1Password Data Export: The Field That Eats Your Backup Codes
The export is complete in one format and quietly lossy in the other. Choose CSV and you leave behind custom fields, which is where most people keep their two-factor recovery codes.
Exit score: 24 / 30
How hard 1Password makes it to leave with your data intact, scored against 6 criteria from the vendor's own published documentation. How we score.
| Criterion | Score | What the documentation says |
|---|---|---|
| Self-service | 3/5 | Export runs from the desktop apps without contacting support. Two points deducted because users who "unlock 1Password with SSO" cannot export at all unless an administrator disables that restriction. |
| Format openness | 4/5 | 1Password Unencrypted Export (.1pux) and CSV in version 8; .1pif, CSV and tab-delimited text in version 7. All readable, though .1pux is a vendor format rather than a standard. |
| Completeness | 3/5 | Format-dependent and the gap is severe. CSV "will only export Login and Password items" and excludes security questions, linked items, linked apps and custom fields. Passkeys export only via the iOS and Android apps. |
| Not paywalled | 4/5 | The documentation states no plan-tier restriction on export. One point deducted for the SSO restriction, which is an access gate on exit even though it is not a pricing one. |
| Documentation clarity | 5/5 | Explicit about the CSV limitation, lists excluded field types by name, and warns without hedging that "exported data files are not encrypted. They are stored in plaintext." |
| Caps and expiry | 5/5 | No record caps, no expiring links, no download limits documented. The file is yours the moment it is written. |
What comes out
- All item types via .1pux — the fuller of the two desktop formats.
- Title, website, username, password, one-time password, favourite status, archived status, tags and notes via CSV.
- Passkeys, but only through the iOS and Android apps using the Credential Exchange standard.
- Everything in plaintext, readable immediately without the app.
What stays behind
- Custom fields, in a CSV export — which is where most people keep two-factor backup codes.
- Security questions, which the documentation lists as a form of custom field.
- Linked items and linked apps.
- Everything except logins and passwords, if CSV is the format you chose.
- All of it, if you unlock with SSO and your administrator has not disabled that restriction.
A password manager export is the highest-stakes export there is. Get it wrong and you do not lose convenience — you lose the ability to log into things.
1Password's export is good, clearly documented, and contains one trap sharp enough to deserve the top of this page.
The trap: CSV drops custom fields
1Password's documentation states that CSV "will only export Login and Password items", and that the excluded fields are "Security questions, Linked items, Linked apps, Custom fields".
Then it adds the detail that turns this from a limitation into a hazard: custom fields "encompass security questions and two-factor authentication backup codes".
Consider what that means in practice. You have been a careful user. You enabled two-factor authentication on your bank, your email, your domain registrar. Each service gave you a set of backup codes and told you to store them somewhere safe. You did the sensible thing and put them in a custom field on the relevant 1Password item.
You now export to CSV, import into your new manager, verify a few logins, and delete the export.
The backup codes are gone. Not corrupted — never exported. You will discover this the day you lose your phone and need them, which is precisely the day you cannot get them any other way.
The fix takes one minute: export as .1pux instead. It is the fuller format and it is right there in the same menu. CSV exists for compatibility with products that only accept CSV, and it should be a deliberate last resort rather than the obvious-looking choice.
SSO can lock the exit
The second finding is organisational rather than technical. Users who "unlock 1Password with SSO" cannot export data unless their administrator disables the restriction.
This is a defensible security control. An organisation that has connected 1Password to its identity provider generally does not want individual staff walking out with plaintext dumps of the company vault.
It is also worth understanding before you need it, because it means in an SSO organisation your ability to leave with your data is not yours to exercise. If you are evaluating 1Password for a business, that is a point in its favour. If you are an employee wondering whether your personal items are portable, it is a question to ask early rather than on your last day.
Plaintext, and why that is correct
1Password does not soften this: "Exported data files are not encrypted. They are stored in plaintext. Anyone with access to your exported data files will be able to read your passwords."
It is worth noting that this is not a flaw. An export has to be readable by the product you are importing into, and that means readable. Every password manager faces the same constraint — though it is worth knowing that Bitwarden offers an encrypted JSON export as an option, which 1Password's documented desktop formats do not.
What the plaintext reality demands is a handling discipline, and it is short:
- Export directly to your local disk, never to a synced folder — Dropbox, iCloud Drive and OneDrive will all cheerfully replicate it.
- Complete the import in the same sitting.
- Delete the file and empty the trash immediately.
- Never email it, never message it, never keep it "just in case".
The window between creating that file and destroying it should be measured in minutes.
Passkeys need the phone
Passkeys export only through the iOS and Android apps, using the Credential Exchange standard for direct app-to-app transfer. They are not part of a desktop export.
For anyone who has started adopting passkeys — which increasingly means anyone with a modern bank or email provider — a laptop-only migration will silently leave them behind. Do the passkey transfer from the phone, separately, and check it worked before you close the account.
What 1Password does well
It tells you. Every limitation described on this page came from 1Password's own documentation, stated plainly, including the ones that make the product look worse.
Naming custom fields as an exclusion, and then explaining that custom fields are where backup codes live, is a company documenting a trap it could easily have left implicit. That earns full marks on documentation clarity, and it is the reason this report can exist at all.
There are also no caps, no expiring links and no download limits. Once the file is written, it is yours — which sounds unremarkable until you compare it with services that give you seven days and five attempts.
The verdict
24 out of 30. A good exit with one sharp edge and one organisational gate.
The sharp edge is the CSV format, and it is entirely avoidable by choosing .1pux. The gate is SSO, and it is not avoidable at all if your administrator has it enabled.
Neither is a reason to avoid 1Password — it remains the most polished product in its category, and we recommend it elsewhere on this site. But if you are migrating away, the format dropdown is the most consequential decision in the process, and it is presented as though it were a matter of preference.
For the alternative with the most complete exit in this category, see the Bitwarden exit report, and for the buying decision between them, 1Password vs Bitwarden.
Before you cancel
- Export as .1pux, not CSV, unless you have confirmed you have nothing in custom fields.
- Before exporting, search your vault for two-factor backup codes and recovery keys and record them separately.
- If you sign in with SSO, ask your administrator to allow export before you plan anything else.
- Export passkeys from the iOS or Android app — the desktop apps do not currently do it.
- Treat the exported file as a live credential dump: it is plaintext, so never email it or put it in cloud storage.
- Import into the new manager, verify a handful of entries, then securely delete the export and empty the trash.
What we could not verify
- Exactly which item types .1pux carries that CSV does not — the documentation names CSV's exclusions but does not enumerate .1pux's contents.
- Whether file attachments and stored documents are included in a .1pux export.
- Whether item edit history or previously used passwords are exported in any format.
These are open questions, not criticisms. Where a vendor does not publish an answer we leave it unscored rather than guessing, and the score is calculated only from what is documented.
Questions people ask
How do you export your data from 1Password?
From the desktop apps on Mac, Windows or Linux. 1Password 8 offers a 1Password Unencrypted Export (.1pux) and a CSV file. On mobile, the iOS and Android apps can transfer directly to another app using the Credential Exchange standard, which is currently the only way to move passkeys.
Is a 1Password export encrypted?
No. The documentation is blunt about it: "Exported data files are not encrypted. They are stored in plaintext. Anyone with access to your exported data files will be able to read your passwords." Treat the file as the most dangerous thing on your computer for as long as it exists.
Does a 1Password CSV export include everything?
No, and this is the most important thing on this page. CSV "will only export Login and Password items", and it excludes security questions, linked items, linked apps and custom fields. Anything you stored in a custom field — commonly two-factor backup codes — is not in that file.
Why can I not export from 1Password?
The most likely reason is SSO. Users who unlock 1Password with single sign-on cannot export unless an administrator disables that restriction. It is a deliberate security control, and it means that in an organisation, your ability to leave with your own data is your administrator's decision.
Do passkeys export from 1Password?
Only through the iOS and Android apps, using the Credential Exchange standard for direct app-to-app transfer. They are not currently part of a desktop export, so a laptop-only migration will leave them behind.
Where this information comes from
Product details change often. Each item below links to the primary source we checked, so you can confirm anything that matters to your decision.
Vendors change their export tooling without announcing it. If something here no longer matches what you see in the product, tell us and we will re-check it.