I'm curious what is best practice. I'm migrating a large export of an existing password manager data like lastpass, 1password, or dashlane into another password manager. Some of these services marked some of the passwords as compromised. It's hundreds and would take many hours to change passwords to these non-vital sites. Should I just delete these sites vs changing them as they are comprised anyway and some of these sites don't even exist anymore?

I just want to be able to migrate to a new password manager.

  • I think this is something that only you can decide. "Best Practice", of course, is to change compromised passwords. But you appear to be favoring convenience over the protection of these accounts, so that's a risk call only you can make.
    – schroeder
    Nov 20 at 22:40

1 Answer 1


How you should address services flagged as compromised is independent of migration. Although it might feel like the right time to tidy things up, I would recommend separating the tasks. Migration tools don’t handle everything perfectly, so you will have some cleanup to do post-migration.

But once that it settled, the question is what to do about a large number of services you have passwords for that are listed as compromised since you created the password. It is an overwhelming task if you look at it as an all or nothing thing.

So I recommend spending no more than 10 minutes a day on it. Maybe if you get into a rhythm you can do more, but don’t “do it until you hate it” because then you won’t do it at all in coming days. Remember that each one you deal with improves your security to some degree. I do recommend some priorities.

  1. Reused passwords. If a password that you have for a compromised service is something that you have used for other services, you need to change to unique passwords for each of those services. You’ve been using a password manager, which is great, if you haven’t always used it to create unique passwords, then start with that. A password compromised from site X will be tried on site Y.
  2. Importance. Financial and email accounts are going to be the most important. Retail shopping will be next. Deal with those before dealing with others.
  3. Don’t worry about services that don’t exist any more. You only need to pay attention to them if you reused a password from such a service on something that does matter. So delete them after you’ve checked for reused passwords.
  • makes sense. go with the important ones first. reason is there are many old sites that don't even exist anymore or they are ultra low priority sites like evite or sweepstakes type sites. Nov 21 at 20:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .