Import and Exporting Data

Commands for importing and exporting vault records, folders and teams permissions.


Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.
To get help on a particular command, run:
help <command>
Import and Export Commands
Import data from a local file or other password managers
Export vault records
Download shared folder memberships
Apply shared folder membership changes

import command

Command: import
Detail: Import data to Keeper from a local file or other password managers.
Path of file to import from.
*note: in file paths, backslash "\" needs to be escaped by using two in a row "\\"
--format <{json, csv, keepass, lastpass, myki, manageengine, 1password, bitwarden, thycotic}> file format (required)
--folder <FOLDER PATH OR UID> import into a specified folder
--filter-folder <FOLDER NAME> only import the specific folder from the source vault
-s, --shared import folders from file as shared folders
-p, --permissions <PERMISSIONS> default shared folder permissions if importing folders as shared
  • U - manage users permission granted
  • R - manage records permission granted
  • E - edit records permission granted
  • S - share permission granted
  • A - all permissions granted
  • N - no permissions granted
-dc, --display-csv show instructions for importing using the CSV format
-dj, --display-json show instruction for importing using JSON format
--record-type <RECORD TYPE NAME> import all records as the specified type
import C:\\records.csv --format csv
import C:\\records.csv --format csv --folder social
import C:\\shared-records.json --format json -s -p A
import C:\\lastpass\\passwords.csv --format lastpass
import --display-csv
import C:\\records.csv --format csv --record-type login
import --format=thycotic https://hostname/SecretServer
import --format=thycotic [email protected]
  1. 1.
    Import records from a "records" CSV file into the vault
  2. 2.
    Import records from a "records" CSV file into the "social" folder
  3. 3.
    Import records from a "shared-records" json file, importing and folders as shared folders with all permissions granted
  4. 4.
    Import passwords from a Lastpass export file
  5. 5.
    Show instructions and example for importing using CSV
  6. 6.
    Import records from a "records" CSV file as login type records
  7. 7.
    Import records from Thycotic/Delinea Secret Server using full URL
  8. 8.
    Import records from Thycotic/Delinea Secret Server using username/hostname syntax
Additional import instructions are documented below.
Ensure that you upgrade to the latest version of Commander to support all import methods.

export command

Command: export
Detail: Export vault data to a file or the console
File name to export to, or nothing to export to console stdout
--format <{json, csv, keepass}> file format (required)
  • note: keepass format cannot be exported to the console
--max-size <SIZE> maximum size of file attachment to export
  • format: number followed by "K","M","G" (Kilobyte, Megabyte, Gigabyte respectfully)
  • e.g. "100k" , "10M" , "2G"
-kp, --keepass-file-password <PASSWORD> if exporting in keepass format, set the file's password
--folder <FOLDER NAME OR UID> select a folder as the export source
export my-vault.csv --format csv
export --format json --max-size 10K
export keeper.kdbx --format keepass -kp 9EqfhCqbym-w
export socials.csv --format csv --folder "Socials"
  1. 1.
    Export the vault in CSV format to a file named "my-vault"
  2. 2.
    Export the vault in JSON format to the console, ignoring any file attachments over 10 KB
  3. 3.
    Export the vault in keepass format to a file named "keeper" and set the file's password
  4. 4.
    Export the records in the "Socials" folder

download-membership command

Command: download-membership
Detail: Download shared folder membership to a JSON file.
--source <{keeper, lastpass, thycotic}> (required)
This command will reach out to the source password vault (either Keeper, LastPass or Thycotic/Delinea Secret Server), retrieve Team and Shared Folder file structure, and then create a local JSON file containing this structure. The filename generated locally will be called shared_folder_membership.json.
This file can then be used for subsequently sharing folders with Keeper users and teams. The sharing operation is performed by executing the apply-membership command.
download-membership --source=lastpass
download-membership --source=thycotic
download-membership --source=keeper

apply-membership command

Command: apply-membership
Detail: Apply shared folder membership changes from a local JSON file. This command is used alongside the download-membership command.
The apply-membership command will look for a JSON file (defaults to shared_folder_membership.json) that contains sharing permissions.
The reason for separating the downloading and applying of membership, is so that you can apply the membership changes as new Keeper users or teams are onboarded. The apply-membership command can be run over and over, or whenever a new Keeper user account or team is created. Shared folder membership will be applied to any new corresponding user accounts and teams.
Folders can only be shared to users and teams that exist (because the public key must be used to encrypt the folder keys).
apply-membership my_permission_file.json

Detailed Import Instructions

Step by step instructions are documented for migrating data and importing into Keeper from the following sources:

Exporting Records from Keeper

To export records from your vault, use the export command. Supported export formats:
JSON export files contain records, folders, subfolders, shared folders, default folder permissions and user/team permissions. CSV import files contain records, folders, subfolders, shared folders and default shared folder permissions. Keepass files contain records, file attachments, folders and subfolders.

Keepass Export

$ keeper export --format=keepass test.kdbx
You can optionally provide the keepass encrypted file password through command line option --keepass-file-password
This flag will only apply when --format=keepass is set. The Master Password is required for Keepass export - if none provided you will be asked during export, and your input will be masked.
$ keeper export --format=keepass --keepass-file-password=file_password_here test.kdbx