NearSeal

2026-09-13

1Password and Bitwarden both warn: the file you export to switch password managers is plaintext

Twice in the last two migration guides on this site's own reading list, a password manager's own support page says the same uncomfortable thing about the file it just told you to create. 1Password's export documentation puts it in plain language: "Exported data files are not encrypted. They are stored in plaintext. Anyone with access to your exported data files will be able to read your passwords." Its advice is to "not email exported data files or store them online" and to "delete them when you are done with them." Bitwarden's export page says almost the same thing about its own plain .csv/.json output: don't send it over an insecure channel like email, and "delete the file immediately after use." Two competing companies, neither of which benefits from admitting a weakness, both landed on the identical warning — which is usually a sign the warning is real.

Why the file is plaintext at all

This isn't an oversight either company could quietly fix. 1Password 8's personal accounts can export to exactly two formats: .1pux — whose full name is literally "1Password Unencrypted Export" — or CSV, which the documentation notes only carries Login and Password items, not the rest of the vault. Neither format is encrypted; there is no third, protected option for moving your own vault out of the app. Bitwarden does better on paper: its encrypted export can produce a password-protected .json file, salted and stretched through Bitwarden's own KDF. But that file only re-imports into another Bitwarden account — it does nothing for someone moving to 1Password, Dashlane, or anywhere else. The moment a migration crosses vendors, which is exactly when people switch, CSV becomes the one format both ends can actually read, and CSV is plaintext by construction. The export step isn't the mistake. The plaintext file it produces, sitting in a Downloads folder for however long it takes you to finish the import, is the part worth taking seriously.

What's already looking for a file exactly like this one

In June 2025, researchers at Cybernews found 30 exposed datasets — some misconfigured, briefly public — that added up to 16 billion credential records between them, reported by CBS News among others. The records didn't trace back to one company's breach; they were compiled over time from repeated infostealer malware infections on individual people's own devices — the exact kind of software that quietly harvests browser data, saved credentials, and files it finds lying around on a compromised machine. A CSV named something like "1Password Export.csv" sitting in Downloads is not a hard target for software built to do exactly that.

And plaintext isn't even the worst-protected a stolen password vault has been. When LastPass disclosed its 2022 breach, the vaults an attacker copied were still AES-256 encrypted, locked behind each customer's master password. That didn't stop everyone: in March 2025, Krebs on Security reported that federal investigators had linked a $150 million cryptocurrency theft — roughly $24 million of it later recovered — to attackers who spent years running those stolen vaults through offline brute-force cracking, cashing in wherever a customer's master password turned out weak enough to break, then reading the crypto seed phrases some of them had saved in a Secure Note. That took real computing time against real encryption. A plaintext CSV asks an attacker for nothing at all.

What closing that gap actually looks like

Closing the export's exposure window 1. Export Vault writes a plaintext CSV/JSON 2. Exposure window Readable by anyone/ anything on the disk 3. Encrypt now NearSeal, in-browser, a fresh passphrase 4. Delete original Empty the trash too — not just delete — Encrypt the export the moment it finishes downloading, before it syncs anywhere — Use a passphrase you have never used for any account — not your old master password — Rename the file before encrypting: NearSeal's default format keeps the filename in the clear — Pause cloud sync on the Downloads folder if you can, so the plaintext copy is never backed up — Delete the plaintext original after encrypting, and empty the trash — don't just move it An encrypted copy sitting next to an undeleted plaintext copy protects nothing.
The export itself isn't the problem — the plaintext window between export and either deletion or encryption is.

NearSeal doesn't touch the export step; it closes the window right after it. Drag the exported file in, and by default it comes back as a single AES-256-GCM container, keyed from your passphrase via PBKDF2-SHA256 at 220 iterations (above OWASP's 2023 minimum of 600,000). If you'd rather have a copy openable by tools other than NearSeal down the line — a reasonable choice for something you might archive offline for years — the opt-in age-encryption.org format is available in the same dropzone. Both run entirely in your browser via a Web Worker; nothing about the file or the passphrase is ever sent anywhere. Then finish the job the export guides above don't fully cover: actually delete the plaintext original, and empty the trash — a "deleted" file that's still sitting in a Recycle Bin or Trash folder isn't gone, it's one click from being exactly where it started.

What this honestly doesn't fix

NearSeal's default format keeps the original filename in a cleartext header field, so an encrypted file still named "1Password Export.csv.nearseal" tells anyone who sees it exactly what's locked inside, even though they can't open it. Rename the plaintext file to something unremarkable before encrypting it, or use the age format instead, which carries no filename field at all (at the cost of losing the original name on decrypt). There's no passphrase recovery, ever — if you lose the passphrase on this encrypted copy, it's gone for good, same as every other file NearSeal seals; that's a reasonable trade for a backup you'll rarely open, but don't make it your only copy of anything you can't afford to lose twice. And speed matters more here than in most of what this tool protects: if the device you're exporting from already has an infostealer resident and watching for new files, encrypting a few minutes later doesn't undo whatever it already read in those first minutes. NearSeal can lock a file down the moment you act — it can't act for you, and it can't retroactively protect a plaintext file that malware already found.

The honest summary

1Password and Bitwarden aren't wrong to tell you the file is plaintext and to delete it quickly — that's genuinely good advice, and skipping it because you also encrypted the file isn't a substitute for doing it. What their advice doesn't cover is the file's whole lifespan: the seconds after it downloads, the folder it might briefly sync into, the version of it that outlives "delete" until the trash is actually emptied. Encrypting it the moment it lands turns that gap from "plaintext, hope nothing looks" into "locked, same as everything else on this site" — not a replacement for deleting the original, but the thing that makes the interval before you get to deleting it survivable if something does look.