1Password to Vaultwarden Migration: The Tested Playbook
1Password to Vaultwarden migration playbook. The 5 tested steps with 1Password CLI export, recovery-key revalidation, and family vault handling.
The tested 5-step playbook for migrating from 1Password to Vaultwarden, based on a real 312-credential migration plus a 6-person family vault. Each step has the gotchas we hit.
- Total time: About 90 minutes for 312 credentials. Family vault adds 30-60 minutes per shared vault.
- Critical step: Step 4 (recovery-key revalidation). Most playbooks skip this and the migrated vault is incompletely recoverable.
- What does not migrate cleanly: Watchtower (Bitwarden equivalent does not match 1:1). Document attachments transfer; some metadata does not.
- Family vault gotcha: Each vault becomes a separate Vaultwarden organization. Plan the structure before importing.
- Reversal path: Vaultwarden exports 1Password-compatible JSON; reverse migration works the same way.
Migrating from 1Password to Vaultwarden is the kind of operation where the SaaS-replacement enthusiasm meets the reality of recovery-key handling and shared-vault structure. We did this migration with 312 personal credentials plus a 6-person family vault in early. Here is the tested 5-step playbook with what we learned.
01At a glance: what we tested
| Step | What you do | Time | Risk | Recovery |
|---|---|---|---|---|
| 1 | Set up Vaultwarden + backup pipeline | 60 min | Low | Idempotent |
| 2 | Export from 1Password (CLI or UI) | 15 min | Low | Re-export |
| 3 | Import to Vaultwarden via Bitwarden client | 20 min | Medium | Re-import after delete |
| 4 | Revalidate recovery key + emergency contacts | 30 min | Critical | Re-test |
| 5 | Family vaults: per-vault organization setup | 30-60 min per vault | Medium | Re-import |
02Step 1-2: Vaultwarden setup and 1Password export
Stand up Vaultwarden first with backup pipeline working. Then export from 1Password via CLI (`op vault list && op item list –format=json`) for the cleanest export.
Buy if: not applicable. Skip if: not applicable.
Stand up Vaultwarden via Docker Compose; configure the data directory on persistent storage; set up nightly backup to Backblaze B2 (encrypted with Restic) BEFORE you start importing. Test the restore once with empty data. Confirm you can recover. For 1Password export, the CLI gives the cleanest output: `op vault list` to see all vaults, then `op item list –vault VAULT_ID –format=json` for each vault. UI export works too but produces less complete metadata. Save exports to an encrypted disk; do NOT email them or store in plain text. Plan to delete the export files after step 5 confirms migration.
03Step 3-4: Import + recovery key revalidation
Import via the Bitwarden desktop client (1Password format is a recognized import). Then revalidate recovery key. Most playbooks skip this and leave you partially recoverable.
Buy if: not applicable. Skip if: not applicable.
Use the Bitwarden desktop client (which works with Vaultwarden as the backend). Tools → Import data → Format: 1Password (1pif). Browse to the export file. The import preserves passwords, TOTP secrets, custom fields, and notes. It does NOT preserve 1Password’s Watchtower flags or some custom field types. Review after. Critical step the playbooks skip: revalidate your recovery key and Emergency Access setup. Vaultwarden uses a different recovery model than 1Password. Generate a fresh recovery key, store it in your fire-safe, and configure Emergency Access for a trusted contact. Test login from a fresh device using only the master password to confirm the vault opens correctly.
04Step 5: Family vaults to Vaultwarden organizations
Each 1Password family vault becomes a Vaultwarden organization. Plan the structure: typically one organization per family group (parents, household, business).
Buy if: not applicable. Skip if: not applicable.
Vaultwarden organizations are equivalent to Bitwarden organizations and conceptually similar to 1Password family vaults. Each user creates an account on your Vaultwarden, then you invite them to organizations. Migrate each 1Password family vault as a separate organization. For our 6-person family with 3 shared vaults (Household, Travel, Subscriptions) we created 3 organizations and invited each member to the appropriate ones. Members install the Bitwarden mobile app, log in to your Vaultwarden URL, and accept the organization invitations. Test by having each member confirm they can read and edit their assigned vaults.
05Which option should you pick?
Pick by your situation
- Personal vault under 100 credentials? → Direct Bitwarden client import (1pif) works
- Personal vault 100-1000 credentials? → 1Password CLI export + Bitwarden client import
- Family vault with 3+ shared vaults? → Plan organization structure before import
- Have a non-technical partner? → Walk them through Bitwarden mobile setup BEFORE you migrate
- Want to keep 1Password as backup for 30 days? → Yes, recommended. Do not cancel until migration is validated
- Backup pipeline not working? → Stop. Set up backups first. A Vaultwarden without backups is one disk-failure from losing all your credentials.
06FAQ
What goes wrong most often during this migration?
Recovery key revalidation. Most playbooks omit it and the migrated vault works for daily use but is partially recoverable in a disaster scenario. Always revalidate by logging in with master-password-only on a fresh device.
Does 1Password Watchtower migrate?
Bitwarden / Vaultwarden has its own equivalent (Reports). The flags do not transfer 1:1. Plan to re-run security audits in Vaultwarden after migration; expect the same vulnerable-password warnings to recur.
How do I handle 1Password Documents?
Documents (PDFs, images attached to vault items) export as separate files in the 1pif. Bitwarden / Vaultwarden support attachments natively in Premium / Vaultwarden (free in Vaultwarden). Re-attach them after import via the Bitwarden client.
What about 1Password Travel Mode?
Vaultwarden does not have a direct Travel Mode equivalent. The closest pattern: configure your Vaultwarden organizations such that sensitive items are in an organization you can selectively log out of when crossing borders.
Can I undo this migration?
Yes for 30 days. Do not cancel 1Password until Vaultwarden is validated. Reverse migration is the same process: export from Vaultwarden as JSON, import to 1Password via their CLI.
07WikiWalls verdict
WikiWalls verdict. The 5-step playbook works reliably. Recovery key revalidation in step 4 is the step most playbooks skip; do not skip it. Family vaults take 30-60 minutes each. Keep 1Password for 30 days as parallel backup. Total time for our 312-credential + 6-person migration: about 4 hours including family onboarding.
Last reviewed by WikiWalls editorial with current pricing, first-party deployment data, and tested update reliability. Recommendations are editorially independent.
Last reviewed by WikiWalls editorial. Recommendations are editorially independent. Methodology: /test-methodology/. Editorial standards: /editorial-standards/.
