Anyone who started using passkeys instead of passwords soon runs into a practical question: if I decide to switch manager, do my credentials come with me? Until recently the answer was awkward. Passkeys tended to stay trapped in the service where they were born, and there was no secure, shared way to move them elsewhere. The FIDO Alliance, the organization that maintains the standards behind passkeys, has published specifications that tackle exactly this point.

Why it matters

The fear of being tied to one provider has a common name: “lock-in”. If switching tools means losing your credentials, or exporting them in an insecure way, many people prefer not to move at all. Or they keep the old password as a safety net. And as long as the password stays as a fallback, most of the benefits of passkeys remain on paper. Making credential transfer a supported, secure operation isn’t a technical detail: it’s one of the knots that decide whether passkeys become a mainstream sign-in method or stay a convenience for the few.

What a passkey is, briefly

A passkey is a way to sign in to a site or an app without typing a password. Instead of a secret word it uses a pair of cryptographic keys: two mathematical values tied to each other. One, the private key, stays on the user’s device and is never shared. The other, the public key, is handed to the site during registration. When you sign in, the device signs a small “challenge” sent by the site, but only after the user has unlocked as usual: fingerprint, face recognition, or PIN.

The benefit is twofold. There’s no longer a password to steal, because the site only keeps the public key, which on its own lets no one in and isn’t open to a brute force attack either. And phishing attempts, the fake pages that imitate a service to get you to type your credentials, stop working, because the passkey is bound to the site’s real address. Passkeys are usually saved and synced by a “credential manager”: it can be the one built into the operating system, like Apple Passwords or Google Password Manager, or a dedicated app like 1Password or Bitwarden.

The problem: no secure way to move them

So far, the solid part. The weak spot was portability. Each manager kept passkeys inside its own fence, and moving from one to another was hard. With old passwords there was at least a path, but a poor one: exporting them to a text file, often in the clear, that is, readable by anyone who opened it. For passkeys there wasn’t even that. A standard was missing entirely, meaning a shared format and procedure that every manager could adopt.

The result is exactly the lock-in described above. Without a secure way out, users feel trapped, and trust in a new technology suffers.

What the FIDO Alliance published

To address this, the FIDO Alliance defined two complementary specifications, grouped under the name Credential Exchange.

• Credential Exchange Format (CXF): this is the format. It sets out how the data to be transferred should be described, with a common structure based on JSON (a widespread, human-readable way of organizing data). It isn’t only about passkeys: it also covers passwords, SSH keys, Wi-Fi credentials, and other kinds of secret. The idea is that exported data looks the same regardless of which manager produced it.
• Credential Exchange Protocol (CXP): this is the protocol, the “how”. It defines the way the transfer happens between two managers, encrypted and secure by default, the same principle behind encrypting data in transit that’s required of systems handling personal data. The stated goal is that credentials no longer travel in the clear.

In short: CXF says what is transferred, CXP says how it’s transferred.

An important point to grasp: these specifications don’t move the passkeys for you. They’re a common language. They exist so that two different managers, from different companies, can talk to each other and hand over credentials without each inventing its own method every time.

Where the specifications stand

Here some honesty about timing is needed, because the two specifications aren’t at the same stage.

The first drafts of CXF and CXP were published on October 14, 2024, open to community feedback and not yet ready for real use. Work continued from there. On August 14, 2025 the CXF format was published as a Proposed Standard, that is, a first stable version (1.0) that managers can begin to implement. That’s a different step from a plain draft: it marks a fixed point to build on.

The CXP protocol, on the other hand, is still in draft at the time of writing. In practice, the format for describing credentials exists and is settled; the secure procedure for transferring them directly between managers is still being defined. It’s a useful distinction, so the announcement isn’t read as “from tomorrow I’ll move everything with one click”.

It’s worth noting who is behind this. The specifications come from a FIDO Alliance working group dedicated to credential providers, with contributions from very familiar names: among others 1Password, Apple, Bitwarden, Dashlane, Enpass, Google, Microsoft, NordPass, Okta, Samsung, and SK Telecom. That detail matters: a portability standard only makes sense if it’s adopted by the very managers users want to move between.

What to expect, realistically

A published standard isn’t yet a feature ready in your manager. For it to become something people actually use, each provider has to implement it in its products, and the timing varies from one to another. That said, the direction is clear: to make exporting and importing credentials a secure, expected operation, instead of an obstacle course or a file readable in the clear.

For the everyday user the benefit, once it’s fully in place, is concrete: being able to change credential manager with the same freedom you now switch phone carrier while keeping your number. It’s precisely the lack of this freedom that kept many people still.

In short

The FIDO Alliance has defined a standard for moving credentials between different managers securely: CXF for the data format and CXP for the transfer protocol. The format reached a first stable version in August 2025; the protocol is still in progress. It isn’t a feature available everywhere yet, but it’s the missing piece for removing the lock-in fear, one of the main brakes on passkey adoption.

Sources

• FIDO Credential Exchange Specifications (FIDO Alliance)
• FIDO Alliance Publishes New Specifications to Promote User Choice and Enhanced UX for Passkeys (FIDO Alliance)
• Portability without compromise: 1Password helps author a new standard for secure credential transfer (1Password)