# 1Password Migration Guide

Move your 1Password vault into DVE using a **1PUX** export (recommended) or a **CSV** export.

## Prerequisites

- 1Password desktop app or 1Password.com access with permission to export
- DVE **IT Admin** or **Super Admin** role to run an import job
- Unlocked 1Password vault with recent sync completed
- Enough local disk space for the export file (1PUX files can be large)

## Step-by-step export from 1Password

### Option A — 1PUX export (recommended)

1. Open **1Password** and unlock your vault.
2. Select the vault or items you want to export.
3. Go to **File → Export**.
4. Choose **1Password Unencrypted Export (.1pux)**.
5. Confirm the security warning — the file will contain **plaintext secrets**.
6. Save the `.1pux` file to an encrypted folder on your machine.

1PUX preserves item structure, categories, and custom fields better than CSV.

### Option B — CSV export

1. Open **1Password** and unlock your vault.
2. Go to **Settings** (or **Preferences** on macOS).
3. Open **Export** (sometimes under **Account** or **Advanced** depending on version).
4. Choose **CSV** format.
5. Save the `.csv` file locally.

Use CSV only if 1PUX is unavailable in your 1Password plan or client version.

## Which format to choose

| Format | DVE import format | When to use |
|--------|-------------------|-------------|
| `.1pux` | `1password_1pux` | **Preferred** — best structure and field fidelity |
| `.csv` | `1password_csv` | Fallback when 1PUX export is not offered |

## DVE field mapping

| 1Password source | DVE field | Notes |
|------------------|-----------|-------|
| Item title | `name` | Required |
| Username field | `username` | From login items |
| Password field | `password` | From login items |
| Website / URL | `url` | Primary URL when present |
| Notes | `notes` | Item notes |
| Vault / tags | `folder`, `tags` | Vault name and tag metadata |
| Category (Login, Secure Note, Credit Card, Identity) | `credential_type` | Mapped automatically |
| One-time password / TOTP field | `totp_secret` | Validated during import |
| Custom fields | `custom_fields` | Non-standard fields preserved |

## Known limitations and quirks

- **Attachments are not exported** by 1Password — documents and files inside items must be re-uploaded manually in DVE.
- **Shared vault ACLs** are not included in export files — recreate access in DVE.
- **Archive/trash items** may or may not appear depending on export scope — export the active vault only.
- **1PUX is unencrypted** — delete the file immediately after a successful DVE import.

## Import into DVE

1. In the DVE admin console, open **Import** (or complete the onboarding import step).
2. Choose source format **1Password 1PUX** or **1Password CSV** to match your file.
3. Upload the export file and start the import job.
4. Wait for the job to reach **Complete** before closing the browser tab.

## Post-import verification checklist

- [ ] Import job status is **Complete** with expected record count.
- [ ] Spot-check banking, email, and admin credentials.
- [ ] Verify secure notes imported as `secure_note` type (not login).
- [ ] Confirm credit card items show custom fields where applicable.
- [ ] Review any TOTP warnings in the import summary.
- [ ] Delete the `.1pux` or `.csv` file and empty trash.
- [ ] Disable 1Password auto-fill on migrated machines.

## Known Limitations

1Password items that are **missing a unique ID** (UUID or equivalent id field) in
the export file are **silently excluded** from import. DVE cannot deduplicate or
track items without a stable identifier.

Before uploading, open your export and confirm the item count matches what you
expect in 1Password. If the imported count is lower than your vault size, re-export
with a format that includes item IDs (1PUX is preferred) or use the generic CSV
guide for manual reconciliation.

## Related guides

- [Migration Overview](overview.md)
- [KeePass Migration Guide](keepass.md)
- [Generic CSV Migration Guide](generic-csv.md)