The Password Migration Feature
Google Chrome is designed to make transitioning from other web browsers as frictionless as possible. One of the ways it achieves this is through the “Passwords importing” feature. When this flag is enabled, Chrome allows users to navigate to their password manager settings and import a raw .csv file containing all their saved usernames and passwords exported from another browser (like Firefox or Edge) or a third-party password manager (like Bitwarden or 1Password), instantly populating Chrome’s internal credential database.
While this is incredibly convenient for a single user setting up a new computer, it can be a massive security vulnerability in corporate or shared environments. If you manage a fleet of computers and mandate the use of a secure, enterprise-managed password vault, allowing users to import arbitrary, unverified .csv files into the local Chrome browser bypasses your security policies. Furthermore, on a shared family computer, allowing imports makes it too easy for someone to accidentally merge their credentials into a shared profile. To lock down the browser’s credential manager, you must disable the import functionality.
How to Turn Off Password Importing
You can remove the import option from the Chrome settings UI via the experimental flags menu.
- Open Google Chrome.
- Click inside the main address bar at the top of the browser.
- Type
chrome://flagsand press Enter. - A page titled “Experiments” will load.
- In the search bar at the top, type Password import.
- The specific flag will appear highlighted in yellow. Next to it is a dropdown menu.
- Change the dropdown menu setting from “Default” to Disabled.
- Click the blue Relaunch button at the bottom of the screen.
Upon restarting, the option to import passwords from a .csv file will be completely removed from the Google Password Manager settings page, forcing users to either save passwords manually as they browse or rely on your designated third-party extension.