After the import, sign in from the notch
On a sign-in page the notch offers the login. Approve with Touch ID and Crest fills it in.
Chrome saves them to one file, and your Mac can read it.
New in 6.6
7 days free, no card. macOS 14 or later.
You're moving off Chrome, or you just want your passwords somewhere other than your Google account, and there's no button that sends them straight across. Chrome can save every password to one CSV file. Apple's Passwords app and Crest both read that file. Export the file and import it, then delete it, because it holds every password in plain text.
On a sign-in page the notch offers the login. Approve with Touch ID and Crest fills it in.
When the next page asks for a two-factor code, the notch offers that too.
The file is a CSV with a header row: name, url, username, password and note. Passkeys are not in it, so any site where you use a passkey still needs one made on the new side.
Apple Passwords then fills in Safari, and on your iPhone too when iCloud Keychain is on.
We built Passwords into Crest, our notch app for the Mac, so signing in happens from the notch: the login, then its two-factor code, with Touch ID. Crest has no Chrome button, because it reads any CSV with a website, a username and a password, and Chrome's file is one of those.
The file never leaves your Mac. Only the encrypted logins sync, to your other Macs and to Crest for iPhone (in public beta), and Crest can't see inside them.
On a sign-in page in Safari, the notch offers the login. You approve with Touch ID and Crest fills it in, and when the next page wants a two-factor code, the notch offers that too, so you never open a second app for it. Your codes live in the same place as your passwords.
Crest also keeps an eye on what you brought over. Watch lists the logins worth changing, most urgent first: ones found in a known breach, then reused, weak, or unchanged for 3 years since Crest saved them. The breach check sends only the first 5 characters of a hash of each password, never the password. There's more on Crest Passwords, and every setting is in the Passwords guide.
Chrome keeps its own copy until you remove it. If you want Chrome to stop offering to save new passwords, turn off Offer to save passwords in Google Password Manager > Settings. Then check that the CSV is gone from the Desktop, the Downloads folder and the Trash.
Try Crest free for 7 days, no card, and import your Chrome file in a minute.
7 days free, no card. macOS 14 or later. Refunds within 7 days if something is wrong.
The export itself is fine, but the file is not encrypted: anyone who opens it can read every password. Import it, delete it, empty the Trash, and never email it or put it in a shared folder.
No. The file holds passwords, with each site's address, username and note. A site where you sign in with a passkey needs a new passkey on the Mac side.
Crest needs a website, a username and a password column, and Chrome's file has them as url, username and password. If the file was opened and saved again in a spreadsheet app, check that the first row is still the header row, then try again.
Yes. Each reads its own copy of the logins. Import into both, then delete the file.
No. Crest reads the file on your Mac and encrypts every login there before it syncs. The file itself never leaves the Mac.
Keep reading: Send large files from a Mac · A WeTransfer alternative for Mac · Send files from a Mac to Windows or Android · Encrypted cloud storage for Mac · A Dropbox alternative for Mac · A password manager for Mac · Authenticator app for Mac · Best authenticator apps for Mac · Everything Crest does