A duplicate is the exact same login — same site, username, and password — saved more than once, with nothing to distinguish the copies (most often left over from importing a CSV export more than once). This is a narrower, stricter check than password reuse: two logins that merely share a password but differ in site or username are not duplicates, and are never touched by this.

Spotting one

Any entry that's part of an exact-duplicate group shows Duplicate in the Duplicated column.

Cleaning them up

Vault window → Manage → Remove duplicate logins… finds every duplicate group, shows you how many extra copies exist, and — after you confirm — keeps the oldest copy of each and removes the rest in one step. If the removed copies had their own notes, those notes are merged into the copy that's kept rather than lost.

Importing a CSV never creates duplicates in the first place: a row whose site and username already match a saved login is skipped automatically, regardless of whether the password also matches — see Importing and exporting passwords.