What does a CSV import need to contain?
Migration · Help center · Current as of 2026-10-10
Short answer
A header row and a column called secret. Everything else is optional: issuer, account, type, algorithm, digits, period, counter and tags are read when they are there and filled with the standard defaults when they are not. Column names are matched case-insensitively and a few common aliases are accepted, so an export from another tool often works untouched.
The columns that are understood
| Column | Also accepted as | If missing |
|---|---|---|
secret | — | Required. Without it the file is rejected. |
issuer | service, name | Left blank. |
account | username, email | Left blank. |
type | — | Treated as TOTP. |
algorithm | — | SHA-1. |
digits | — | 6. Must be 6 to 8. |
period | — | 30 seconds. Must be 1 to 300. |
counter | — | 0, for HOTP entries. |
tags | — | No tags. Separate several with ; or |. |
Two things that trip people up
- Commas inside a field. Fields are split on commas with no quoting, so a value containing a comma — several tags, or a service name with one in it — will land in the wrong column. Use semicolons for tags and remove stray commas from names.
- A secret that is not base32. A cell holding an
otpauth://URI, a hex string or a padded secret with spaces removed by hand is reported as invalid rather than imported wrong. Paste URIs in directly instead; they are read as links.
Nothing is written before you look
Parsing happens on your device, and the preview shows every row with its status and the destination space and group you have chosen. Rows that could not be read are listed with the reason. Why some rows get rejected explains each of those statuses.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms