How to Export Passwords from iOS 18

Apple’s iOS 18 introduces a standalone Passwords app that officially allows users to export their saved logins, passkeys, Wi-Fi credentials, and verification codes into a CSV file. While initiating the export requires biometric authentication (Face ID or Touch ID) to ensure only the device owner can access the data, the resulting file itself is completely unencrypted. Consequently, users can export their credentials, but maintaining security depends entirely on how the exported file is handled and stored.

Step-by-Step: Exporting Passwords in iOS 18

To export your saved credentials from an iPhone or iPad running iOS 18:

  1. Open the Passwords app and authenticate using Face ID, Touch ID, or your device passcode.
  2. Access Settings: Tap the menu or settings icon within the app.
  3. Select Export: Tap the option labeled Export All Passwords (or Export Passwords).
  4. Confirm the Export: iOS will present a prompt warning that the exported file is not encrypted and can be read by anyone who accesses it. Confirm your choice to proceed.
  5. Re-authenticate: Provide your Face ID, Touch ID, or passcode once more to authorize the export.
  6. Save the File: Choose where to save the generated .csv file via the iOS Share Sheet, such as the local Files app or via AirDrop to another personal device.

Security Implications of the Exported File

While the generation of the file is secure and locked behind hardware authentication, the resulting CSV format presents significant security risks:

  • Plaintext Storage: All usernames, website URLs, passwords, and two-factor authentication secrets are saved in human-readable plain text.
  • No Built-in Encryption: Unlike encrypted database exports from third-party password managers (such as 1Password or Bitwarden), Apple's CSV export cannot be natively password-protected.
  • Cloud Sync Risks: If the file is saved directly to an unencrypted cloud storage folder (like iCloud Drive or Google Drive), anyone with access to that storage can view every credential.

Best Practices for Secure Exporting

To maintain credential security when migrating to another password manager or creating a backup:

  • Use Direct Transfers: AirDrop the file directly to your computer rather than emailing it or uploading it to unencrypted cloud services.
  • Import and Delete Immediately: Import the .csv file into your destination password manager right away. Once verified, permanently delete the CSV file and empty the "Recently Deleted" folder on your device.
  • Use Shared Groups for Day-to-Day Sharing: If you simply need to share credentials with family or colleagues, avoid exporting. Instead, use Apple's built-in Shared Groups feature, which shares passwords end-to-end encrypted directly through iCloud Keychain.