Import passwords from lastpass to keepassx

Question

I was wondering how if there were any current ways to import lastpass passwords to keepass/keepassx? I found the lastpass2keepass.py program, but it doesn't seem to work anymore (lastpass updated their csv fields?).

Solution 1

Well, doesn't seem like there were any, so I hacked together a quick php script to do it.

If anyone else needs to do it. Run this script, paste the exported csv in the textarea, and input the outputted csv file to keepass.

<?php
if (isset($_POST["submit"]))
{
    //Loop through, build a multi array;
    $parsedCSV = array();
    //Columns (in order) to parse out.
    $ColumnAssociation = array("%%name%%","%%username%%","%%password%%","%%url%%","%%extra%%"); //The xml strings to use for output, replace %%COLUMNNAME%% with COLUMNVALUE

    $LastPassHeaders = array();

    $inQuotes = false;
    $quoteType = '';
    $curColumn = 0;

    //My epic parser, I know, deal with it (it wasn't meant to be modified)
    $first = true;
    $curLine = 0;
    foreach (explode("\n",$_POST["csvinput"]) as $line)
    {
        if (empty($line))  //I do this instead of searching for \r\n, because linux just uses \n (I think :/)
            continue;

        $letters = str_split($line);
        //print_r( $letters);
        for ($i = 0; $i < count($letters); $i++)
        {
            /*if ($first) //get lastpass's headers (they are the first row
            {

            }*/

            //Set inQuotes
            if (!$inQuotes && $letters[$i] == "'" && ($i - 1 < 0 || $letters[$i - 1] != '\\')) //Not Inquotes, matching singlequote, not prefixed with escape character
            {
                $inQuotes = true;
                $quoteType = "'";
                continue;
            }
            else if (!$inQuotes && $letters[$i] == '"' && ($i - 1 < 0 || $letters[$i - 1] != '\\')) //Not Inquotes, matching doublequote, not prefixed with escape character
            {
                $inQuotes = true;
                $quoteType = '"';
                continue;
            }
            else if ($inQuotes && $letters[$i] == $quoteType && ($i - 1 < 0 || $letters[$i - 1] != '\\')) //Inquotes, is the endquote, and isn't prefixed with an escape character
            {
                $inQuotes = false;
                $quoteType = '';
                continue;
            }
            //Finished with quotes

            if (!$inQuotes && $letters[$i] == ',' && ($i - 1 < 0 || $letters[$i - 1] != '\\'))
            {
                $curColumn++;
                continue;
                /*if ($curColumn > count($ColumnAssociation))
                    throw new Exception("TO MANY COLUMNS FTW");*/
            }

            //Well, because lastpass doesn't incapsulate their stuff, I guess I'll just wing it
            if (!$first) //If not headers, parse normally
            {
                if (!isset($parsedCSV[$curLine][$LastPassHeaders[$curColumn]]))
                    $parsedCSV[$curLine][$LastPassHeaders[$curColumn]] = "";
                $parsedCSV[$curLine][$LastPassHeaders[$curColumn]] .= $letters[$i];
            }
            else if ($first)
            {
                if (!isset($LastPassHeaders[$curColumn]))
                    $LastPassHeaders[$curColumn] = '';
                $LastPassHeaders[$curColumn] .= $letters[$i];
            }
        }
        if ($inQuotes)
            throw new Exception('Error, Unexpected end of line (Check quotes)');

        $curColumn = 0;
        if ($first)
            $first = false;
        else
            $curLine++; //Put this here so it only adds to the column number if the current row wasn't the first row (header)
    }
    //print_r($parsedCSV);
    //print_r($LastPassHeaders);

    $output = '"Account","Login Name","Password","Web Site","Comments"'."\r\n";
    //Alright, now reprint in xml format
    foreach ($parsedCSV as $row)
    {
        //print_r($row);
        //Don't output Generated passwords?
        if (isset($_POST["rgp"]) && $_POST["rgp"] && stristr($row['name'],'Generated Password for '))
            continue;

        //$output .= "<pwentry>\r\n";

        foreach ($ColumnAssociation as $xmlstring) //first loop through each xml string
        {
            $nxml = $xmlstring;
            foreach ($LastPassHeaders as $name) //then loop through each possible variable in the string
                if (isset($row[$name])) //because if a column is empty, it isn't even set in the array
                    $nxml = str_replace('%%'.$name.'%%',$row[$name],$nxml); //then replace found variables
                else
                    $nxml = str_replace('%%'.$name.'%%','',$nxml); //just because it isn't set, doesn't mean it isn't a real variable, hide it

            $output .= '"'.$nxml.'",';
        }
        $output = substr($output,0,-1); //remove end ,
        //$output .= "</pwentry>\r\n";
        $output .= "\r\n";
    }


    header("Content-type:application/csv");

    // It will be called lastpass-export.csv
    header("Content-Disposition:attachment;filename=lastpass-export.csv");
    echo $output;
}
else
{
?>
<html>
<body>
<form action="<?php echo $_SERVER["PHP_SELF"]; ?>" method="POST">
<textarea name="csvinput" cols="100" rows="20"></textarea><BR />

Remove Generated Passwords? <input type="checkbox" name="rgp"/ ><BR/>


<input type="submit" name="submit" value="Generate" />
</form>
Created By Mazzzzz
</body>
</html>
<?php
}
?>

Solution 2

As of 19/Dec/2012 the https://github.com/anirudhjoshi/lastpass2keepass script does indeed work.

Just export your LastPass data in CSV format then run it through the python script, then import it into KeePass (I used KeePassX)

Solution 3

Export your LastPass passwords to a CSV file. Click on LastPass browser icon, go to Tools > Export to > LastPass CSV file.

Next, in KeePass go to File > Import > Generic CSV file. This should import the passwords.

Comments

[Ben]

A good idea, but keepass doesn't like lastpass's export.

[rzlines]

hey you could also have a look at this keepassx.org/forum/viewtopic.php?f=5&t=2077

[moritzebeling]

@mazzzzz Hello, is your script safe and does not send sensitive data to you? Do you have updated version of this script?

[Ben]

I made sure to put up the source code so it could be peer reviewed (you're right, this isn't something you should trust to proprietary software). I've also got a good score here + stackoverflow.com; and nobody else has commented it to have a data leak; And of course if you don't feel safe using it you can look for another option ;).