cxporter

cxporter

Convert credentials from legacy password managers to the FIDO Alliance CXP protocol (CXF format).

🚧 DISCLAIMER: This project is still under development and not ready for production use, furthermore both specs are still in draft stage. Use at your own risk. 🚧

Overview

cxporter is a command-line tool that converts credentials from legacy password manager formats (KeePass, Chrome, Firefox, Bitwarden) and local credential stores (SSH keys) into the FIDO Alliance's Credential Exchange Format (CXF). It enables secure, encrypted credential migration to any CXP-compliant password manager.

Features

• Multi-source support: Import from KeePass (.kdbx), Chrome CSV, Firefox CSV, Bitwarden JSON, and SSH keys
• CXF output: Export to the standardized FIDO Alliance CXF format
• HPKE encryption: Optional encryption for secure credential transfers
• Metadata preservation: Maintains timestamps, folders, tags, and custom fields

Installation

From Source

go install github.com/nvinuesa/cxporter/cmd/cxporter@latest

Build from Source

git clone https://github.com/nvinuesa/cxporter.git
cd cxporter
make build

Usage

Convert SSH Key

cxporter convert -s ssh -i ~/.ssh/id_ed25519 -o ssh-key.cxf

Convert KeePass to CXF

cxporter convert -s keepass -i vault.kdbx -o vault.cxf

Convert Chrome Passwords

cxporter convert -s chrome -i passwords.csv -o chrome.cxf

Encrypted Export

To enable HPKE encryption, provide an X25519 public key via --encrypt-key:

# With base64-encoded key
cxporter convert -s keepass vault.kdbx -o vault.cxp --encrypt-key <base64-pubkey>

# With key file
cxporter convert -s keepass vault.kdbx -o vault.cxp --encrypt-key @pubkey.key

Supported Sources

Requirements

• Go 1.26rc1 or later (for building from source)

License

AGPL-3.0 - See LICENSE for details.

Related Projects

• go-cxf - Go implementation of CXF types
• go-cxp - Go implementation of CXP protocol

References

• CXP Specification
• CXF Specification