I’ve moved to passkeys for all but a few of my accounts, and I haven’t typed my password in a long time, at least on my PC. All I do is input my login PIN, and my PC takes care of the rest. However, the hesitation around adopting passkeys has to do with their lack of portability. Passkeys are device-bound, so you’d have to set up everything from scratch on a new device.
This is changing with the introduction of new FIDO Credential Exchange standards, which now allow a safe way to move passkeys between applications. While adoption is still limited, this can help make passkeys a more convincing option for skeptics. For anyone who’s been holding off on passkeys because they don’t want to be locked into a single ecosystem, this is a development worth paying attention to.
What’s the FIDO Credential Exchange standard and why it matters
Two specs that solve passkey portability
Until now, moving credentials between password managers or platforms meant relying on unencrypted CSV exports. If you’ve ever tried switching from one password manager to another, you know how it works. You start by exporting a plain-text file, hope nothing breaks during import, and then delete the file before it becomes a security risk. It’s messy for both users and companies.
For passkeys, it was even worse. Since they use cryptographic key pairs tied to your device’s secure hardware, there was no viable export mechanism at all, especially on mobile. Every ecosystem, whether Apple, Google, or individual password managers, kept credential data walled off within its own environment.
To remedy this, FIDO Alliance introduced two complementary specifications. The Credential Exchange Format (CXF) is a standardized JSON-based structure that defines how credentials should be represented so that any participating app can read and understand them. The Credential Exchange Protocol (CXP) handles the secure transfer itself, using end-to-end encryption to move credentials between providers without exposing them in transit.
To put it simply: CXF makes sure both apps speak the same language, while CXP makes sure the conversation happens over a secure line. You need both for the migration to work reliably, because even when data does transfer between providers today, differing internal formats mean pieces frequently get dropped without any clear indication of what worked and what didn’t.
Why does this matter? Because it directly tackles the biggest catch with passkeys. Without a standard like this, passkeys risked becoming a walled garden, locking you into whichever platform or password manager you first set them up on. If you wanted to switch from, say, Apple Passwords to Bitwarden, your passkeys simply couldn’t come with you. There was also no good way to share a single credential with someone using a different password manager without resorting to insecure workarounds like copy-pasting into a chat.
The FIDO Credential Exchange standard removes the ecosystem lock-in. Major players like Apple, Google, Microsoft, 1Password, Bitwarden, and Dashlane are all backing the effort, and while the initial focus is on passkeys, passwords and other credential types like credit card data are expected to follow.
Platforms that support the FIDO Credential Exchange standard
Early adopters on mobile and desktop
Support is still in its early stages, but it’s growing. Apple was one of the first to ship native credential exchange support through Apple Passwords across iOS, iPadOS, macOS, and visionOS. If you’re in the Apple ecosystem, you can already transfer passkeys and passwords to compatible apps without dealing with insecure file exports.
Bitwarden has also implemented the standard, and it works across both mobile and desktop. Since Bitwarden syncs its vault through the cloud, a passkey imported via the mobile app shows up on your desktop vault as well. Dashlane followed suit, integrating the FIDO Credential Exchange protocols into its mobile environment. Other major contributors guiding the standard’s development include NordPass and Samsung, though their implementations haven’t shipped to end users yet.
On Android, Google now supports the Credential Exchange Protocol as part of a Google Play Services update. Anyone running Android 14 or higher with Google Play Services version 26.21 or higher can import and export saved passwords and passkeys to compatible apps. The transfer request on Android is initiated as an import from the target app, so you start the process from whichever password manager you’re moving to, not the one you’re leaving.
On the desktop side, things are a bit further behind. Microsoft is a co-author of the standard, but native Windows Hello import and export hooks haven’t fully caught up with mobile rollouts yet. That said, cross-platform password managers like Bitwarden and 1Password are building this standard directly into their desktop apps and browser extensions, so the gap is narrowing. Since these apps sync their vaults through the cloud, a passkey you import via their mobile app becomes available on your desktop vault right away. If you use a dedicated password manager instead of your phone’s built-in option, you’re likely to get cross-platform credential portability sooner.
Smartphones led the way here for a practical reason. Passkeys rely heavily on on-device hardware security modules like Apple’s Secure Enclave or Android’s StrongBox, and restructuring the APIs to pass these keys securely between apps required deep OS-level updates first. Desktop platforms are catching up, but the mobile-first rollout explains why your phone is where you’ll notice the change first.
Passkeys are the future, and it’s getting better
The FIDO Alliance won’t treat credential exchange as the finish line. Beyond passkeys, the roadmap extends to passwords, credit card data, and eventually digital credentials like mobile driver’s licenses. Regulatory pressure from the EU’s digital wallet initiatives is reinforcing the push, too, since those regulations specifically require data portability so users aren’t locked into one provider.
That said, mass adoption still depends on awareness and trust. Most people don’t even know passkeys exist, let alone that they can now move them between apps. However, by making passkeys portable and platform-independent, their biggest catch finally has a fix.