Bitwarden vaults and the items stored within them are always securely saved to the cloud or a self-hosted instance. Because of that, each Bitwarden vault is always up to date and in sync across desktop, mobile, and web. Even with vaults safely stored, keeping an up-to-date, encrypted local copy on hand is still a good idea. This guide to backing up your Bitwarden vault covers choosing an export format, running the export, and keeping the file secure afterward.
Bitwarden vaults can be exported as CSV or JSON files, with the option to export an encrypted version in JSON format. Creating an encrypted copy of a vault ensures sensitive data remains secure and accessible for restoration or offline use.
What does that mean? Simple:
CSV or standard JSON exports remain unencrypted, meaning anyone with access to the file could read it. Storing an unencrypted file on a USB drive or other removable device kept in a secure location, like a physical safe, is safer than saving it to a shared computer. A CSV file is often more human readable, so your intended use case for the file should also be considered.
Encrypted JSON exports encrypt all password entries, so anyone accessing the file sees only encryption strings instead of readable data. This format is recommended whenever a physical safe isn't available for storage.
An alternative encryption method for CSV exports appears below.
Individual vaults can be exported from any Bitwarden client by users with appropriate permissions. Organization vaults can only be exported from the web app. This walkthrough uses the Bitwarden desktop app as an example. A safe location to store the backup file is the only other requirement. That's all it takes!
1. Sync the vault. Open the Bitwarden app, select File, then Sync vault. This will ensure all the latest entries are saved to the account.
2. Export the vault. Select File, then Export vault. In the resulting popup, choose a file format from the File format dropdown, like the recommended encrypted JSON.
3. Choose an encryption option. The encrypted JSON export format offers two choices. Account restricted uses the encryption key tied to the Bitwarden account, so the file can only be re-imported into that same account. Password protected offers more flexibility instead.
4. Enter a password and export. Account restricted requires entering the master password, while Password protected requires entering and confirming a password for the file. After choosing your preferred type of encryption, select Export vault in the bottom left corner. If saving to a USB drive, select the drive from the file manager, then select Save.
5. Store the file securely. Once the file downloads, remove the USB drive and store it somewhere secure, like a locked drawer or safe. If saving to a computer instead, store the file in a hidden or less obvious folder for extra security.
This creates a viable, importable backup of the Bitwarden vault, ready for whenever it's needed. Any new or edited vault items after this point require a fresh export to keep the backup current.
For anyone who exported the vault as a CSV file instead, the file can still be encrypted manually using tools built into each operating system.
Note: A GPG key must already be available for this method to work. One can be generated with:
gpg --expert --full-gen-key
Encrypt the file using GPG with the following command: gpg -c export.csv
This creates a new file with the .gpg extension; in this case, the file name becomes export.csv.gpg.
To decrypt the file, use the command: gpg export.csv.gpg
This prompts for the password created during encryption. The original exported file should be deleted afterward, since it remains unencrypted.
Create a new folder.
Move the exported file into the new folder.
Use Disk Utility to create a new image from the new folder.
Delete the original export file.
Create a new folder.
Move the unencrypted file into the folder.
Right-click the new folder.
Select "Show more options."
Select Properties.
Go to General > Advanced.
Check the box next to "Encrypt content to secure data."
Click OK.
When prompted, type and verify a password.
That covers the full export process. The vault backup is now ready to store securely.
Beyond the initial export, whether generated through the desktop app or the bw export command, a few ongoing habits help keep backups reliable long after they're created. Store the backup file in multiple locations, such as an external hard drive, USB drive, or cloud storage service, to ensure availability if one copy is lost or damaged. An encrypted volume or encrypted USB partition adds an extra layer of protection against unauthorized access. You can also automate the process with a backup script to keep files current without manual intervention. Logging each backup's location, date, and time in a text file or spreadsheet makes it easy to track and verify your backups when needed.
If an issue arises with a local drive or Bitwarden instance, restoring data from a backup file is straightforward. When using the Bitwarden CLI, the bw import command restores vault items, including passwords and notes, using the encrypted JSON file as input. The desktop app offers an alternative: connect the USB drive, or restore the local .\bitwarden-appdata folder, then unlock the portable app to regain full vault access.
With a secure backup in place, vault data stays protected and accessible at all times. Start a 14-day free trial of a Bitwarden Enterprise plan to keep teams and colleagues safe online, or get started with a free individual Bitwarden account today.