Bitwarden Encrypted Backup Formats
By Mihaly Kertesz · Updated
Bitwarden’s account-restricted and password-protected encrypted exports have different recovery dependencies. An encrypted JSON file is not necessarily portable to a new account. The export type determines which credentials and restore destination remain necessary.
Bitwarden encrypted backups and readable exports
Plain JSON and CSV can serve documented migration paths, but remain readable collections of secrets. Encryption of the normal vault does not extend to an unencrypted export. Format, export type and restore destination describe different parts of a backup record.
| Format | Useful for | Question to verify |
|---|---|---|
| Plain CSV / JSON | A compatible destination import | How will the temporary readable file be protected? |
| Account-restricted encrypted JSON | Restore into its originating account | Will that same account and key still be available? |
| Password-protected encrypted JSON | Restore using a separately chosen export password | Where is that password kept independently? |
| Attachment-bearing export | Recovering files as well as records | Which account scope and attachment format are included? |
Account-restricted Bitwarden encrypted backups
Bitwarden documents that account-restricted exports belong to the originating account and can become unusable after account-key rotation. Recreating an email address in another account does not recreate its cryptographic keys. A new-account recovery scenario therefore has different requirements.
Password-protected Bitwarden encrypted backups
The export password becomes part of the recovery set. A sole copy inside the unavailable original vault creates a circular dependency.
A unique generated export password and a separate protected record provide a different arrangement. Date, scope, file location and intended restore procedure can describe the backup without duplicating readable account secrets.
Random-word passphrase generator · Independent recovery materials
Bitwarden encrypted backup item coverage
Login records do not establish export of attachments, organization-owned entries, deleted items or other product data. Current account options and format documentation define that scope. A ZIP container is not automatically encrypted.
Personal recovery and organizational backup have different ownership requirements. Work-owned records remain subject to the authorized organizational process.
Restoring Bitwarden encrypted backups
A disposable vault with invented entries and an attachment can demonstrate the chosen recovery scenario. The compatible destination and its required account credentials or export password are part of that test.
- Recorded client version and export type
- Fictional source records and intended attachment
- Documented compatible restore destination
- Required account credentials or export password
- Observed restored fields and missing material
- Recovery limits recorded for the selected format
Bitwarden encrypted backup maintenance
Major imports, recovery changes and key rotation can affect backup validity or scope. Dated generations preserve a fallback after accidental deletion; useful frequency depends on how often the vault changes.
Encryption protects the stored export within its design. It does not prevent a compromised device from observing secrets during use.