Chapter 7 · 7.1
Making a backup or export of your vault
With Bitwarden, your vault is stored on their servers and on your devices. With KeePassXC, it is a single file. Either way, you want your own backup in case you lose your account, your server breaks down or you want to switch. For more about backups in general, see the lesson The 3-2-1 rule and what you should back up in the Staying safe online course.
Bitwarden: which export should you choose?
| Format | Encrypted? | When to use it |
|---|---|---|
| .json | No | Only to import straight into another program. Delete it immediately afterwards. |
| .csv | No | Same as above. Excludes passkeys and is less complete than JSON. |
| .json (encrypted), Account restricted | Yes | Can only be restored to the same account. Stops working if your account is gone or if you rotate your account's encryption key. |
| .json (encrypted), Password protected | Yes | The best choice for a backup. Can be restored to any Bitwarden or Vaultwarden account, using the password you choose. |
| .zip with attachments | Read the message shown when you export | If your vault contains attachments. Only for your own vault. Other formats do not include attachments. |
- Log in to your vault's website and choose Tools, then Export. In the browser extension, you will find it under Settings, in the vault settings.
- Under Export from, choose your own vault.
- Choose the encrypted JSON format and then Password protected. Pick a strong, new password for the file and write it down with your master password.
- Confirm with your master password and save the file.
Not included in the export: items in your trash and your Sends. Organisation items are not included in the export of your own vault. The organisation's administrator exports those separately.
KeePassXC: copies of your file
- Your
.kdbxfile is your backup: it is always encrypted. Copy it regularly to a second location, such as a USB stick you keep at home. - Turn on Backup database file before saving (see Installing KeePassXC and creating your first database). With Database, Save Database Backup you can make a copy at any time.
- If your database is stored in Nextcloud, Nextcloud keeps older versions (see Backups at WebOké: what we keep and what you can do yourself).
- Do you use a key file? Keep a copy of that too, in a different place from your database.
A paper backup
KeePassXC can export your database as an HTML file for printing. This is intended as an emergency paper copy. Print it, store the paper somewhere safe and delete the file straight away. Keep in mind: anyone who finds the paper has all your passwords. For most people, a sheet with just the master password and the recovery code is enough.
Where should you keep a backup?
- In at least one place that is not your everyday computer.
- An encrypted export or a
.kdbxfile can safely go in your Nextcloud or on a USB stick. - Never keep an unencrypted export (CSV, JSON, HTML). Delete it immediately after use, including from the trash.
Tip: Test once whether your backup works. With Bitwarden: import it into a second, empty test account. With KeePassXC: open the copy on another computer. A backup you have never tested is a gamble.