Protools

Goodboy bridges your password managers — securely routing logins, OTPs, and passkeys across Chrome, Apple Passwords, KeePassXC, and more, with no manual exports.

01. The Matrix What Connects to What

Connector Transport Logins* OTP Passkeys Notes Folders Custom
iCloud / Apple
CXP handoff R/W R/W R/W — — —
KeePassXC
keepassxc-cli R/W R/W R/W R/W W —
Chrome + Chromium (read)
Local SQLite R/W — — — — —
1Password
Bitwarden
ProtonPass
Official CLIs R R — R — R
Bitwarden JSON
File export W W W W W —
R/W Read & Write
R Read only
W Write only
— Not supported
* Logins carry URL, username, and password.

The preflight computes this matrix for the exact flow you're about to run.

02. Chrome & Chromium No Export Required

Goodboy skips the CSV export entirely. It reads your local Chromium databases directly and securely — requesting macOS Safe Storage access, deriving the local browser key, and decrypting the database in memory. Your data never sits in an exposed intermediary file.

Sync-mode detection is fully automated. Whether Chrome stores your passwords in Login Data or Login Data For Account, Goodboy detects the active table across Chrome, Brave, Edge, Opera, Vivaldi, and Arc. Each discovered profile is treated as its own independent source.

Writing back is supported for Chrome. In the free tier, Chrome must be closed during the write; Pro adds a headless path that runs without interruption. Other Chromium browsers are read-only for now.

Direct, secure access to
your local browser vaults.

Direct SQLite read. No export file. No clipboard.

03. iCloud / Apple Passwords The CXP Bridge

Goodboy integrates with Apple's Credential Exchange on macOS 26 — Apple's implementation of the FIDO Alliance's Credential Exchange Format (CXF). The operating system mediates the handoff; credential data never touches the file system.

The two-step handoff

When you choose File → Export All Passwords in the Passwords app and select Goodboy, two Apple APIs do the work:

  1. OS hands off to the app. The system launches Goodboy with an NSUserActivity whose activityType is ASCredentialExchangeActivity, carrying a one-shot UUID token in userInfo.
  2. App redeems the token. Goodboy calls ASCredentialImportManager.importCredentials(token:) and the system returns a typed ASExportedCredentialData payload directly to memory — passwords, passkeys, OTP seeds, notes.

No CSV. No clipboard. No intermediate file. Writing back into the Apple ecosystem uses the paired ASCredentialExportManager, making Goodboy a true two-way bridge for your iCloud Keychain.

App MCP only

The iCloud protool is available through Goodboy's in-app MCP server only. The standalone goodboy-mcp binary is process-isolated from macOS's credential exchange surface — the OS will not hand a credential-exchange activity to a headless stdio process — so iCloud lives inside the app. Every other protool (Chrome, KeePassXC, Bitwarden, 1Password, ProtonPass, JSON Export) works in both transports.

Passkey routing for KeePassXC

Moving passkeys out of Apple Passwords is notoriously difficult due to export limitations. Goodboy acts as a native macOS bridge, routing passkeys straight from Apple directly into your .kdbx database.

No complex conversions, no intermediate files — a direct, secure handoff into your existing KeePassXC setup.

KeePassXC has an open issue for CXF/CXP import (#11363). Goodboy fills that gap from the outside.

04. KeePassXC The Open-Source Landing Zone

Goodboy uses the official keepassxc-cli to interact with your local .kdbx databases, with full support for passwords, OTP seeds, passkeys, and notes.

Setup is automatic: Goodboy detects your recently opened databases and surfaces them individually. Provide your master password (and key file, if applicable) on first use, and Goodboy handles the rest. It's the ideal landing zone for migrating data — especially passkeys — from proprietary ecosystems like Apple's into open-source local storage.

05. Commercial password managers 1Password, Bitwarden, ProtonPass

1Password

Goodboy uses the official op CLI. Authentication is brokered by the 1Password desktop app — Goodboy never sees the master password. For headless use, authenticate with a service account token.

Fields: passwords, OTP, notes, custom fields.

Bitwarden

Goodboy uses the official bw CLI against an authenticated session. Supports .com, .eu, and self-hosted vaults.

Fields: passwords, OTP, notes, custom fields.

ProtonPass

Goodboy uses the official pass-cli. Supports 2FA and older two-password (mailbox password) accounts.

Fields: passwords, OTP, notes, custom fields.

06. Bitwarden JSON The File Destination

For users who maintain their own backups, Bitwarden JSON is the widest-capture export Goodboy offers. Exporting captures the entire SecuredBox in one place: passwords, OTP seeds, passkeys, notes, and folders.

For your security, this is the only scenario where Goodboy will ever write credential data directly to your local disk — and it only happens when you explicitly choose it as your destination.