Home › Offline version
Use it offline
The converter is one self-contained HTML file. Save it, disconnect from the internet, and open it from your own disk — it works exactly the same. Nothing to install, no runtime, no account, and no way for it to phone home.
movepasswords-offline.html
55 KB · version 2026.09.07 · works on Windows, macOS, Linux, Android and iOS
Right-click → “Save link as…” if your browser opens it instead of saving it. Then double-click the saved file to run it.
When you'd want this
- You don't want the file near a network at all. Reasonable: a password export is every credential you own in plaintext. Save this, pull the Wi-Fi, convert, delete, reconnect.
- Your workplace blocks the site, or blocks file uploads by policy, or you're on a locked-down machine.
- You have no connection where you're doing the migration.
- Your export is very large. The hosted page caps input as a wrong-file heuristic; the offline copy has no such limit.
- You want it to keep working. A file on your disk doesn't go away when a domain lapses. Keep a copy with your backups.
What it does that this site doesn't
The offline file offers all 210 source-and-destination combinations across every supported manager, not just the routes published here. The website's route list is about what people search for; there's no reason to withhold a working conversion from someone who already has the file. Pick your source and destination from two dropdowns and it shows the migration guide for that pair too.
Everything else is identical, and deliberately so: it is built from the same conversion engine as the pages on this site, in the same build. It cannot fall behind or report different warnings.
Verifying it yourself
You should not have to take our word for any of this, so here is how to check. All of it takes less time than the migration will.
The one-second version
Turn off your Wi-Fi, then convert your file. If it still works — and it will — nothing was uploaded, because there was nowhere to upload it to.
Read the file
Open it in any text editor. It is one file with no external references: no
<script src>, no stylesheet links, no fonts, no images. Search it for these
and you will find nothing:
| Search for | Which would mean |
|---|---|
fetch( | Sending data to a server |
XMLHttpRequest | The older way of doing the same |
sendBeacon | Fire-and-forget analytics |
WebSocket | A persistent outbound connection |
localStorage, indexedDB | Keeping your passwords in the browser after you close it |
https:// in a src or href | Loading anything from a third party |
The build refuses to produce this file if any of those appear in it — that check runs on every release, so a careless change can't quietly ship.
The file's own policy forbids it
Near the top you'll find a Content-Security-Policy with
connect-src 'none'. That is the browser refusing to let this page open any
connection, whatever its code asks for. It turns a promise into an enforced rule.
Checksum
Compare against the file you downloaded:
| SHA-256 | 4713560c292b7c2bdcaca8819b46f7cd6c2d74d6e3b832136282621b1e2a7bdb |
macOS or Linux: shasum -a 256 movepasswords-offline.html ·
Windows: certutil -hashfile movepasswords-offline.html SHA256
Still delete the files afterwards
Working offline protects the file from the network. It does not protect it from your own disk.
Your export and the converted copy are both plaintext, readable by anything on the machine —
including backup software and cloud sync clients. Delete both as soon as the import is
verified, empty your trash, and confirm the deletion propagated if your Downloads folder syncs
anywhere.
Why there's no installer
We could ship a desktop app, and it would be worse. An installer asks you to trust a signed
binary you can't read, grant it whatever permissions it requests, and keep it updated. A single
HTML file you can open in a text editor, run inside the browser's sandbox, and delete by
dragging to the trash is a smaller thing to trust — which matters more here than anywhere else,
because of what you're about to feed it.