Migration guide

How to Migrate from Bitwarden to Fob in 2026

Published April 25, 2026. Works whether or not you use Fob.

Bitwarden is one of the better password managers in the market, and the standalone Bitwarden Authenticator (shipped 2024) is a clean, free TOTP app from a team that takes security seriously. If you are reading this, you are probably in one of two camps: either your TOTP codes live inside your Bitwarden password vault next to your passwords (Premium or Family/Business), or you installed the standalone Bitwarden Authenticator and want a different organizational model. Both flows export and import the same way; the reasons for moving are different, and worth treating separately.

This guide is honest. Nothing about Bitwarden is broken. The decision to leave is a tradeoff, not a fix.

Why move from Bitwarden (or why not)

If your codes live inside the Bitwarden password manager, the question worth asking is not "is Bitwarden good?" (it is), but "do I want my passwords and my second factors guarded by the same secret?" That is the defense-in-depth question, addressed in the next section. The convenience case for keeping them together is real: one app, one unlock, autofill that pastes the password and the code in the same flow. For some users that convenience is the right call.

If you use the standalone Bitwarden Authenticator, the bundling argument does not apply. The reasons to move from there are narrower:

• Single-folder organization. One folder per entry. At 40+ accounts that breaks down: a Coinbase entry is crypto, exchange, and high-value at the same time, and you have to pick one.
• No tag-based filtering. Folders are buckets. Tags are filters. The difference matters past 30 accounts.
• Recovery story is "set up sync first." If you skipped sync at install and your phone breaks, the codes are gone. Fob's recovery wizard is mandatory at onboarding.
• No first-class shared accounts. Bitwarden the password manager has shared collections; Bitwarden Authenticator does not.

If none of those bite for you, the standalone Bitwarden Authenticator is a defensible choice. If even one does, the rest of this guide is for you.

The defense-in-depth case for separating 2FA from your password manager

This is the section that earns this page. It is not a slogan; it is a threat model.

A second factor exists because the first factor (your password) might be compromised. Phishing, breach, malware, reuse: the password is the thing the attacker is most likely to get. The whole point of 2FA is that getting the password is no longer enough.

If your password manager and your authenticator are the same vault, that property degrades. An attacker who gets your Bitwarden master password (through phishing, malware on the typing device, or a vault-side compromise) gets your passwords and your TOTP secrets in one breach. The second factor stops being a second factor against that exact threat. It still defends against the credential-reuse case (a leaked password from another site), but the master-password case (the highest-impact case) is no longer two factors.

Some users accept this tradeoff: my master password is long, my Bitwarden vault is hardened, the convenience is worth the residual risk. That is a defensible position. Others (and a meaningful number of security professionals) take the opposite view: 2FA is supposed to be the layer that survives the password breach, and putting it in the same vault forfeits that property by construction. Neither camp is wrong. Pick the side that matches your actual threat model.

What you keep, what you do not

Bitwarden exports every account with every property: secret, issuer, name, algorithm (SHA-1, SHA-256, SHA-512), digit count, period, OTP type. Fob preserves all of those.

Two things to know:

• Folders become tags. Each entry that had a folder comes into Fob with one tag of the same name. Add more tags after the import.
• Password fields are dropped. Exports from the password manager contain your passwords. Fob is not a password manager and ignores those fields. The export file still has them in plaintext, which matters for the next section.

The Bitwarden export format

Both the password manager and the standalone authenticator export to JSON.

• Bitwarden Password Manager: Settings > Export Vault > File format .json. Use the unencrypted JSON for migration; the encrypted variant is locked to a Bitwarden account and not designed for cross-app use. TOTP secrets live as the login.totp field on each entry.
• Bitwarden Authenticator (standalone): Settings > Export > JSON. Same shape, no password fields.

Plaintext exports are a known footgun. Bitwarden uses them deliberately because they are portable, which is the right call for a migration file - but the file is a complete copy of every secret you have, unencrypted. Move it directly from source to destination, delete it the moment the import succeeds. Do not email it, do not paste it into chat, do not leave it in your Downloads folder.

How to migrate in about 60 seconds

From the Bitwarden password manager (web vault or browser extension):

1. Open the Bitwarden web vault at vault.bitwarden.com, sign in.
2. Navigate to Tools > Export Vault.
3. Choose File format: .json, enter your master password to confirm, and download the file.
4. Move the file to your destination phone through the most direct path you have. USB cable, AirDrop, a one-time-use cloud drop you delete immediately after.
5. On your destination phone, open Fob, tap Add account, choose Import from Bitwarden.
6. Pick the .json file. Fob scans it, finds every entry with a TOTP field, ignores the password fields, and shows you the list of accounts it can import.
7. Review the list, confirm. Folder assignments come across as tags.
8. Delete the export file from every device it touched. Source phone, destination phone, cloud drop, USB drive, all of it.

From the standalone Bitwarden Authenticator app: Settings > Export > JSON, save the file, then steps 4 through 8 above are identical.

The plaintext vault is never written anywhere except the Fob database, which is encrypted with AES-256-GCM and a key derived from your Fob password using Argon2id.

What happens to your Bitwarden data

Nothing, unless you remove it. Exporting is a read operation; Bitwarden still has every account until you delete it. An export should not break your fallback, and it does not.

The recommended path for a few days after migration:

• Use Fob as the primary app.
• Keep Bitwarden installed as a fallback. If a service rejects a Fob code (rare, usually clock drift), Bitwarden still has the secret.
• Once you have logged into every account at least once using Fob codes, remove the TOTP entries from Bitwarden (or uninstall the standalone app).

If you exported from the password manager and choose to keep TOTP in Bitwarden as a permanent backup, you have re-bundled the second factor with the password. Fine if you understand the tradeoff; the defense-in-depth section above is the version of that decision you should make on purpose, not by accident.

After migration, what Fob does differently

• Tags, not folders. A Coinbase account can be crypto, exchange, and high-value at the same time. Filter by any combination, save the filter, switch tags in two taps. No other authenticator has this.
• Not a password manager. Fob does TOTP and only TOTP. The defense-in-depth argument above is the architectural reason. Keep Bitwarden for passwords, Fob for codes; the two apps are designed not to need each other.
• Mandatory recovery wizard at onboarding. No "I will set up sync later" path. The recovery story is the first thing you do, before you add a single account.
• Zero-knowledge sync. Your vault is encrypted on-device with AES-256-GCM. The key is derived from your Fob password with Argon2id and never leaves your devices. Fob's servers hold a blob they cannot read. Architecture details at /security.
• Export any time. If Fob ever stops being the right choice for you, your vault exports in an open format behind a reauth prompt. You can put it back into Bitwarden Authenticator the same day. Fob is structurally unable to hold your codes hostage.

If you also have accounts in Authy, see /import/authy. For Google Authenticator, /import/google-authenticator. For Microsoft Authenticator, /import/microsoft-authenticator. For Aegis, /import/aegis. For 2FAS, /import/2fas.

Fob is on Google Play, Android first. iOS follows; get notified from the homepage when it lands.

FAQ

Should I keep my 2FA codes in Bitwarden?

It depends on your threat model. If your master password is long, unique, and typed only on devices you trust, and your priority is convenience, keeping TOTP in Bitwarden is defensible. If your priority is that the second factor must survive a master-password compromise (phishing, malware on the typing device, vault-side breach), separation is the right move. Both camps are internally consistent.

What happens if my Bitwarden master password is compromised?

If your TOTP secrets live in the same vault, the attacker has both your passwords and your second factors. The 2FA layer no longer protects the accounts it was supposed to protect against that specific breach. If your TOTP secrets live in a separate authenticator (Fob, the standalone Bitwarden Authenticator, Aegis, anything that is not the same vault), the second factor still does its job. This is the entire defense-in-depth argument in one sentence.

Is Fob a password manager like Bitwarden?

No. Fob does TOTP and only TOTP. That is a deliberate architectural choice, not a missing feature. The trust model is: your password manager is one vault, your authenticator is a different vault, the master keys are different secrets, and a compromise of one does not cascade into the other. If you want one app that does both, Bitwarden does that well and you should stay there. If you want the two responsibilities split, Fob is the second half of that split and Bitwarden remains a fine choice for the first half.

Can I import the encrypted Bitwarden export, or do I need the unencrypted JSON?

Use the unencrypted JSON. Bitwarden's encrypted export is keyed to your Bitwarden account and meant for backing up a Bitwarden vault back into Bitwarden, not for cross-app migration. The unencrypted JSON is the portable format. Move it directly from source to destination, run the Fob import, and delete the file immediately.

Does this guide cover the standalone Bitwarden Authenticator app too?

Yes. The standalone Bitwarden Authenticator (launched 2024) exports the same JSON shape as the password manager, minus the password fields. The migration steps are identical to step 4 onward in the password-manager flow. What differs is the rationale: from the password manager the case is defense-in-depth, from the standalone app the case is tag-based organization, the mandatory recovery wizard, and shared accounts on the roadmap.