How to migrate from 1Password to Vaultwarden
The riskiest moment isn't deploying {to} — it's the window where your entire vault exists as an unencrypted file on your disk. Treat it like your master password itself.
- 1
Before exporting: set up a trusted environment
Do the export and import from the same trusted computer, off public networks, and have a way to securely delete the file (not just move it to the trash) ready as soon as you're done — don't upload it to any cloud service in between.
- 2
Export your vault from 1Password as .1pux
From 1Password's desktop app (not the browser extension): File → Export → All Items → .1pux format. This format preserves field types, folders and secure notes better than a flat CSV — only use CSV if your 1Password version doesn't offer .1pux.
- 3
Deploy Vaultwarden via Docker Compose and create the first user
Vaultwarden ships with `SIGNUPS_ALLOWED=false` by default (correct for production). Temporarily enable it (`SIGNUPS_ALLOWED=true`), create your admin account from the official Bitwarden web client pointed at your domain, then disable it again immediately after — Vaultwarden has no UI of its own, it uses the official Bitwarden clients configured with your server's URL.
- 4
Import the .1pux from the Bitwarden web/desktop client
With the client already pointed at your Vaultwarden server, go to Tools → Import Data, choose "1Password (1pux)" as the source format, and select the file. Bitwarden recognizes that format natively — no conversion needed beforehand.
- 5
Verify, and only then delete the exported file
Compare the number of imported items against your original 1Password vault and open a handful at random to confirm fields and passwords came through intact. Only once you've verified it, securely delete the .1pux from every disk it touched.
Before cancelling 1Password
Before cancelling 1Password, rotate the passwords for your most critical accounts (primary email, banking, your own domain) already from Vaultwarden — not because the export itself is insecure, but to confirm the authentication flow with your new vault works end to end before relying on it alone. Previous password version history for each item in 1Password isn't exported — if you need it, it only exists while the account is still active.
Ready to deploy Vaultwarden?
Full profile with license, tech stack and ready-to-copy docker-compose.
View Vaultwarden's profileThese steps are a general guideline — the exact export menu can vary depending on 1Password's plan and version.
Frequently asked questions
What client do I use to access Vaultwarden?
Vaultwarden has no UI of its own: use the official Bitwarden clients (browser, desktop, mobile) pointed at your server's URL, the same way you would with Bitwarden Cloud.
Why is SIGNUPS_ALLOWED disabled by default?
For security: in production you don't want anyone with the URL to be able to create an account on your server. Enable it only temporarily to create your first user, then disable it again.
Is the exported .1pux file safe?
No, the exported file is unencrypted. Do the export and import on a trusted computer off public networks, and securely delete it (not just move it to the trash) as soon as you confirm the import succeeded.