets product). LitePassword has no equivalent.
- SSO and SCIM. Not supported, intentionally.
If any of those are load-bearing for your team, the migration is not for you.
The realistic timeline
- Day 1, 15 min: Export, create LitePassword, recreate vault structure.
- Day 1, +5 min: Send invites to team members.
- Days 1-2: Team members sign up, set master passwords, save recovery keys.
- Day 2-3: Manage Vault Access for each member, validate they can decrypt.
- Day 7: Cancel Bitwarden subscription / shut down Vaultwarden.
- Day 30: Permanently delete Vaultwarden DB backup if all is well.
Don’t rush the calendar-time portion. The 15 minutes of work happens fast; the trust-but-verify period across the team takes a week.
Done migrating from Bitwarden? Cancel their seat.
LitePassword bills only for active users. No long-term commitment, no cancellation fee.
Considering other tools instead of Bitwarden?
Common questions about leaving Bitwarden
Does LitePassword support a direct Bitwarden JSON import?
Not in v1 — manual per-secret entry is intentional. Bitwarden Collections do not map 1:1 to a single LitePassword vault structure, and bulk imports tend to dump categories incorrectly. ~15 minutes of manual entry for a 10-person team produces a cleaner result than a bulk import would.
I self-host Vaultwarden. Do I need to migrate before shutting it down?
Yes, complete migration first. Run Vaultwarden in parallel for at least a week after the migration so you can validate without losing fallback access. Keep an encrypted DB backup for 30 days after shutdown.
What about Bitwarden Send / Sends?
LitePassword does not have an equivalent of Bitwarden Send (time-limited one-time shares). For one-off secure shares, use a dedicated tool like onetimesecret.com or password.link.
My Bitwarden org has custom roles. How do I map them?
Bitwarden's custom roles flatten to LitePassword's three roles + per-vault access. "Owner" → Admin. "Admin/Manager" → Manager. "User" → View only or Manager depending on whether they edit. Most teams find the simpler model fits without losing meaningful access control.
How do I handle Bitwarden SSO if my org used it?
LitePassword does not support SSO. Your team will sign in with email + password (or email magic-code) and unlock with their master password. If SSO is a hard requirement, do not migrate.
How long does this actually take?
A 10-person team with 50-100 shared secrets typically completes the migration in ~15 minutes of focused work, plus a day in calendar time for everyone to sign up, validate, and confirm.
Stop sharing passwords in Slack messages.
Create your account in under a minute. Pick a master password. We'll generate your recovery key for you.