How to Export and Backup Your Bitwarden Vault Securely

In this article

1. The Danger of Unencrypted CSV Backups
2. Understanding the Bitwarden Encrypted JSON Format
3. Step-by-Step: How to Generate an Encrypted JSON Export
4. How to Store and Encrypt Your Backup Securely
5. Local Storage and Media
6. Cloud Storage Considerations
7. Verifying Your Backup Before You Need It
8. Frequently Asked Questions
9. Can I open a Bitwarden encrypted JSON file in a text editor?
10. What is the difference between a normal JSON export and an encrypted JSON export?
11. How often should I update my password manager offline backup?

Relying exclusively on a cloud-based password manager without a local contingency plan introduces a single point of failure. While services like Bitwarden maintain robust infrastructure, account lockouts, API outages, or unexpected synchronization errors can leave you temporarily or permanently separated from your digital identity. Maintaining a local, offline copy of your credentials is a fundamental tenet of robust personal security.

However, the backup method you choose matters immensely. Many users default to unencrypted CSV exports for simplicity, inadvertently exposing their entire digital footprint in plaintext. To truly protect your secrets, a Bitwarden encrypted JSON export is the gold standard. This guide details how to safely generate, store, and verify an encrypted backup of your vault.

The Danger of Unencrypted CSV Backups

When exporting a password manager vault, users are typically presented with multiple format options, primarily CSV and JSON. Standard CSV exports are entirely unencrypted. If you open a CSV file in a spreadsheet application, every username, password, secure note, and TOTP seed phrase appears in plain text.

Storing an unencrypted CSV file on a local hard drive, a USB flash drive, or a cloud storage provider is a significant security risk. If your machine is compromised by infostealer malware, or if your local drive is unencrypted and falls into the wrong hands, your entire digital life is instantly exposed. Even deleting the file through standard operating system commands leaves recoverable fragments on the disk until overwritten.

By contrast, an encrypted JSON export protects your data at rest. The file is scrambled using a cryptographic password or a specific user-defined encryption key. Even if the file is leaked publicly, it remains computationally unreadable without the decryption key.

Understanding the Bitwarden Encrypted JSON Format

The Bitwarden encrypted JSON export creates a structured text file containing your vault items—logins, cards, identities, and notes—along with metadata. Crucially, the sensitive fields within this file are encrypted client-side before they are written to your disk.

Bitwarden offers two distinct encryption types for JSON backups:

• Password-Protected: You supply a custom password during the export process. Bitwarden uses this password to derive a key via a key derivation function (such as PBKDF2 or Argon2, depending on your account settings) to encrypt the payload.
• Account-Key-Protected: The export is encrypted using your account’s cryptographic master key or a specific key associated with your membership. This requires your current account state to decrypt.

For a true offline backup, the password-protected JSON export is often preferred because it is self-contained. It does not rely on your active Bitwarden account session to be restored, making it a reliable cold-storage archive.

Step-by-Step: How to Generate an Encrypted JSON Export

To ensure your master password or sensitive account details are not intercepted during the process, perform this action from a trusted, fully updated desktop environment.

1. Log in to your Bitwarden vault using either the Web Vault or the Bitwarden Desktop App. Note that browser extensions and mobile apps sometimes restrict advanced export formats or omit the password-protection prompt.
2. Navigate to Settings in the left-hand sidebar.
3. Select My Vault, and then click on Export Vault.
4. Under the format dropdown menu, select Encrypted JSON. Do not choose CSV or unencrypted JSON.
5. Choose your encryption method. Opt for Password-Protected and enter a strong, unique passphrase. Ensure this passphrase is distinct from your master password and store it in a separate, secure location or commit it to memory.
6. Click Export Vault and save the resulting .json file to a temporary working directory on your local machine.

How to Store and Encrypt Your Backup Securely

Once you have generated your encrypted export file, you must treat it with care. While the file is encrypted, adding secondary layers of security aligns with defense-in-depth principles.

Local Storage and Media

Move the exported JSON file away from your primary desktop operating system partition. Copy the file to a reliable physical medium, such as an encrypted USB flash drive formatted with LUKS, VeraCrypt, or macOS FileVault. If you store the file on a Network Attached Storage device or a local backup drive, ensure the share or partition is fully encrypted.

Cloud Storage Considerations

If you choose to store your backup in a cloud provider (such as OneDrive, Dropbox, or Google Drive) for redundancy, rely on client-side encryption tools like Cryptomator before uploading. Never place an unencrypted or password-protected JSON file directly into standard cloud storage without an additional container layer.

Verifying Your Backup Before You Need It

An untested backup is merely a wish. Before archiving your backup vault, verify that the file is not corrupted and that you can successfully restore it.

To test your export:

• Create a temporary, secondary Bitwarden account or use a clean test environment.
• Navigate to the import section of the test vault.
• Select Bitwarden (JSON) as the import source.
• Upload your encrypted backup file and enter the custom password you specified during export.
• Confirm that your folders, login items, and secure notes populate correctly in the test vault. Once verified, delete the test account.

Frequently Asked Questions

Can I open a Bitwarden encrypted JSON file in a text editor?

Yes, you can open the file in any text editor like Notepad or VS Code, but you will only see structural metadata and heavily scrambled ciphertext. The actual credential data remains completely unreadable without the decryption key.

What is the difference between a normal JSON export and an encrypted JSON export?

A standard JSON export contains all your vault data in plain text, making it as dangerous as a CSV file if mishandled. An encrypted JSON export cryptographically scrambles the sensitive payloads, protecting your credentials even if the file is stolen.

How often should I update my password manager offline backup?

You should generate a new backup whenever you make significant changes to your vault—such as adding critical new accounts, updating financial logins, or changing your master password. Setting a calendar reminder to export your vault quarterly is a solid maintenance habit.