Migrate to Kinde from Firebase Authentication

Migrate your users from Firebase Authentication to Kinde. The process involves exporting user data from Firebase, converting it to NDJSON, and importing into Kinde. Kinde supports Firebase’s modified scrypt password hashes, so migrated users can sign in with their existing password.

What you need

Link to this section

• A Kinde account with Admin access
• A Kinde account configured to match your current auth provider - see before you migrate
• Firebase account with user export permissions

Key considerations

Link to this section

• Hash parameters are required for password migration — if your export includes passwordHash and salt, you must enter your Firebase project’s hash parameters when you confirm the import in Kinde. You will find the instructions in this guide.
• Drip-feed is not applicable — Firebase scrypt verification is handled during sign-in migration, not via a drip-feed API workflow.
• Organizations must exist in Kinde first — assign users to organizations by including an organizations array on each user object. Each organization must already exist in Kinde with a matching external_id (provided ID).

Migration guide

Link to this section

1. Export users from Firebase

Link to this section

Make sure you have the Firebase CLI installed, then run:

firebase auth:export users.json --format=json

This exports user records including email addresses, display names, UIDs, hashed passwords, and salts. For full details, see the Firebase Auth CLI documentation.

Firebase typically writes a JSON array of user objects (or an object with a users array). Kinde cannot import that file as-is — convert it to NDJSON in the next step.

2. Convert the export to NDJSON

Link to this section

Kinde accepts a .ndjson file with one user object per line.

Use the jq command-line JSON processor tool to convert the export to NDJSON.

If your export is a JSON array:

jq -c '.[]' users.json > users.ndjson

If your export is an object with a users array:

jq -c '.users[]' users.json > users.ndjson

Your file should look like this (each user on its own line):

users.ndjson

{"email":"user@example.com","localId":"firebase-uid-abc123","emailVerified":true,"displayName":"Alex Smith","passwordHash":"...","salt":"..."}
{"email":"other@example.com","localId":"firebase-uid-def456","emailVerified":true,"passwordHash":"...","salt":"..."}

The file extension must be .ndjson. Rename the file if needed before uploading.

3. (Optional) Enrich the NDJSON for organizations and status

Link to this section

Firebase does not export organization membership. If you use Kinde organizations, add an organizations array to each user object before import. Organizations must already exist in Kinde with a matching external ID.

• disabled (Firebase’s usual field) or userDisabled — when true, the user is imported as suspended in Kinde. If neither field is present, the user is active.

Example of one line (pretty-printed here for readability — keep it as a single line in the .ndjson file):

{
  "email": "user@example.com",
  "localId": "firebase-uid-abc123",
  "emailVerified": true,
  "displayName": "Alex Smith",
  "passwordHash": "...",
  "salt": "...",
  "disabled": false,
  "organizations": [
    { "external_id": "org_abc001" }
  ]
}

You can also include roles and permissions arrays on each organization object, using the same role and permission keys configured in Kinde.

4. Get the hash parameters from Firebase (for password migration)

Link to this section

Hash parameters are only required when your export includes password hashes. Users without passwordHash can still be imported without password migration.

1. Sign in to your Firebase console

2. In your project dashboard, go to Product categories > Security > Authentication > Users.

   

3. Select the three dots menu next to the user table, then select Password hash parameters. A dialog appears.

   

4. Copy the parameters and save them securely. You need them to import into Kinde.

5. Import into Kinde

Link to this section

1. In Kinde, go to Users, then select Import users. A dialog appears.

2. Select Firebase.

   

3. Upload your .ndjson file (49MB or less).

4. On the confirmation screen, enter the Firebase password hash parameters you copied in the previous step.

   • Signer key (base64) (base64_signer_key)
   • Salt separator (base64) (base64_salt_separator)
   • Rounds (rounds)
   • Memory cost (mem_cost)

   

5. Select Import and wait for the import to complete.

6. Review any errors reported after import. Fix the NDJSON file and re-import to resolve them.

6. Test the migration

Link to this section

1. Sign in to your application with a migrated user’s email and existing password.
2. Verify the user can access your application.
3. Confirm organization membership and profile details where applicable.

Supported Firebase fields

Link to this section

Kinde maps the following fields from each NDJSON user object:

Firebase field	Imported as	Notes
localId	User id (provided ID)	Used to match records on re-import
email	Email identity	Required for email/password users
emailVerified	Email verified status	true / false
displayName	first_name / last_name	Split on the first space
phoneNumber	Phone identity	Imported if present
passwordHash	Migrated password hash	Requires hash parameters at confirm
salt	Per-user salt	Required with passwordHash
disabled / userDisabled	Suspended status	true → suspended in Kinde
organizations	Organization membership	Optional — see step 3 above

Unsupported fields

Link to this section

The following Firebase fields are not imported automatically:

• providerUserInfo (social / federated identities)
• customAttributes / custom claims
• photoUrl, createdAt, lastSignedInAt

If you need social identities or custom claims, configure the relevant connections in Kinde and use the API or a follow-up process after import.

For the full list of supported fields and hashing methods, see the bulk import guide.

Get support

Link to this section

If you need help with your migration, contact Kinde support.