Guide: How to Create and Store a Backup of Your Bitwarden Vault

Maintaining a backup of your Bitwarden vault plays a critical role in ensuring the security of your secrets and passwords, but comes with the responsibility of managing a file full of very sensitive information. This guide breaks down the steps of one method for creating an encrypted backup of your vault on a USB thumb drive. A backup will prove invaluable if you find yourself unable to log into your Bitwarden account or in some other unforeseen circumstance. 

Bitwarden users can download their vaults for use as a backup as well as to import their passwords into another vault. This downloaded vault copy contains all the usernames, passwords, URIs and other details in a human-readable format. 

Once downloaded, the backup of the vault can be stored, moved, copied and deleted but remember - this file must be protected as it contains plain-text copies of all the usernames and passwords from the vault. This guide aims to provide a simple and effective way to safely manage this data so that it’s accessible in case of emergency, but remains secure in case it falls into the wrong hands.

What You’ll Need

Before getting started, here’s a list of what’s needed:

• Somewhere to store your backup! A USB thumb drive is perhaps the most convenient way to do this and what this guide covers, but any kind of storage media will work just as well

• A Bitwarden vault to be exported

• Somewhere to store your password

• An encryption & decryption tool

To begin  you will need to download your vault, which can be done using the guide here: Help: Export Your Data

Because this vault copy is intended for use as a backup to restore a Bitwarden vault in case of being locked out, it’s best to choose the .json export format. When importing a Bitwarden .json vault file, it will give you a vault  identical to the original vault at the time it was exported.

At the end of the export, a .json file will be downloaded to your computer. It’s very important not to forget about this file afterwards! Anybody with access to your computer would be able to open the file and read the entire vault contents, including all the credentials and secrets contained within. 

What about the .json (Encrypted) option?

The encrypted .json option is a great tool for creating backups! However the files are not human-readable and offer less flexibility (but more security) than exporting an unencrypted file and manipulating that.

The exported files from Encrypted Export can be imported into your specific Bitwarden account only (Account backup) or into any other Bitwarden account (Password protected). They cannot be used by third-party encryption tools, even if you provide them the correct password.

The safest way to store a backup is to have the sensitive file stored on some sort of encrypted media, such as a USB thumb drive.

You have two main options when preparing your media:

• Encrypt the entirety of the media:  nothing on the media will be visible without the correct credentials

• Encrypt only a portion of the media: the unencrypted portions of the media will be visible to those without the correct credentials, but the encrypted volume will be reserved for those with the password

For the purposes of storing your vault backup, a useful technique is to create an encrypted volume onto an unencrypted USB drive (instead of encrypting the whole drive). This ensures that the USB stick is detected normally by computers, and allows for storage of unencrypted files and folders alongside the encrypted files. 

The unencrypted space can then be used to store instructions such as where to find the decryption password, and copies of the decryption tools for macOS and Windows. The benefit is that a user plugging the drive into their machine five years in the future, long after they have forgotten the purpose of the backup, will immediately understand the contents and how to use them. An unauthorized user on the other hand will understand the contents, but will not be able to access them as they will lack the required credentials.

Most USB thumb drives come preformatted and ready for your computer to use. If it has not or you would like to change advanced file settings, the following section provides an explanation and instructions on how to do that.

All storage designed to be read by computers must use one of many file systems. Popular file systems include FAT, exFAT, APFS, ext4, and NTFS amongst others. The filesystem on a device gives instructions to the computer as to what, where, and how to access files that are contained on the device. Different operating systems prefer different file systems, e.g. a Windows PC probably uses NTFS, whereas an Apple device probably uses APFS. Different devices cannot always easily read file systems that they are not designed to use.

When preparing your USB drive, you will be asked to select a file system. For the reasons stated above, no matter whether you’re using macOS or Windows (or Linux), it’s probably best to format the USB stick using the exFAT file system and the GUID partition table. exFAT is a good balance between modern features and compatibility. These options will ensure that your USB drive will work on pretty much any machine that you plug it in to.

It is best practice to use a cleanly formatted USB drive. Guides for both macOS and Windows can be found easily online. 

Once we are in possession of our freshly formatted media, it’s time to use an encryption tool to either encrypt the entire USB drive, or to create an encrypted volume on the drive. 

Encryption tools are common in computing today, and serve many useful functions. The traffic that you send via the web is routinely encrypted to ensure that nobody gaining access can read it, and the entire hard drives of many entire computers and phones are encrypted so that the data will remain secure should the device be lost or stolen.

Bitwarden recommends using a tool that can encrypt and decrypt a small collection of files, as well as an entire device (USB drives, internal drives, etc). Once encrypted, this device will be used to store your Bitwarden vault export.

There are many encryption tools available on the internet. Popular options include VeraCrypt, PeaZip, and 7-Zip for file storage, though many more exist. This guide will detail how to use both VeraCrypt and PeaZip to backup your Bitwarden vault.