A password manager switch is less about the new vault and more about the moment of trust when the whole team moves its keys at once. Bitwarden earns that trust differently from LastPass, with open code and a simpler pricing story, but the migration itself still hinges on one careful export and one careful import. This guide shows how to switch LastPass to Bitwarden small team by small team, keeping the old vault readable until every login has been proven in the new one.
Never delete the old vault on migration day. The safe sequence exports, imports, tests the five logins the team uses most, and only then retires the old vault after a week of normal use. That week of overlap is the cheapest insurance a small team will ever buy, because it turns a risky cutover into a reversible experiment.
Why Teams Make This Move Now
Teams usually reach this decision after months of small frustrations rather than one dramatic failure. The old tool still works, but every workaround added to it makes the next change harder, and the team slowly spends more time managing the tool than doing the work it was bought for. That slow drift is easy to ignore, because no single week looks bad enough to justify a project, yet the total cost across a year is often larger than the migration itself.
The second reason teams move is control. A small team that can explain its own structure, its sharing rules and its review dates keeps the benefit of any tool long after the initial enthusiasm fades. A team that relies on memory or on one enthusiastic person loses it when that person is busy or leaves. Written standards are dull, but they are what turn a good week into a good year, and they cost almost nothing to create compared with redoing work that was never recorded.
Timing matters as much as tool choice. Starting during a quiet period, with a small pilot and a clear review date, gives the team room to fix problems without pressure. Starting during the busiest period, with everything moving at once, turns small mapping errors into visible failures. Choose the pilot carefully, protect the review date, and let the pilot result decide the pace of the wider rollout rather than a calendar deadline set before anyone saw the real data.
How to switch LastPass to Bitwarden small team Without Losing Live Work
There are several ways to carry out the work, and the right one depends on size, data quality and how much time the team can give it. The table below compares the realistic options, including what each one suits best. Judge each option against your own volume and skill, not against a sales claim, and run the cheapest option that still passes a trial with real work. A method that works on a sample but fails on real data is not a method, it is a demo.
| Option | What it involves | Best for |
|---|---|---|
| Built in or native importer | the Bitwarden import tool, which accepts a LastPass CSV export | A team with a standard LastPass setup |
| CSV export and manual import | A manual export cleaned in a spreadsheet before import, giving control over assignment | A team that needs to restructure during the move |
| Assisted or third party migration | A specialist service that handles mapping, batches and validation | A team with compliance, volume or deadline pressure |
Check the current plan details on lastpass.com and bitwarden.com before you commit, since pricing, limits and importer availability change. Vendor pages are the only reliable source for prices at decision time, and any figure quoted elsewhere, including in this guide, should be treated as a prompt to verify, not as a quote.
The honest limit to name early is this. Sharing rules, admin policies and some two factor seeds do not transfer through a CSV import. They must be rebuilt in Bitwarden, and the rebuild should be tested with real members before cutover, not discovered afterwards. Accepting that limit in week one lets you schedule the rebuild work properly, while discovering it in launch week turns it into a crisis. Put the rebuild items on the project plan with owners and dates, and treat them as launch criteria, not as follow up tasks.
What Moves, What Breaks and What Must Be Rebuilt
Work through the table below row by row as you switch LastPass to Bitwarden small team with your own data, and mark each row as moves cleanly, needs rebuilding or needs a decision. Rows marked needs a decision are the ones to resolve before import, since deciding them afterwards means rework. Keep the completed table as the project record, because it answers most questions the team will ask during rollout, and it prevents the same decision being debated three times by three different people.
| Item | Where it goes | What to check |
|---|---|---|
| Shared folders | Bitwarden collections inside an organization | Recreate membership per collection, never copy old folder access blindly |
| Personal vault items | Private vaults for each member | Confirm each person sees only their own items after import |
| Logins and passwords | Bitwarden login items | Verify a sample of high value logins by signing in with them |
| Secure notes | Bitwarden secure note items | Check long notes for truncation after import |
| Form fill identities | Bitwarden identity items | Re-enter card and identity fields that do not map cleanly |
| Attachments | Bitwarden item attachments | Verify large files separately, since imports can skip them |
| Emergency access | Bitwarden emergency access settings | Set this up before you delete anything from the old vault |
| Two factor seeds | Re-enrolled authenticator items | Some seeds do not export, so plan re-enrolment per service |
Two rows in that table usually cause the most trouble, and they are worth naming plainly. The first is anything involving permissions or sharing, since a wrong share can expose sensitive work or block a colleague at a critical moment. The second is anything involving history, since history that arrives flattened or unattributed looks complete but misleads anyone who relies on it. Test both rows in the pilot with real examples, and do not accept a vendor assurance in place of a test result.
Once the mapping is settled, the order of work matters as much as the mapping itself. Move the smallest meaningful slice first, verify it completely, and only then widen the move. That order limits the damage from any error, gives the team confidence from a real success, and creates a repeatable routine for the remaining slices. Teams that move everything at once rarely get that confidence, and they often spend the savings from speed on fixing errors that a pilot would have caught.
The Workflow Step by Step
Follow the steps below in order, because each one builds on a finished earlier step. Skipping ahead to the import before the mapping is settled creates work that has to be redone, while following the order means the import itself is the easy part. Print the list for switch LastPass to Bitwarden small team, tick each step off, and do not move on until the current step works with real data from the team.
- Audit vaults and sharing. List every shared folder, who can see it, and which items are shared outside the team. Revoke stale access now, because a migration is the best moment to remove people who should no longer see sensitive logins. Record the result in a simple sheet with an owner per folder.
- Clean up before export. Delete dead logins, duplicates and items belonging to former staff. A clean export imports cleanly, while a messy export carries years of clutter into the new vaults. Ask whether a new joiner could understand each folder name without asking its creator.
- Export from LastPass securely. Export to an encrypted device, never to a shared drive or email. The export file holds every password in plain form, so treat it like a master key. Import promptly, then delete the file and empty the trash on that device.
- Set up the Bitwarden organization. Create the organization, invite members, and build collections per team or project. Agree naming before importing anything, and assign a manager to each collection so ownership is clear from day one.
- Import and verify a sample. Import the CSV, then test high value logins such as email, banking and cloud admin. Check secure notes and attachments on a sample, and fix mapping errors on the sample before you import the rest.
- Re-enrol two factor items. For authenticator seeds that do not export, re-enrol each service in the new vault and store recovery codes in a separate secure vault. Test one re-enrolled login end to end before you rely on it.
- Train the team and set policies. Show staff how to share through collections, how to use the browser extension, and what happens when someone leaves. Set vault timeout and two factor policies, and name the person who owns access reviews.
- Close LastPass on a set date. Confirm every member can sign in to Bitwarden, revoke LastPass access, and delete old exports and shared folders. Treat the move as finished only when the old vaults are closed, not when the import report says success.
The Checklist to Run Before Cutover
Use this checklist as the gate before you complete switch LastPass to Bitwarden small team, not as an afterthought. Every item should have a name beside it and a date, since a checklist without owners is a wish list. Run through it with the people who will live with the result, not only with the person who set it up, because the people who use the system daily spot problems that the setup person cannot see. If an item fails, fix it and rerun the checklist, rather than waiving it under time pressure.
| Check | What good looks like |
|---|---|
| Pilot verified with real data | A real slice of vaults moved, checked and signed off by its owner |
| Permissions and sharing tested | Access checked for members, guests and external shares |
| High value logins verified | Email, banking and admin logins tested by signing in |
| Export file deleted | The plain text export and its trash copies destroyed |
| Team trained on daily habits | Staff can share, save and find logins without help |
| Closure date communicated | Everyone knows when the old vaults stop and where to go instead |
The rollback note deserves emphasis, because it is the item most plans skip. A rollback plan is not pessimism, it is professionalism. It states what triggers a pause, who decides, how the team returns to the old system, and how long that return stays possible. Writing it before cutover costs an hour. Needing it without having written it costs days of confusion, and it is usually needed on the one migration where nobody expected trouble.
Trade Offs and Costs to Weigh Honestly
Bitwarden lists its Teams plan at 4 dollars per user per month, and its Enterprise plan at 6 dollars per user per month, on its pricing page. Check the current page before you buy, since prices change.
Beyond the subscription, price the time honestly. Cleanup, import checks, re-enrolment and the first month of support all cost hours, and those hours have value even when they do not appear on an invoice. A tool that costs little per month but takes many hours to maintain can cost more than a pricier tool that runs itself. Write down both numbers and judge the total.
Also check what happens when you stop paying. Your data, your history and your templates should stay yours in a usable form, and the export route should be tested before you depend on it. A system that holds data hostage is not a bargain at any price, and the time to discover that is before migration, not during an exit years later when the data matters most. When you switch LastPass to Bitwarden small team, you are choosing a home for work that will outlive the project itself, so exit terms deserve the same attention as entry price.
Mistakes That Quietly Undo the Work
The mistakes below are common because each one feels reasonable at the time. Read the list with the team, agree which mistake your setup is most likely to make, and put one guard in place against it, since a named mistake is far easier to avoid than a vague warning to be careful. The team that can name its likely mistake before starting has already avoided half of it, and the guard you put in place now is cheaper than the fix you will need later when you switch LastPass to Bitwarden small team under deadline pressure.
- Moving everything at once. A full move before a pilot means a mapping error affects the whole team instead of one slice, and fixing it under pressure costs more than the pilot ever would.
- Skipping the permission audit. Old shares carry over quietly, and the first time anyone notices is usually when the wrong person sees something sensitive or the right person is locked out.
- Trusting the import without testing. An import report that says success does not mean notes, attachments and sharing landed correctly. Spot check real records, especially the ones the team relies on daily.
- Letting one person hold all the knowledge. If only one person knows how the new vaults work, holidays and departures break the routine. Train a second person on every key step and write the routine down.
- Never setting a closure date. Without a date, the old vaults linger, the team splits across two tools, and the benefit of the move never arrives. Set the date at the start and communicate it clearly.
How to Tell Whether It Is Working
Pick four numbers and track them monthly, because evidence beats feeling when judging whether switch LastPass to Bitwarden small team is working. Choose numbers you can collect without extra admin, such as time saved, errors, completion rates or satisfaction, and record them in one place on the same day each month. A trend over three months tells you far more than a single good or bad week, which may reflect holidays, deadlines or one unusual event.
Compare the new numbers with the baseline recorded before the change, and be honest about what they say. If a number improves, keep doing what caused it and say so to the team, since people repeat work that is praised. If a number gets worse, change one thing, not five, so you can tell what helped. Changing five things at once leaves you guessing, even when the numbers improve.
Set a review date now, ninety days from launch, and put it in the calendar with the name of the person who owns the review. Without a named owner and a date, reviews slip, and a slipped review means a system that slowly stops matching the work. The review itself need not take long, since one hour with the four numbers and the user answers is enough to decide what to keep, what to change and what to stop.
One more consideration is how the team handles exceptions, because every workflow meets a case that does not fit the template. Decide in advance what happens then, whether the exception is handled by hand, escalated to a named person, or logged for a later template change. A workflow without an exception rule either breaks on the first odd case or gets quietly bypassed, and bypassed workflows teach people that the routine is optional. Write the exception rule beside the template, keep it to two sentences, and review it when exceptions start to repeat, since a repeated exception is really a missing step.
Training deserves a note of its own, because a workflow is only as good as the least confident person using it. Train in short sessions with real examples from your own work, let people practise with a colleague before they face a real task, and write the three most common questions and answers where everyone can see them. People who feel confident use the system, while people who feel unsure avoid it and fall back on old habits, which quietly recreates the very problem the workflow was meant to solve.
The First Two Weeks After Cutover
The first two weeks after cutover decide whether the new system sticks or quietly loses to old habits. Staff will hit the first unfamiliar screen, the first missing shortcut and the first report that looks different, and each of those moments is a small decision point. If help is quick and the answer is written down, the new habit forms. If help is slow and the answer lives only in one person’s head, the old habit returns, and it returns without anyone announcing it. Plan the first two weeks as carefully as the migration itself, with named helpers, office hours and a visible list of known issues.
Start with a daily check in for the first five working days, kept to fifteen minutes and focused on blockers only. Ask each team what failed, what felt slow and what they worked around, and fix the workarounds first, since a workaround that survives a week becomes a permanent shadow process. Log every issue with its fix, and share the log where the whole team can read it, because the same question asked by five people costs five times as much as the same question answered once in public. Close each check in with one decision, even a small one, so the team sees progress rather than a growing list.
- Watch the first real task end to end in the new tool, not a demo task, and note every click that felt unnecessary or confusing.
- Check the most used report, queue or dashboard daily for the first week, and compare it with the old system until the numbers agree.
- Ask new joiners and occasional users first, since confident daily users hide problems that occasional users hit immediately.
- Review permissions and access requests weekly at first, because access problems are the fastest way to lose trust in a new system.
- Record every workaround the team invents, and turn the repeated ones into proper fixes or documented steps within the fortnight.
By the end of the second week, the questions should change character. Early questions are about where things live and how to do familiar tasks, while later questions are about edge cases, reporting and improvements. That shift is the signal that adoption is working, and it is worth naming in the review, since teams that expect questions to vanish entirely misread normal learning as failure. If questions have not shifted by week three, the problem is usually training or mapping, not attitude, and it deserves a focused fix rather than a reminder to try harder.
The ninety day review should then judge the move on the numbers chosen before launch, not on how people felt in launch week. Bring the four tracked numbers, the issue log and the list of rebuild items that were deferred, and decide what to keep, what to change and what to stop. Deferred rebuild items need dates at this review, or they drift forever, and the team should hear explicitly which deferred items are being dropped and why. A review that ends with dated decisions is a project closed properly, while a review that ends with general satisfaction is a project that will be reopened the next time someone asks why a report looks odd.
Support coverage during those first weeks deserves its own rota, not just good intentions. Name two people who can answer questions each day, rotate the role so it does not burn out one enthusiast, and give the rota holders time in their week to actually help. A rota that exists only on paper helps nobody, while a rota with protected time turns early confusion into quick answers and quick answers into confidence. Thank the rota holders publicly at the review, since visible thanks is what makes people volunteer for the next change.
Measure support volume as well as task outcomes during the first fortnight, since a falling question count with steady output is a better sign than either number alone. If questions stay high while output falls, the team is stuck rather than learning, and that pattern calls for more training or a mapping fix. If questions fall but output also falls, the team may have quietly stopped using the new tool, and that pattern calls for a direct conversation, not another tutorial. Numbers do not replace talking to people, but they tell you which conversations to have first.
Finally, write the one page handover that the next person will need. It should name the system owner, the review date, the mapping decisions that matter, the known gaps and where the exports and backups live. One page is enough, and one page will actually be read, while a long manual will not. Keep it beside the system, not in a personal drive, and update it at each review. That single habit is what turns a migration project into a system that survives staff changes, busy periods and the next tool decision, whenever that comes.
More Reading on Stratilyze
For the systems around this one, Stratilyze also covers a related Stratilyze guide a related Stratilyze guide a related Stratilyze guide Read the guide that matches your next bottleneck first, because fixing the biggest bottleneck next gives a larger gain than polishing a part of the work that already runs well.
Communication around the change matters as much as the setup itself. Tell the team what is changing, why it is changing, when it takes effect and where to get help, and say it in the channel they already read rather than in a new tool they have not adopted yet. A change announced once in one place will be missed by half the audience, so repeat the message at the pilot, at cutover and at the first review, and keep the wording consistent each time.
Finally, resist the urge to add features in the first month. The first month is for proving the core workflow with real work, fixing the mapping errors the pilot missed, and letting habits form. New features added during that period confuse the measurement, since you can no longer tell whether a change in the numbers came from the workflow or from the feature. Freeze the scope for ninety days, log feature requests for the review, and judge them then against the numbers rather than against enthusiasm.
Frequently Asked Questions
Does everything transfer automatically from LastPass to Bitwarden?
No. Core logins, notes and folders usually move through the CSV import, while sharing rules, policies and some two factor seeds must be rebuilt by hand. The mapping table in this guide shows which rows need rebuilding. List every such row before import and test the rebuilt pieces with real work before the wider rollout.
Is the LastPass export file safe to handle?
Only if handled carefully. Export to an encrypted device, import promptly, then delete the export file and empty the trash, since an unencrypted export contains every password in plain form. Never send the export by email or store it on a shared drive, even briefly, since that copy is easy to forget and hard to recall.
Shared folders become collections in a Bitwarden organization, with membership set per collection. Do not copy old membership blindly. Review each folder, remove people who no longer need access, and assign a manager to each new collection so future access changes have an owner.
How long does this migration take for a small team?
A small setup with clean data can move in a week or two including a pilot, while a larger setup with many shared folders usually needs three to six weeks once testing and retraining are counted. The pilot gives the honest timeline, since it reveals mapping errors and training gaps that no estimate can predict.
Should the old vaults stay open after the move?
Yes, but read only in practice and for a fixed period, often thirty to ninety days. That window lets the team check old items without drifting back to the old tool for new work. Set the closure date at the start, since an open ended reference period quietly becomes a permanent second system.
Do two factor codes move across?
Not always. Some authenticator seeds do not export from a vault, so those services need re-enrolment in the new tool. List every service that uses vault based codes before cutover, re-enrol them one by one, and store the new recovery codes somewhere separate from the vault itself.
The Bottom Line
Start with the mapping table and the pilot, then the checklist, then the closure date, and do those three things before any wider rollout, because a wider rollout without them is how a promising move becomes a lingering parallel system. The team that runs a simple, written routine well will get more from the new tool than a team with a fancier setup and no routine, and that advantage grows every month the routine runs.
Pick the first step today, test it with real work tomorrow, and let the numbers over the next ninety days tell you what to improve next. That disciplined approach is what makes this kind of change pay, rather than becoming another project that starts with enthusiasm and fades within a month.
