LastPass Data Import
Automatic migration of your LastPass vault and shared folders
This document outlines the process for automatically and seamlessly migrating LastPass data into Keeper. Keeper supports automatic import of your LastPass vault with Master Password, federated SSO from Okta/Azure/Google and MFA.
LastPass > Keeper Transfer Supported Data:
- Transfer of Passwords
- Transfer of Folders
- Transfer of Shared Folders
- Transfer of Shared Folder permissions (users and teams)
- Transfer of custom fields, TOTP seeds
- Transfer of File Attachments
The steps we recommend to importing an entire organization from LastPass to Keeper are the following:
- 1.Admin downloads the membership of the Shared Folders and teams data to json file
- 2.Admin imports their shared folders and non-shared passwords
- 3.Admin applies shared folder membership (includes permissions) for users who already exist in Keeper
- 4.Admins continue to periodically apply membership as more users join Keeper
In Keeper Commander, the Keeper/LastPass Administrator will run the following:
This will perform the following 3 functions:
- Download all Shared Folder information
- Download Team Membership
- Download Shared Folder permissions
This step downloads a file locally called "
shared_folder_membership.json" which contains the team and shared folder structure. The location of this file on Windows is typically C:\Users\username\shared_folder_membership.json. On Linux/Mac, it will be in the location where you run Commander.
The download-membership command basically produces a local file containing the share relationships. You can simply edit this file in a text editor and make any permission changes needed before proceeding to the next step.
In Keeper Commander, the Admin will run the following command to perform the import of shared folders and data.
The first time the import command is run, you may get the following notice that LastPass wants to verify the device from which you are connecting.
Try again OR look for an email from LastPass to verify it's you.
Check the email address associated with your LastPass account and click "verify" to allow Keeper to access the records in your LastPass account.
importcommand will migrate and populate regular folders, shared folders and records within the folders. This will NOT import the private folders of other users within LastPass. This step will only import the information available to the admin.
Typed LastPass items are automatically imported as Keeper records with corresponding record types if your Enterprise environment has Record Types activated.
See the LastPass Item Type and corresponding Keeper Record Type in the table below.
If a folder is shared with another user or team in LastPass, the import will apply the same sharing permissions to Keeper teams with the same name, and Keeper users with the same email address.
Shared folder permissions can be re-applied and applied if a new Keeper user or team is added after the initial import.
To assign Share Permissions to your imported passwords from LastPass, use the
This will read the file called "
shared_folder_membership.json" from Step 1 and apply the shared folder permissions for any users and team which exist in the Keeper enterprise environment. This command is safe to run over and over again, and it will not generate duplicates.
Explanation: When users are invited/created through SSO or your invitation process, their public keys are created. Therefore, Keeper cannot apply membership until the users exist.
For this reason, the Keeper Admin needs to run the "apply-membership" command on a daily basis, hourly, or on demand, when users are created in Keeper.
If you would like to be notified as soon as users migrate to Keeper, use the Advanced Reporting & Alerts module in the Keeper Admin Console to set up an Alert when a user has been created.
The Keeper Admin will invite users through one of the following methods:
- Just-in-time provisioning through SSO login
- Invite through the Admin Console
When the user registers to create their vault, they will generate a public/private key pair. At this point, they will be able to receive shared folders, as outlined in the next step.
For transferring the user's LastPass private folders and records, we recommend directing the user to install the Keeper Desktop application.
Here's the link to the public / latest version:
To automatically deploy Keeper Desktop to your users through group policy, see:
Once users create their Keeper vaults, they can then be added to a team and/or a folder. The next time that the Admin runs the
apply-membershipcommand, any new Keeper users will receive access to their Shared Folders.
You can run apply-membership repeatedly as more users are onboarded to keeper. It will apply the memberships to users that exist in Keeper.
Due to the number of steps, we recommend performing a pilot test with a few users before rolling out to the entire organization.
If your LastPass email domain has changed and you would like to transition to a new email domain when transferring share permissions, you can use the
--new-domainoptional parameters. Example below:
download-membershipapplies the shared folder permissions from LastPass users to your Keeper shared folders, but the permission settings can be overridden during membership download.
To override the "manage records" and "manage users" permissions for all users on all imported shared folders, use the
--permissionsallows the permission(s) for all users on all imported shared folder.
--restrictionsdenies the permission(s) for all users on all imported shared folders.
To set for "manage records" pass
r, for "manage users" pass
ufor both use
// override enable manage records permission
download-membership --source=lastpass --permissions=r
// override disable manage users permission
download-membership --source=lastpass --restrictions=u
// override enable manage records and manage users permissions
download-membership --source=lastpass --permissions=ru
You can optionally make all top level folders shared folders with specified permissions by passing the
The available permissions options are:
- U - manage users permission granted
- R - manage records permission granted
- E - edit records permission granted
- S - share permission granted
- A - all permissions granted
- N - no permissions granted
Use the letters corresponding to the permissions you want to grant with no spaces or characters in between.
Attachment files can be cached during import so that they do not have to be redownloaded if another import is performed.
To run the import with a file cache, add the
--file-cache <DIR>flag. Specify a directory to use as the cache.
To use the cache on a subsequent import, apply the
--file-cacheflag with the same directory.
import --format=lastpass --file-cache tmpDir
Cached attachment files are encrypted
Keeper records have a size limit of 5MB (excluding attachments). If a record from LastPass is larger than this limit, fields will be converted to a text file, starting with the largest field, until the record is smaller than the limit.
Created attachments are named in the following format:
<title of field>_<type of field>_field.txt
For example a "notes" field titled "Instructions" would be converted to an attachment titled:
The contents of your LastPass vault can be imported into a specified folder in your Keeper vault. To do this, use the
You can limit the import of your LastPass vault to a specific folder in LastPass by using the
--filter-folderoption. This filters the data from LastPass to ONLY the specific folder on the LastPass side.
If you believe there may be duplicate records in your vault after import, you can use the
find-duplicatefeature in Commander to locate them.
If you wanted to locate duplicates based on title, login, password for example:
find-duplicate --title --login --password
From the output of this report, you can gather a list of record UIDs to delete with the "
By default, records are imported into Shared Folders with "Can View" permission. This means that the record is only editable by the owner of the record, and any share admins that have been added to the folder.
record-permission -a grant --can-edit --recursive <folder name or UID>