Convert credentials from legacy password managers to the FIDO Alliance CXP protocol (CXF format).
🚧 DISCLAIMER: This project is still under development and not ready for production use, furthermore both specs are still in draft stage. Use at your own risk. 🚧
cxporter is a command-line tool that converts credentials from legacy password manager formats (KeePass, Chrome, Firefox, Bitwarden) and local credential stores (SSH keys) into the FIDO Alliance's Credential Exchange Format (CXF). It enables secure, encrypted credential migration to any CXP-compliant password manager.
- Multi-source support: Import from KeePass (.kdbx), Chrome CSV, Firefox CSV, Bitwarden JSON, and SSH keys
- CXF output: Export to the standardized FIDO Alliance CXF format
- HPKE encryption: Optional encryption for secure credential transfers
- Metadata preservation: Maintains timestamps, folders, tags, and custom fields
go install github.com/nvinuesa/cxporter/cmd/cxporter@latestgit clone https://github.com/nvinuesa/cxporter.git
cd cxporter
make buildcxporter convert -s ssh -i ~/.ssh/id_ed25519 -o ssh-key.cxfcxporter convert -s keepass -i vault.kdbx -o vault.cxfcxporter convert -s chrome -i passwords.csv -o chrome.cxfTo enable HPKE encryption, provide an X25519 public key via --encrypt-key:
# With base64-encoded key
cxporter convert -s keepass vault.kdbx -o vault.cxp --encrypt-key <base64-pubkey>
# With key file
cxporter convert -s keepass vault.kdbx -o vault.cxp --encrypt-key @pubkey.key| Source | Format | Credential Types |
|---|---|---|
| KeePass | .kdbx | passwords, TOTP, notes, attachments |
| Chrome | CSV | passwords |
| Firefox | CSV | passwords |
| Bitwarden | JSON | passwords, TOTP, notes, cards, identities |
| SSH | key file | SSH key (single file) |
- Go 1.26rc1 or later (for building from source)
AGPL-3.0 - See LICENSE for details.