Dear PopleysYsb ,
You can use GMU to migrate, with migrateOut --all option.
Or, if your policy depends on(using) a stored password, when you migrateOut that policy, the stored password will be migrateOut as well.
For example, you can publish a temp web api, and add route via http assertion to access the stored password as below,
(you can use any other assertion that can input a stored password)
Add as many assertions as you need to access all the stored password, and then you can migrate this service to migrate all the stored password.
Of cause, you can also use the restman, but the above should be easier.
Regards,
Mark