On this page
The short version
- Bubble stores passwords as salted hashes that are invisible even to the app’s developer, so no export, CSV or Data API call contains them.
- Every move away from Bubble therefore ends with users setting a password once — unless the new app checks their old password against Bubble on their first sign-in (“lazy migration”).
- With deBub your users can keep their passwords: while Bubble is still live, the new app checks each user’s first sign-in against one small workflow you add to Bubble, then stores the password in your Supabase project. Users it can’t check get a “set your password” link.
01Why passwords can’t be copied
Bubble’s User accounts article is explicit: passwords are “hashed and salted”, and the password field is “invisible, even to you as the app developer”. A hash can’t be turned back into the password, and Bubble doesn’t hand the hashes out either. That’s good security — and it means nothing you can download from Bubble includes a password.
Everything else about your users moves fine: email addresses, names, roles, the records they own and the files they uploaded can all be read through the Data API. Only the secret part stays behind.
02Your options
| Approach | What users do | Trade-off |
|---|---|---|
| “Set your password” email | Click a link once and choose a password | Simple and safe; some users ignore the email and need a reminder |
| Magic link or one-time code | Sign in with a link or code sent to their email | No password at all; changes the sign-in habit |
| Social sign-in (Google, Apple…) | Sign in with the same provider as before | Only for users who already used it; you set up the provider again |
| Lazy migration | Nothing — they sign in with their old password | Keeps Bubble running during the switch; more moving parts |
Most apps combine two of them: a reset-style invitation for everyone, plus magic links as a fallback for anyone who doesn’t finish it.
03How lazy migration works
In a lazy (or “just-in-time”) migration the new app doesn’t know the passwords up front. When a migrated user signs in for the first time, the new app asks the old system whether that email and password are correct. If they are, it saves the password in the new system — as a fresh hash — and the user never notices the move. After that, the new app no longer asks the old one.
With Bubble that means:
- keeping the Bubble app (and its plan) running until most active users have signed in once;
- a secure endpoint in the Bubble app that answers “is this login valid?”, protected against guessing and called only by your server;
- a sign-in route in the new app that tries its own database first and falls back to Bubble only for users who haven’t moved yet;
- a cut-off date after which everyone left gets a “set your password” email instead.
Done carefully it is the smoothest option for users. Done carelessly it sends passwords through more places than necessary — so it needs the same care as any login code.
04What deBub does
deBub’s data copy creates every Bubble user in your own Supabase project, with a confirmed email and without a password, and keeps the link to their records. When you go live, the launch steps send each migrated user a “set your password” link through your own email provider, in small batches, with a test mode that only emails you first. Users who already signed in are skipped, so nobody gets the email twice.
05A checklist for the switch
- Set up your own email sending (a verified domain) before inviting users — the default Supabase sender is only meant for testing.
- Write the invitation in your app’s voice: why the change happened, and that it takes one click.
- Send a test batch to yourself, then invite everyone.
- Consider offering magic-link sign-in (Supabase Auth supports it) for anyone who misses the email.
- Delete the Bubble Data API token once the copy is done and you’re live.
Questions
- Can I export user passwords from Bubble?
- No. Bubble stores passwords as salted hashes that are invisible even to the app developer, and no export, CSV download or Data API response contains them.
- Will my users have to create a new password?
- Not with deBub’s password migration switched on: while your Bubble app is still live, their first sign-in is checked against Bubble once and the password is kept. Without it — or for users who only sign in after the cut-off date — each user gets a one-time “set your password” link. Supabase Auth also supports magic-link sign-in.
- Do my users’ accounts and data move?
- Yes. Emails, profile fields, the records each user owns and their uploaded files are copied into your own Supabase project; only the password has to be set again.
- Is lazy migration safe?
- It can be, if the check runs only between your server and your Bubble app over HTTPS, is protected against password guessing, and is switched off after a cut-off date. It does keep Bubble running during the transition.
Sources
- Bubble support: User accounts — checked October 16, 2026
- Supabase docs: Migrate from Auth0 (importing password hashes) — checked October 16, 2026
- Bubble support: Can I export my data from the Bubble platform? — checked October 15, 2026