In brief
- Customer passwords cannot be migrated from WooCommerce to Shopify: WordPress stores only one-way hashes, and Shopify states that passwords cannot be imported with a customer CSV.23
- Shopify's current customer accounts are passwordless. A customer enters their email address, receives a one-time 6-digit code and is signed in, with sessions lasting up to 365 days, so a migrated customer needs no activation step.1
- The customer CSV carries names, email, phone, default address, tags, notes, tax exemption and email, SMS and WhatsApp marketing consent, in files up to 15 MB. It cannot carry orders or the Total Spent and Total Orders figures.2
- Order history is attached by importing orders after customers, matched by email, which is also what makes past orders appear in the customer's new account.5
- Shopify's legacy, password-based customer accounts are deprecated.4
Why passwords cannot move
WordPress does not store passwords. It stores a one-way hash of each password: historically phpass portable hashes, and bcrypt since WordPress 6.8, stored with a $wp$2y$ prefix and upgraded automatically the next time a user logs in.3 A hash can verify a password but cannot be turned back into one, and another platform's login system cannot verify it without implementing the same scheme. Shopify's help centre is direct about the result: customer passwords cannot be migrated from another store using a CSV.2
This is true of every platform migration, not a Shopify limitation. What differs between platforms is what the customer has to do next.
How sign-in works on Shopify
With Shopify's customer accounts, a customer enters their email address, receives a one-time 6-digit verification code and is signed in. No password is required.1 Other documented options are Shop sign-in, when Shop Pay is active, Google and Facebook sign-in, and an external identity provider on Shopify Plus. Sessions persist for up to 365 days.1
For a migration this removes the old problem entirely. There is no password to reset and no activation email to send. A customer who existed on WooCommerce types the same email address on the new store, enters the code, and sees their account with their order history.
Legacy accounts
Shopify's older, password-based accounts are deprecated.4 A store that still used them would have to send every migrated customer an account invite to set a new password. New migrations should go straight to the current customer accounts. One documented caveat: workflows and automations built on legacy accounts are not carried over to the new accounts.4
What moves, and what does not
| WooCommerce data | On Shopify | How |
|---|---|---|
| Name, email, phone | Moves | Customer CSV or API |
| Billing and shipping address | Moves | Default address in the CSV; additional addresses through the API |
| Password | Does not move | Not needed: sign-in by emailed code1 |
| Order history | Moves | Imported as orders after customers, linked by email5 |
| Total spent, order count | Recalculated | Read-only in the CSV; Shopify derives them from imported orders2 |
| Marketing opt-in | Moves | Accepts Email Marketing and Accepts SMS Marketing columns, yes or no2 |
| User role (wholesale, VIP) | As tags | Tags drive segments, discounts and B2B rules |
| Saved cards | Only for subscriptions | See the subscriptions guide |
| Store credit, points | Via app or store credit | Balances are re-issued, not imported as a field |
| Custom user meta (birthday, VAT number) | As metafields | Customer metafields through the API |
| Wishlists, saved carts | Does not move | Plugin data with no Shopify equivalent in core |
The customer CSV
Shopify's customer template contains First Name, Last Name, Email, Accepts Email Marketing, the default address fields (Company, Address1, Address2, City, Province Code, Country Code, Zip, Phone), Phone, Accepts SMS Marketing, Accepts WhatsApp Marketing, Note, Tax Exempt and Tags.2 The rules that matter in practice:
- 15 MB per file. Larger lists are split into several files.2
- Duplicates are skipped. Customers with a duplicate email address or phone number are skipped, unless you choose to overwrite existing customers, which replaces their data.2
- ISO codes. Province and country use ISO codes, not names; WooCommerce already stores country as a two-letter code, but states need checking.
- Tags are comma-separated and not case sensitive.2
- No orders in this file. Order information cannot be imported through the customer CSV.2
On the WooCommerce side, the REST endpoint /wp-json/wc/v3/customers returns each customer's email, names, billing and shipping blocks, creation date and meta data, which covers every column above.6
Marketing consent
The consent columns accept only yes or no.2 That makes the import a legal decision as well as a technical one: a customer marked yes will receive marketing email from Shopify and any connected email tool.
- WooCommerce core has no marketing opt-in field. Consent usually lives in the email plugin or service: Mailchimp for WooCommerce, Klaviyo, MailPoet or a checkout checkbox plugin.
- Export consent from the system that holds it, join it to customers by email, and set yes only where there is a recorded opt-in.
- Default everyone else to no. A smaller, clean list protects deliverability on the new sending domain setup.
- Keep the consent date and source in a customer note or metafield as evidence.
Guests, duplicates and roles
- Guest checkouts. WooCommerce guest orders have no user record, only a billing email on the order. Shopify creates a customer for every order email, so importing orders produces customers for past guests. With code-based sign-in those people can see their old orders without ever having registered.
- One person, several records. The same person may exist as a registered user and as a guest with a different email capitalisation. Normalise emails to lowercase before import, since Shopify treats a duplicate email as the same customer.2
- Non-customers. WordPress users include administrators, editors and shop managers. Export by the customer role, not the whole users table.
- Wholesale roles. Convert roles to tags first; decide afterwards whether they drive Shopify B2B company profiles, automatic discounts or customer segments.
Step by step
- Export customers by role through the REST API, with their meta data.6
- Clean: lowercase emails, merge duplicates, remove spam registrations with no orders, validate country and province codes.
- Join consent from the email tool and set the marketing columns.
- Import in Shopify's order: products, then customers, then historical orders, so orders link to both.5
- Use the current customer accounts, not legacy accounts, so nobody needs a password.14
- Test with a real account: sign in with an imported email, enter the code, confirm addresses and order history.
- Tell customers once. One line in the launch email is enough: sign in with your email, no password needed.
Customers, consent and order history move as one linked set.
- Customers exported by role, not the whole users table
- Duplicates merged before import
- Marketing consent carried only where it was given
- Order history linked to each customer
- Passwordless sign-in tested before launch
- Preview before you pay
Frequently asked questions
Can customer passwords be migrated from WooCommerce to Shopify?
No. WordPress stores one-way password hashes, and Shopify states that customer passwords cannot be migrated from another store. With Shopify's current customer accounts this does not matter, because customers sign in with a one-time code sent to their email address instead of a password.
Will my customers have to create a new account?
No. Their customer record is imported with their email address. On the new store they enter that email, receive a 6-digit code and are signed in to an account that already contains their details and order history.
Do I need to send account activation emails after migrating?
Only if the store uses Shopify's legacy password-based accounts, which are deprecated. With the current passwordless customer accounts there is nothing to activate.
Does order history move with the customer?
Yes, when historical orders are imported after customers. Shopify links each order to the customer with the same email address and recalculates total spent and order count from the imported orders.
What happens to customers who checked out as guests?
Shopify creates a customer record for every order email, so past guests become customers when their orders are imported. They can sign in with that email and a one-time code to see their orders.
Can I import everyone as subscribed to marketing?
Technically the column accepts yes for anyone, but you should set it only for people with a recorded opt-in. Consent is normally stored in the email tool rather than in WooCommerce, so it has to be exported from there and joined by email address.
Sources
- Shopify. Customer accounts, Shopify Help Center: one-time code sign-in, other sign-in options, 365-day sessions.
- Shopify. Importing and exporting customers, Shopify Help Center: template columns, 15 MB limit, duplicates, consent values, passwords.
- WordPress. WordPress 6.8 will use bcrypt for password hashing, Make WordPress Core.
- Shopify. Upgrading to customer accounts from legacy customer accounts, Shopify Help Center.
- Shopify. Migrating to Shopify: considerations: import products, then customers, then orders.
- WooCommerce. REST API reference: Customers.
Mufatech Studio migrates stores to Shopify. Figures are quoted from the linked documentation as of September 2026 and can change; check the source before acting on a limit or a price.