Migrating to Ennote: Import Secrets from 1Password, LastPass, and Bitwarden via CLI

For years, engineering teams have shoehorned infrastructure secrets—like production database URIs, API keys, and TLS certificates—into legacy password managers designed for web browser autofill. While these tools are great for personal logins, they lack the programmatic governance, zero-persistence environments, and native Kubernetes integrations required for modern DevSecOps.

When organizations decide to upgrade to an identity-driven secret manager, the biggest hurdle is usually the migration itself. Manually copying hundreds of API keys and environment variables across systems is error-prone, insecure, and incredibly tedious.

To eliminate this friction, we have updated the Ennote CLI to natively support bulk secret imports from the most common legacy password managers. You can now ingest thousands of records in seconds directly from your terminal.

Supported Export Formats

The Ennote CLI parsing engine has been mapped to automatically handle the proprietary schemas and folder structures of the following exports:

  • 1Password (.1pux): The 1Password Unencrypted Export format. This is the recommended format for 1Password users as it retains rich metadata, item categories, and custom fields much better than standard CSVs.
  • 1Password (CSV): Standard comma-separated export for older 1Password vaults.
  • LastPass (CSV): The default plaintext export format generated by the LastPass web vault.
  • Bitwarden (CSV): Standard export format from the Bitwarden web or desktop applications.

The CLI Workflow

Importing your legacy vault into Ennote is designed to be a single-command operation.

First, ensure you are authenticated with the CLI and have the necessary Role-Based Access Control (RBAC) permissions to write to your target Ennote Workspace:

ennote auth login

Once authenticated, use the ennote secret import command. By default, the CLI will automatically detect the format of your file (via the --format auto default setting). You can specify your target workspace using the global --workspace-id flag, or rely on your local environment configuration.

Importing from 1Password (1PUX)

# Import a 1PUX file archive and target a specific workspace
ennote secret import ./export.1pux --workspace-id "backend-infra-id"

If your 1PUX file contains multiple vaults (e.g., "Personal" and "Production"), you can filter the import to ensure you only ingest infrastructure secrets:

# Import only the "Production" vault from a 1PUX export
ennote secret import ./export.1pux --vault "Production"

Importing from CSV (LastPass, Bitwarden, 1Password)

Because the Ennote parser utilizes auto-detection, CSV files from major password managers are handled seamlessly:

# Import a standard CSV file
ennote secret import ./secrets.csv

If your file has an unusual extension but is formatted as a CSV, you can force the parser using the --format flag:

# Force CSV parsing for a text file
ennote secret import ./export.txt --format csv

Dry-Run: Measure Twice, Cut Once

Because legacy password managers often treat secrets as generic "notes" or bundle them with irrelevant data, we highly recommend running your first import with the --dry-run flag.

This will parse the file and output exactly how your secrets will be mapped in Ennote without actually sending the data to the server. Add the --verbose flag to see every parsed secret and warning.

# Preview the import without writing anything to the Ennote vault
ennote secret import ./secrets.csv --dry-run --verbose

Security Considerations for Local Exports

Crucial Warning: All export files generated by 1Password, LastPass, and Bitwarden (both .1pux and .csv) are completely unencrypted plaintext.

During the migration window, your entire organization's security posture is sitting in a file on your local hard drive. To perform this migration safely:

  1. Do not export the file to a cloud-synced folder (like iCloud, Dropbox, or OneDrive).
  2. Do not leave the file sitting in your ~/Downloads directory.
  3. As soon as the ennote secret import command completes successfully, securely shred the plaintext file from your disk immediately.
# On macOS/Linux, use the 'rm -P' or 'shred' command to overwrite the file before deletion
shred -u ./export.1pux

Upgrade to Zero-Persistence

Once your secrets are safely inside Ennote, they benefit from our verifiable Transient Envelope Encryption model and strict hardware security.

More importantly, your engineering team can stop copying API keys into local .env files. With your secrets migrated, developers can now use the Ennote CLI to inject environment variables directly into their local processes at runtime:

ennote secret get "stripe-prod-keys" -- npm run dev

Nothing is written to disk, and the secrets vanish from memory the moment the process terminates.

Upgrade your CLI today via Homebrew, Scoop, or our universal shell script to access the new ennote secret import command.

Stop managing enterprise infrastructure like a personal web browser. Ennote stores passwords, API keys, and environment variables with Role-Based Access Control, verifiable supply chain security, and sub-second Kubernetes synchronization. Start for free on the Developer plan.