Commands

Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.

To get help on a particular command, run:

help <command>

Import and Export Commands

import command

Command: import

Detail: Import data to Keeper from a local file or other password managers.

Parameters:

Path of file to import from.

*note: in file paths, backslash "\" needs to be escaped by using two in a row "\\"

Switches:

--format <{json, csv, keepass, lastpass, myki, manageengine, 1password, bitwarden, thycotic, proton}> file format (required)

--folder <FOLDER PATH OR UID> import into a specified folder

--filter-folder <FOLDER NAME> only import the specific folder from the source vault

-s, --shared import folders from file as shared folders

-p, --permissions <PERMISSIONS> default shared folder permissions if importing folders as shared

folders

• U - manage users permission granted

• R - manage records permission granted

• E - edit records permission granted

• S - share permission granted

• A - all permissions granted

• N - no permissions granted

-dc, --display-csv show instructions for importing using the CSV format

-dj, --display-json show instruction for importing using JSON format

--record-type <RECORD TYPE NAME> import all records as the specified type

--dry-run display records to be imported without importing them

--show-skipped display skipped records

--update update records with common login, url or title

Examples:

import C:\\records.csv --format csv
import C:\\records.csv --format csv --folder social
import C:\\shared-records.json --format json -s -p A
import C:\\lastpass\\passwords.csv --format lastpass
import --display-csv
import C:\\records.csv --format csv --record-type login
import --format=thycotic https://hostname/SecretServer
import --format=thycotic username@hostname --update --dry-run

1. Import records from a "records" CSV file into the vault

2. Import records from a "records" CSV file into the "social" folder

3. Import records from a "shared-records" json file, importing and folders as shared folders with all permissions granted

4. Import passwords from a Lastpass export file

5. Show instructions and example for importing using CSV

6. Import records from a "records" CSV file as login type records

7. Import records from Thycotic/Delinea Secret Server using full URL

8. Import records from Thycotic/Delinea Secret Server using username/hostname syntax

Additional import instructions are documented below.

export command

Command: export

Detail: Export vault data to a file or the console

Parameters:

File name to export to, or nothing to export to console stdout

Switches:

--format <{json, csv, keepass}> file format

--max-size <SIZE> maximum size of file attachment to export

• format: number followed by "K","M","G" (Kilobyte, Megabyte, Gigabyte respectively)

• e.g. "100k" , "10M" , "2G"

-kp, --keepass-file-password <PASSWORD> if exporting in keepass format, set the file's password

--zip Create ZIP archive for file attachments. JSON only

--folder <FOLDER NAME OR UID> select a folder as the export source

--store-in-vault Stores exports file as a record attachment. Keepass only

Examples:

export my-vault.csv --format csv
export --format json --max-size 10K
export keeper.kdbx --format keepass -kp 9EqfhCqbym-w
export socials.csv --format csv --folder "Socials"

1. Export the vault in CSV format to a file named "my-vault"

2. Export the vault in JSON format to the console, ignoring any file attachments over 10 KB

3. Export the vault in keepass format to a file named "keeper" and set the file's password

4. Export the records in the "Socials" folder

download-membership command

Command: download-membership

Detail: Download shared folder membership to a local JSON file.

Switches:

--source <{keeper, lastpass, thycotic}> (required)

--folders-only Unload shared folder membership only. Skip team membership.

--sub-folder <{ignore, flatten}> (optional, default ignore) Thycotic/Delinea Secret Server allows shared folder permission to be overwritten by the subfolders. This option controls how these folders are imported.

• ignore Subfolder permissions are ignored. Folder structure is preserved.

• flatten Such subfolders are moved to the root of the vault. Folder permissions are preserved.

This command will reach out to the source password vault (either the current Keeper vault, remote LastPass vault or remote Thycotic/Delinea Secret Server), retrieve Team and Shared Folder file structure, and then create a local JSON file containing this structure. The filename generated locally will be called shared_folder_membership.json.

This file can then be used for subsequently sharing folders with Keeper users and teams. The sharing operation is performed by executing the apply-membership command.

Examples:

download-membership --source=lastpass
apply-membership

or

download-membership --source=thycotic
apply-membership

or

download-membership --source=keeper
apply-membership

Sample Permission File

After executing download-membership, the resulting JSON file contains information about the teams, user-team assignments and shared folder permissions. An example file is below. This example file contains 3 teams, and 3 shared folders. The 3rd shared folder exists within a regular folder.

{
  "teams": [
    {
      "name": "AWS Team",
      "uid": "A-XXiApbEBMeqMbfcHMbyQ",
      "members": [
        "user1@company.com",
        "user2@company.com",
        "user3@company.com",
        "user4@company.com",
        "user5@company.com"
      ]
    },
    {
      "name": "Secrets Managers",
      "uid": "EqLqF_D7qO6zOs_9OxfWiw",
      "members": [
        "user5@acme-demo.com",
        "user6@acme-demo.com",
        "user7@acme-demo.com"
      ]
    },
    {
      "name": "Social Media",
      "uid": "yIKS09TaqxESMwRym4aMkQ",
      "members": [
        "craig@acme-demo.com",
        "jack@acme-demo.com",
        "randy@acme-demo.com",
        "shiela@acme-demo.com"
      ]
    }
  ],
  "shared_folders": [
    {
      "path": "Amazon AWS",
      "uid": "aWaqKbSTaLTmpKlVeusrow",
      "manage_users": true,
      "manage_records": true,
      "can_edit": true,
      "can_share": true,
      "permissions": [
        {
          "name": "AWS Team",
          "manage_users": true,
          "manage_records": true,
          "uid": "A-XXiApbEBMeqMbfcHMbyQ"
        },
        {
          "name": "Secrets Managers",
          "manage_users": true,
          "manage_records": true,
          "uid": "EqLqF_D7qO6zOs_9OxfWiw"
        },
        {
          "name": "craig@acme-demo.com",
          "manage_users": true,
          "manage_records": true
        },
        {
          "name": "jack@acme-demo.com",
          "manage_users": true,
          "manage_records": true
        }
      ]
    },
    {
      "path": "PR Social ",
      "uid": "d4iVESSPVvuXBJtlkDzWzg",
      "manage_users": false,
      "manage_records": false,
      "can_edit": false,
      "can_share": false,
      "permissions": [
        {
          "name": "Social Media",
          "manage_users": false,
          "manage_records": false,
          "uid": "yIKS09TaqxESMwRym4aMkQ"
        },
        {
          "name": "craig@acme-demo.com",
          "manage_users": true,
          "manage_records": true
        },
        {
          "name": "shiela@acme-demo.com",
          "manage_users": true,
          "manage_records": true
        }
      ]
    },
    {
      "path": "Outer Regular Folder\\Inner Shared Folder",
      "uid": "0VBh9NNDm4eyhHqnXI0OeA",
      "manage_users": false,
      "manage_records": false,
      "can_edit": false,
      "can_share": false,
      "permissions": [
        {
          "name": "user1@company.com",
          "manage_users": true,
          "manage_records": true
        },
        {
          "name": "user2@company.com",
          "manage_users": true,
          "manage_records": true
        }
      ]
    }
  ]
}

apply-membership command

Command: apply-membership

Detail: Apply shared folder membership changes from a local JSON file. This command is used alongside the download-membership command.

Switches:

--full-sync force full sync of shared folder permissions. Permissions are only added by default

The apply-membership command will look for a JSON file (defaults to shared_folder_membership.json) that contains sharing permissions.

The reason for separating the downloading and applying of membership, is so that you can apply the membership changes as new Keeper users or teams are onboarded. The apply-membership command can be run over and over, or whenever a new Keeper user account or team is created. Shared folder membership will be applied to any new corresponding user accounts and teams.

Examples:

apply-membership --full-sync

or

apply-membership my_permission_file.json

download-record-types command

Command: download-record-types

Detail: Download custom record types to a JSON file.

Switches:

--source <{keeper, thycotic}> (required)

This command will reach out to the source password vault (either Keeper or Thycotic/Delinea Secret Server), retrieve custom record types (Secret Server calls it secret templates), and then create a local JSON file containing this information. The filename generated locally will be called record_types.json.

This file can then be used for subsequently loading custom record types to Keeper. The record types loading operation is performed by executing the load-record-types command.

--ssh-key-as-file

Thycotic/Delinea Secret Server stores SSH keys as file attachments. Keeper stores SSH keys on a record. If you would like to preserve Thycotic/Delinea Secret Server behavior (imported SSH keys from Secret Server will be stores as file attachments) use this option.

Examples:

download-record-types --ssh-key-as-file 

or

download-record-types my_record_types_file.json

load_record_types command

Command: load-record-types

Detail: Load custom record types from a JSON file into Keeper.

Detail: Load custom record types from a local JSON file. This command is used alongside the download-record-types command.

The load_record_types command will look for a JSON file (defaults to record_types.json) that contains custom record types and loads missing record types into Keeper.

Examples:

load-record-types

or

load-record-types my_record_types_file.json

Detailed Import Instructions

Step by step instructions are documented for migrating data and importing into Keeper from the following sources:

• Cyberark

• LastPass

• Thycotic/Delinea Secret Server

• Keepass

• ManageEngine

• Myki

• Proton Pass

• CSV

• JSON

Exporting Records from Keeper

To export records from your vault, use the export command. Supported export formats:

• JSON

• CSV

• Keepass (see additional install instructions)

JSON export files contain records, folders, subfolders, shared folders, default folder permissions and user/team permissions. CSV import files contain records, folders, subfolders, shared folders and default shared folder permissions. Keepass files contain records, file attachments, folders and subfolders.

Keepass Export

$ keeper export --format=keepass test.kdbx

You can optionally provide the keepass encrypted file password through command line option --keepass-file-password

This flag will only apply when --format=keepass is set. The Master Password is required for Keepass export - if none provided you will be asked during export, and your input will be masked.

$ keeper export --format=keepass --keepass-file-password=file_password_here test.kdbx

See: Import and Export Data

Keeper Commander will log on to CyberArk Privilege Cloud Web Portal or the self-hosted Password Vault Web Access (PVWA), retrieve accounts and their passwords, and automatically create corresponding Server records in Keeper.

keeper import --format=cyberark server.domain

If the server is a CyberArk Privilege Cloud Web Portal, i.e., it ends in ".cyberark.cloud," then it will prompt for the CyberArk Identity Tenant ID and CyberArk Service User credentials:

CyberArk Identity Tenant ID: abc12345
CyberArk service user name: myserviceuser
Cyberark service user password:

ℹ️ The Identity Tenant ID is the first part of the login URL, e.g., https://abc12345.id.cyberark.cloud/...

If the server is any other hostname or IP address, then it will prompt for the authentication method, username, and password for PVWA:

CyberArk logon type (Cyberark, LDAP, RADIUS or Windows): LDAP
CyberArk username: myusername
CyberArk password: 

ℹ️ Use LDAP (not Windows) to log in with an Active Directory account

CyberArk Accounts based on Platforms in the Windows and *NIX groups will be imported as Server records. Accounts based on the Business Website platform, i.e., CyberArk Workforce Password Management Accounts, will import as Login records.

Importing Accounts

The process will list the Accounts to be imported, including the ID, Name, and Safe. It will also show a progress meter with a timer and ETA. If password retrieval fails for an Account, a Retry, Skip, or Skip All dialog is presented. The process can retry the request, skip the Account, or skip all Accounts that trigger the same HTTP status.

Skipped Accounts

The skipped Accounts will be listed after processing is complete. The list includes the ID, Name, Safe, and the Error code and message.

Using a search string to limit the imported Accounts

The process will import all Accounts by default; however, appending a question mark (?) followed by the search string will limit processing to Accounts that match the search.

keeper import --format=cyberark 10.11.12.13?WinDomain

Using a custom query string

Alternatively, if the search string contains '=', the process will pass it to the CyberArk Get Accounts endpoint as a query string. E.g.,

keeper import --format=cyberark example.cyberark.cloud?limit=10&offset=20

passes the limit and offset parameters to the Accounts endpoint, causing it to page the accounts 10 at a time, starting at the 20th account.

PowerShell Method

The end-user guide includes a process to import data into Keeper from Cyberark using a PowerShell script. Note, however, that it accesses the Vault server directly, so it only works on self-hosted servers.

Overview

This document outlines the process for automatically and seamlessly migrating LastPass data into Keeper. Keeper supports automatic import of your LastPass vault with Master Password and MFA. Keeper also supports federated logins to LastPass from Okta/Azure/Google, and this is explained in detail below.

LastPass > Keeper Transfer Supported Data:

• Transfer of Passwords

• Transfer of Folders

• Transfer of Shared Folders

• Transfer of Shared Folder permissions (users and teams)

• Transfer of custom fields, TOTP seeds

• Transfer of File Attachments

Summary of Steps

The steps we recommend to importing an entire organization from LastPass to Keeper are the following:

1. Admin downloads the membership of the Shared Folders data to json file

2. Admin imports their shared folders and non-shared passwords

3. Admin applies shared folder membership (includes permissions) for users who already exist in Keeper

4. End-users migrate their vaults over using the Keeper Desktop application.

5. Admins continue to periodically apply membership as more users join Keeper

Step 1. Download Team and Shared Folder Membership

In Keeper Commander, the Keeper/LastPass Administrator will run the following:

download-membership --source=lastpass

This will perform the following 3 functions:

• Download all Shared Folder information

• Download Shared Folder permissions

This step downloads a file locally called "shared_folder_membership.json" which contains the shared folder structure. The location of this file on Windows is typically C:\Users\username\shared_folder_membership.json. On Linux/Mac, it will be in the location where you run Commander.

The download-membership command basically produces a local file containing the share relationships. You can simply edit this file in a text editor and make any permission changes needed before proceeding to the next step.

Step 2. Import Shared Folders

In Keeper Commander, the Admin will run the following command to perform the import of shared folders and data.

import --format=lastpass lastpass@example.com

The first time the import command is run, you may get the following notice that LastPass wants to verify the device from which you are connecting.

Try again OR look for an email from LastPass to verify it's you.

Check the email address associated with your LastPass account and click "verify" to allow Keeper to access the records in your LastPass account.

Record Type Mapping

Typed LastPass items are automatically imported as Keeper records with corresponding record types if your Enterprise environment has Record Types activated.

See the LastPass Item Type and corresponding Keeper Record Type in the table below.

Share Permissions

If a folder is shared with another user or team in LastPass, the import will apply the same sharing permissions to Keeper teams with the same name, and Keeper users with the same email address.

Shared folder permissions can be re-applied and applied if a new Keeper user or team is added after the initial import.

Step 3. Apply Shared Folder and Team Memberships

To assign Share Permissions to your imported passwords from LastPass, use the apply-membership command:

apply-membership

This will read the file called "shared_folder_membership.json" from Step 1 and apply the shared folder permissions for any users and team which exist in the Keeper enterprise environment. This command is safe to run over and over again, and it will not generate duplicates.

Explanation: When users are invited/created through SSO or your invitation process, their public keys are created. Therefore, Keeper cannot apply membership until the users exist.

For this reason, the Keeper Admin needs to run the "apply-membership" command on a daily basis, hourly, or on demand, when users are created in Keeper.

Step 4. End-Users migrate with Keeper Desktop

The Keeper Admin will invite users through one of the following methods:

• Just-in-time provisioning through SSO login

• Invite through the Admin Console

• SCIM

When the user registers to create their vault, they will generate a public/private key pair. At this point, they will be able to receive shared folders, as outlined in the next step.

For transferring the user's LastPass private folders and records, we recommend directing the user to install the Keeper Desktop application.

Here's the link to the public / latest version:

Download Keeper Password Manager for iOS, Android, Mac, PC and moreKeeper® Password Manager & Digital Vault

To automatically deploy Keeper Desktop to your users through group policy, see:

Desktop ApplicationsEnterprise Guide

Receiving Shared Folders

Once users create their Keeper vaults, they can then be added to a team and/or a folder. The next time that the Admin runs the apply-membership command, any new Keeper users will receive access to their Shared Folders.

Due to the number of steps, we recommend performing a pilot test with a few users before rolling out to the entire organization.

If you have any questions please contact your Keeper sales engineer or email commander@keepersecurity.com.

Advanced Features

Transforming Email Domains for Sharing

If your LastPass email domain has changed and you would like to transition to a new email domain when transferring share permissions, you can use the --old-domain and --new-domain optional parameters. Example below:

download-membership --source=lastpass --old-domain=acme-old.com --new-domain=acme-demo.com lastpass@example.com

Override Imported Shared Folder Permissions

The LastPass download-membership applies the shared folder permissions from LastPass users to your Keeper shared folders, but the permission settings can be overridden during membership download.

To override the "manage records" and "manage users" permissions for all users on all imported shared folders, use the --permissions or --restrictions options.

--permissions allows the permission(s) for all users on all imported shared folder.

--restrictions denies the permission(s) for all users on all imported shared folders.

To set for "manage records" pass r, for "manage users" pass u for both use ru

// override enable manage records permission
download-membership --source=lastpass --permissions=r

// override disable manage users permission
download-membership --source=lastpass --restrictions=u

// override enable manage records and manage users permissions
download-membership --source=lastpass --permissions=ru

Import Top Level Folders as Shared Folders

You can optionally make all top level folders shared folders with specified permissions by passing the --shared and --permissions=<PERMISSIONS> flags.

The available permissions options are:

• U - manage users permission granted

• R - manage records permission granted

• E - edit records permission granted

• S - share permission granted

• A - all permissions granted

• N - no permissions granted

Use the letters corresponding to the permissions you want to grant with no spaces or characters in between.

import --format=lastpass --shared --permissions=URES lastpass@example.com 

Attachment Files Cache

Attachment files can be cached during import so that they do not have to be redownloaded if another import is performed.

To run the import with a file cache, add the --file-cache <DIR> flag. Specify a directory to use as the cache.

To use the cache on a subsequent import, apply the --file-cache flag with the same directory.

import --format=lastpass --file-cache tmpDir

Record Size Limit

Keeper records have a size limit of 5MB (excluding attachments). If a record from LastPass is larger than this limit, fields will be converted to a text file, starting with the largest field, until the record is smaller than the limit.

Created attachments are named in the following format:

<title of field>_<type of field>_field.txt

For example a "notes" field titled "Instructions" would be converted to an attachment titled:

Instructions_notes_field.txt

Import to a Specified Folder

The contents of your LastPass vault can be imported into a specified folder in your Keeper vault. To do this, use the --folder option.

import --format lastpass --folder="A Keeper Folder" lastpass@example.com

Import from a Specified LastPass Folder

You can limit the import of your LastPass vault to a specific folder in LastPass by using the --filter-folder option. This filters the data from LastPass to ONLY the specific folder on the LastPass side.

import --format lastpass --filter-folder="Some Folder In LastPass" lastpass@example.com

Locating Duplicates

If you believe there may be duplicate records in your vault after import, you can use the find-duplicate feature in Commander to locate them.

If you wanted to locate duplicates based on title, login, password for example:

find-duplicate --title --login --password

From the output of this report, you can gather a list of record UIDs to delete with the "rm" command.

Changing Record Permissions

By default, records are imported into Shared Folders with "Can View" permission. This means that the record is only editable by the owner of the record, and any share admins that have been added to the folder.

To change the permissions of records inside a shared folder (after the import is complete), you can use the record-permission command. For example:

record-permission -a grant --can-edit --recursive <folder name or UID>

Secret Server Import

This document outlines the process for automatically and seamlessly migrating Secret Server (Delinea/Thycotic) data into Keeper which includes private folders, shared folders, permissions, file attachments, TOTP codes. This process utilizes the Secret Server API to automate the process.

Note: A basic import capability is available on the Keeper Web Vault and Desktop App which supports Thycotic XML format. Visit the vault Settings > Import > Thycotic screen. The XML format does not include attachments or permissions. Therefore, we recommend using the automated method as described in this document.

Pre-requisites

In Secret Server admin settings, ensure Webservices are enabled

Admin -> Configuration -> Edit -> Enable Webservices

Adjust Session Timeout

In Secret Server admin settings, ensure that "Session Timeout for Webservices" is set to a high enough value, since large vaults will take time to process. For example, 59 minutes.

Step 1. Download Team and Shared Folder Structure

Prior to running the above code snippet, make sure to:

• Verify the base Thycotic URL in your browser

• The Username is in the correct format:

  • If it's a AD user, the format is DOMAIN\username otherwise username

In Keeper Commander, the Keeper/Thycotic Administrator will run the following:

download-membership --source=thycotic

You will then be prompted with the following:

...     Thycotic Host or URL: https://xyz.acme.com/secretserver
...     Thycotic Username: acme.com\user

Executing the above code snippet will perform the following 3 functions:

• Download all Shared Folder information

• Download Team Membership

• Download Shared Folder permissions

This step downloads a file locally called "shared_folder_membership.json" which contains the team and shared folder structure. The file location should be under your user folder

Step 2. Import Shared Folders

Before importing records, we will first create the shared folder structure on the Keeper side. Run the below command:

import --format=json shared_folder_membership.json

Step 3. Export TOTP Codes

The TOTP codes stored in Thycotic/Delinea Secret Server can only be retrieved by manually downloading a CSV file. The admin of Secret Server needs to go to Secret Server > Export Secrets and select the following options:

• Export Type: Export All

• Export Folder Path: Checked

• Export TOTP Settings: Checked

• Export Format: CSV

Export the file and save it to your home folder or the folder where Keeper Commander is running. By default, the file will be called "secrets-export.csv."

Step 4. Import the Secret Server Vault

In Keeper Commander, the Keeper/Thycotic Administrator will run the following command to perform the import of data using the Secret Server API:

import --format=thycotic https://your-secret-server-hostname
or
import --format=thycotic username@your-secret-server-hostname

This command will take several minutes (or more) to complete, depending on the number of vault records and users. A large Secret Server instance could take 20 minutes or more.

Commander will attempt to build the same folder structure as Secret Server in the admin's Keeper vault.

Commander will also look for the file "secrets-export.csv" in the user's home folder or current Commander folder to import TOTP codes.

Note 1: This command will import and populate regular folders, shared folders and records within the folders. This will NOT import the private folders of other users within Secret Server. This step will only import the information available to the admin.

Note 2: If a Shared Folder is found within another shared folder with different permissions, the shared folder will be moved to the root folder (since Keeper does not support subfolder permissions).

Step 5. Applying Memberships

Note: All Thycotic teams must exist in Keeper with exact matching names before execution. This way, existing users will be applied to the corresponding teams. You can create missing teams through:

• Keeper Admin Console (Teams > Create New Team)

• Commander's create-team command

In Keeper Commander, the Keeper/Thycotic Administrator will run the following:

apply-membership

This will read the file called "shared_folder_membership.json" from Step 1 and apply the shared folder permissions for any users and teams in the Keeper enterprise environment. This command is safe to run repeatedly and will not generate duplicates.

Explanation: When users are invited/created through SSO or your invitation process, their public keys are created. Therefore, Keeper cannot apply membership until the users exist.

For this reason, the Keeper Admin must run the "apply-membership" command daily, hourly, or on demand when users are created in Keeper.

Step 6. End-Users are invited to Keeper

The Keeper Admin will invite users through one of the following methods:

• Just-in-time provisioning through SSO login

• Invite through the Admin Console

• SCIM

When the user registers to create their vault, they will generate a public/private key pair. At this point, they will be able to receive shared folders, as outlined in the next step.

Receiving Shared Folders

The next time that the Admin runs the apply-membership command, any new Keeper users will receive access to their Shared Folders.

Due to the number of steps, we recommend performing a pilot test with a few users before rolling out to the entire organization.

If you have any questions, please email commander@keepersecurity.com.

Keepass Import

Keeper Commander supports importing the record and folder structure directly from an encrypted Keepass file. File attachments are also supported. Make sure to first follow these instructions to install the necessary keepass modules.

$ keeper import --format=keepass test.kdbx

You can optionally make all top level folders as shared folder object with default permissions.

$ keeper import --format=keepass --shared --permissions=URES test.kdbx

For more options, see the help screen:

$ keeper help import

ManageEngine Import

Keeper supports importing the resources and connected accounts directly from a ManageEngine Password Manager Pro server. Importing file attachments from a File Store resource is also supported. You will need a ManageEngine user with API access and a generated token to use this import functionality.

$ keeper import --format=manageengine https://localhost:7272

Substitute https://localhost:7272 with your server URL and port. You will then need to enter your ManageEngine API token.

Myki Import

Keeper supports importing the records from a Myki CSV file.

$ keeper import --format=myki myki.csv

Overview

This document outlines the steps required to seamlessly migrate your Proton Pass Vault data into Keeper.

Export your Proton Pass Data as a JSON File

By default, Proton Pass exports your data as a JSON File. Exporting on Proton Pass is only supported on the Proton Pass Browser Extension.

To export on Proton Pass:

1. Navigate to settings on your Proton Pass Browser Extension

2. Click on the Export tab and select Export.

This will export a zip file that contains the JSON file. Keeper commander gives you the option of providing either the zip file or the JSON file as input.

Import your Proton Pass Data into Keeper

On Keeper Commander and with the exported zip file, executing the following command will import your Proton Pass Data:

import --format=proton ProtonPass.zip

Commander CSV Record Import

Keeper Commander supports .csv text file import using comma separated values. CSV import files can contain data for certain fields, folders, subfolders, shared folders and default shared folder permissions.

Use this order of fields shown below with commas separating each value (and no spaces around the commas). Not all fields are required; some can be left blank.

Folder,Title,Login,Password,Website Address,Notes,Shared Folder,Custom Field1 Name,Custom Field1 Value,Custom Field2 Name,Custom Field2 Value

• To specify subfolders, use backslash "\" between folder names

• To set shared folder permission on the record, use the #edit or #reshare tags as seen below

• Enclose fields in quotes for multi-line or special characters

• Ensure files are UTF-8 encoded for support of international or double-byte characters

Below is an example csv file that showcases several import features including personal folders, shared folders, subfolders, special characters and multi-line fields.

Business,Twitter,marketing@company.com,password,https://twitter.com,Some interesting notes!,,API Key,"131939-AAAEKJLE-491231$##%!",Date Created,2018-04-02
Subfolder1,Twitter,craig@gmail.com,xwVnk0hfJmd2M$2l4shGF#p,https://twitter.com,,Social Media\Customer1#edit#reshare
Subfolder2,Facebook,craig@gmail.com,TycWyxodkQw4IrX9VFxj8F8,https://facebook.com,,Social Media\Customer2#edit#reshare
,Google Dev Account,mydevaccount@gmail.com,"8123,9fKJRefa$!@#4912fkk!--3",https://accounts.google.com,"Google Cloud ID 448812771239122
Account Number 449128
This is multi-line",Shared Accounts#edit#reshare,2FA Phone Number,+19165551212

To import this file as "login" records:

keeper import --format=csv --login-type test.csv

The resulting vault will look like this:

Here is a list of some record types (you may have more if you have custom record types, or less if you are restricting some record types):

Below is a list of all possible field types (including custom fields). You can use these as a custom field names such as $oneTimeCode as shown below.

More advanced import options are available using the JSON Import format described in the next section.

JSON Record Import

JSON import files can contain records, folders, subfolders, shared folders, default folder permissions and user/team permissions.

Below is a JSON import file with 2 records. The first record is added to a folder called "My Websites\\Online". The second record is added to "Social Media" and also added to a shared folder called "Shared Social".

The import file example below is an array of record objects which can import into private folders and shared folders. Note in the example that the Facebook record contains a TOTP seed which will render on the Vault user interface and Commander CLI.

{
  "records": [{
    "title":"Google",
    "folders": [
      {
        "folder": "My Websites\\Online"
      }
    ],
    "login": "testing",
    "password": "lk4j139sk4j",
    "login_url": "https://google.com",
    "notes": "These are some notes.",
    "custom_fields": {"Favorite Food":"Cheetos"}
  },
  {
    "title":"Facebook",
    "folders": [
      {
        "folder": "Social Media"
      },
      {
        "shared_folder": "Shared Social",
        "can_edit": false,
        "can_share": false
      }
    ],
    "login": "me@gmail.com",
    "password": "123123123123",
    "login_url": "https://facebook.com",
    "notes": "This is our corporate shared record.",
    "custom_fields": {
      "Facebook Application ID":"ABC12345",
      "$oneTimeCode": "otpauth://totp/Amazon:me@company.com?secret=JBSWY3DPEHPK3PXP&issuer=Amazon&algorithm=SHA1&digits=6&period=30"}
  }]
}

Another example below first creates shared folders that are shared to users and teams, then imports records into the shared folders. The format of the file is slightly different and allows you to separate the creation of shared folder objects and records:

{
  "shared_folders": [
    {
      "path": "My Customer 1",
      "manage_users": true,
      "manage_records": true,
      "can_edit": true,
      "can_share": true,
      "permissions": [
        {
          "uid": "kVM96KGEoGxhskZoSTd_jw",
          "manage_users": true,
          "manage_records": true
        },
        {
          "name": "user@mycompany.com",
          "manage_users": true,
          "manage_records": true
        }
      ]
    },
    {
      "path": "Testing\\My Customer 2",
      "manage_users": true,
      "manage_records": true,
      "can_edit": true,
      "can_share": true,
      "permissions": [
        {
          "uid": "ih1CggiQ-3ENXcn4G0sl-g",
          "manage_users": true,
          "manage_records": true
        },
        {
          "name": "user@mycompany.com",
          "manage_users": true,
          "manage_records": true
        }
      ]
    }
  ],
  "records": [
    {
      "title": "Bank Account 1",
      "login": "customer1234",
      "password": "4813fJDHF4239fdk",
      "login_url": "https://chase.com",
      "notes": "These are some notes.",
      "custom_fields": {
        "Account Number": "123-456-789"
      },
      "folders": [
        {
          "folder": "Optional Private Folder 1"
        }
      ]
    },
    {
      "title": "Bank Account 2",
      "login": "mybankusername",
      "password": "w4k4k193f$^&@#*%2",
      "login_url": "https://amex.com",
      "notes": "Some great information here.",
      "custom_fields": {
        "Security Group": "Public",
        "IP Address": "12.45.67.8"
      },
      "folders": [
        {
          "folder": "Optional Private Folder 1"
        },
        {
          "shared_folder": "My Customer 1",
          "can_edit": true,
          "can_share": true
        }
      ]
    }
  ]
}

The format must be strict JSON or it will fail parsing. To import this file:

$ My Vault> import --format=json import.json

There are more complex import file examples that supports shared folders, folder permissions, user permissions and team permissions located in the sample_data/ folder. To import the sample JSON file into your vault, type this command:

• Example 1: import.json.txt

• Example 2: import_records_existing_folders.json.txt

• Example 3: import_records_into_folders.json.txt

• Example 4: import_shared_folders.json.txt

• Example 5: import_shared_folders_and_records.json.txt

$ My Vault> import --format=json sample_data/import.json.txt

The sample file contains "permissions" objects that contain email address or team names. If the email or team name exists in your Keeper enterprise account, they will be added to the shared folder, otherwise the information is ignored.