Chrome Password CSV Import: Check Headers and the Saved Result

By ON Lab · Sources checked November 6, 2026

For desktop Chrome password imports, first check that the file is CSV and its first row includes url, username and password. Then import through Google Password Manager → Settings → Import passwords → Select file. A return to the settings screen is not your only acceptance check: look for the intended records in Password Manager before discarding your transfer file.

Identify the operation before editing the file

Google's current desktop help describes password import from CSV and password export to a downloaded file. This article covers that password workflow. It does not claim that a password CSV transports passkeys, authentication sessions, account recovery methods or every feature of another password manager.

If your source is another app, use its documented CSV export. A file called “backup” is not necessarily the right export format. If you are trying to recover entries that no longer exist in either manager, an import procedure cannot create the missing credentials.

Keep the transfer private and check the destination

A password CSV is sensitive. Google warns that another person using the device can open it and access the passwords. Do not upload it to an online converter, paste rows into a support forum or send it with an error report. Use a trusted computer and a local viewer if you need to inspect the header.

Before importing, check which Chrome profile and account are active. Google's password help distinguishes device-stored passwords when signed out from passwords saved to a Google Account. Importing into the wrong environment is not corrected by repeatedly selecting the same file.

Check the first row without destroying useful fields

The official requirement is that the first line includes the three names url, username and password. That wording is different from a rule that every additional column must be deleted. An export containing name,url,username,password,note already contains those required names; the presence of extra labels alone does not establish the cause of an import failure.

Our suggested check is to compare the header and the exact reported error before modifying anything. If a header correction is necessary, make it in a working copy and keep the source data intact until you verify the transfer. Do not publish the actual header together with a password row. This invented example shows the structure only:

url,username,password
https://example.com,example-user,EXAMPLE-NOT-A-REAL-PASSWORD

If you use a spreadsheet editor to inspect CSV, verify that saving it has not rearranged columns or changed field contents. This article does not provide a universal CSV repair tool. If the file format is unclear, consult the exporting app's documentation rather than deleting columns by trial and error.

Import once, then examine the result

1. In Chrome, open More → Passwords and autofill → Google Password Manager → Settings.
2. Find Import passwords and choose Select file.
3. Select the intended CSV and follow the on-screen instructions. Note an exact error if one is shown, without recording actual passwords.
4. Open the saved-password list and search for a site or app that should have been included.
5. Check that the expected username and site are represented in the intended destination. A similarly named record is not proof that the required one migrated.

Google notes that app and site names do not always arrive in the expected field, so its documented next step for a missing imported password is to search by app or site name. Search before declaring the transfer empty or importing repeatedly.

Match the next step to the failure

Do not delete entries from the old manager merely because the import dialog closed. Verify enough representative entries for your transfer, especially entries with unusual characters or names, before deciding the old copy is no longer needed. This is an editorial acceptance method, not a claim that we performed a migration.

Finish the temporary-file cleanup

After verifying the import, follow your device's deletion procedure for the exported CSV and any temporary working copies. Google's instructions explicitly call for deleting the password file. Ordinary deletion is not a guarantee of forensic erasure, and a copy placed in a shared or cloud-synced folder needs attention there too.

If you made a mistake, preserve the still-valid source records and stop importing until you know which destination or file was wrong. This guide does not promise a one-click undo or automatic deduplication. Use the manager's documented controls for a specific correction.

Scope: current Google desktop CSV password instructions and editorial transfer checks. No credentials were opened, exported or imported, and no authentication or passkey migration was tested.

Sources

• support.google.com: source guidance
• support.google.com: source guidance