Is exporting my Bitwarden vault safe?

The encrypted-JSON export is safe so long as the file password is strong and you store the file responsibly. Plain JSON and CSV exports are plaintext credential dumps — handle them like you would handle a written-down password list, which is to say carefully and briefly.

How often should I back up my vault?

Monthly for personal vaults; weekly if your vault changes a lot (new accounts, business use). Anything less frequent than monthly means a single device loss or account lockout sets you back too far.

Can I export from the mobile app?

iOS and Android apps include a vault export function as of 2026 — same format choices as desktop. Settings → Vault → Export. Useful for travel-only setups but desktop or web is more practical for routine backups.

What's the difference between "Account-restricted" and "Password-protected" encrypted exports?

Account-restricted ties the export to your specific Bitwarden account — only your same account on the same server can re-import it. Password-protected uses a stand-alone password — any Bitwarden account on any server (cloud or self-hosted) can import it with the password. Account-restricted is more secure, password-protected is more portable. Pick password-protected unless you have a strong reason otherwise.

How do I back up Bitwarden attachments?

Attachments require explicit download — the vault export only references them. The simplest path is the CLI: bw list items | jq -r '.[] | select(.attachments != null) | .id' gives you item IDs with attachments; bw get attachment downloads each. Our CLI scripts post includes a complete attachment-backup script.

Can I export and re-import without losing folders or organisations?

Folders persist across export/import in JSON formats. Organisations export and import as separate units — re-importing a personal vault export into an account that has organisations does not change the organisation membership.

Will Bitwarden export TOTP codes?

Yes — Premium users' TOTP secrets are exported as part of the item data, in the login.totp field. Plain JSON shows them as otpauth:// URIs; encrypted JSON contains them encrypted. CSV exports also include them as a column. Treat any export with TOTP secrets as exceptionally sensitive — they're the second factor for those accounts.

Can I export only a single folder or collection?

The web vault and desktop app export the entire vault — partial export isn't supported in the UI. The CLI lets you filter: bw list items --folderid <ID> outputs items within a folder, which you can pipe to jq or save selectively.

Does Bitwarden notify me when an export happens?

Yes — exports are logged. Premium and Family users see them in the account event log; the web vault sends an email notification on every export to alert you if someone gained vault access without your knowledge.

What if I lose the file password to my encrypted export?

The export becomes irrecoverable. The encryption is the same AES-256 used for the live vault — there is no backdoor. Always write the file password somewhere offline before you save the file, and test re-import within a few minutes of creation.

Tutorial · 5-minute read

How to export your Bitwarden vault — CSV, JSON, and encrypted backup

Stack of cardboard moving boxes — exporting your Bitwarden vault as a portable backup file

You should be able to take your data and leave. That's the property a good password manager has and the reason locking your data into a closed format is the single largest red flag for any vault product. Bitwarden gets this right — three export formats, no friction beyond a master-password reconfirm, no premium-tier paywall, no hidden truncation. This page walks through exactly how to do it, in every Bitwarden client, and what the export does and doesn't include.

TL;DR

Use password-protected JSON for backups — it's encrypted, safe to leave on disk, and re-imports cleanly. Use CSV only if you're moving to a competitor that doesn't accept Bitwarden JSON. Plain JSON is plaintext — never leave it sitting in your Downloads folder.

Why export at all

Three legitimate reasons:

Backup against catastrophe. Bitwarden has not had a public breach, but no service is breach-immune over a long enough horizon. A monthly encrypted export tucked into a separate cloud account is cheap insurance.
Migration. Moving from Bitwarden cloud to self-hosted Vaultwarden. Or away from Bitwarden entirely if you decide a different product fits better. Either direction starts with an export.
Inheritance / emergency planning. A printed and sealed copy of your vault, stored in a fireproof safe, is the lowest-tech version of Emergency Access. It survives Bitwarden going down, your account being compromised, or you being unable to log in.

What you should not do: export to plain JSON or CSV "just in case" and leave the file in Downloads. That file is your entire authentication life in plaintext. The next malicious browser extension or compromised account password rolls up your whole credential set.

Three formats — pick the right one

Format	Encrypted?	Use case	Re-importable to
Password-protected JSON	Yes — AES-256 + KDF	Backup, Bitwarden-to-Bitwarden migration	Bitwarden, Vaultwarden
JSON (unencrypted)	No — plaintext	Moving to another manager that takes JSON, or scripted analysis	Bitwarden, Vaultwarden, some others
CSV	No — plaintext	Moving to a manager that only accepts CSV	1Password, Dashlane, KeePass, NordPass, RoboForm

Default to password-protected JSON. You set a separate password when you create it (different from your master), and Bitwarden encrypts the file with a key derived from that password. Even if the file leaks, contents stay safe so long as the file password is strong.

The format also preserves field types Bitwarden has but CSV flattens — secure notes, identities, custom fields, folders, attachments-by-reference, item history. CSV throws most of that away. Plain JSON keeps everything but exposes it.

Export from the web vault

The web vault is the simplest path:

Sign in at vault.bitwarden.com.
Top menu: Tools → Export vault.
Format dropdown: pick .json (Encrypted).
Choose "Password protected" file password type.
Set a strong file password — different from your master, written down somewhere offline.
Click Confirm format, then re-enter your master password when prompted.
Browser downloads bitwarden_encrypted_export_YYYYMMDD.json.

Move the file out of Downloads immediately. Documents/Backups/bitwarden/ on an encrypted disk, an encrypted external drive, or a separate cloud account are all defensible destinations.

Export from the desktop app

The same path exists in Windows, Mac, and Linux desktop apps:

Open the desktop app, unlock vault.
Menu bar: File → Export vault.
Same format choice as web — pick .json (Encrypted).
Set file password, confirm master password.
Choose save location — desktop app lets you pick the destination, web doesn't.

Useful when you want to save directly to an encrypted external volume without the file ever touching Downloads/.

Export with the CLI

For automation — nightly cron, post-rotation backup, audit pipelines:

# Unlock and capture session
export BW_SESSION=$(bw unlock --raw)

# Encrypted JSON to a file
bw export --format encrypted_json --password "$BACKUP_PWD" \
  --output ~/backups/bitwarden-$(date +%F).json

# Or plain JSON for scripting (DANGEROUS — plaintext!)
bw export --format json --output /tmp/vault.json
# ...do work...
shred -u /tmp/vault.json

# Lock the session when done
bw lock

The --password flag for encrypted exports avoids interactive prompts but means the password sits in your shell history. Pull it from a secrets manager (op, vault) or a non-history-recorded prompt instead. Our CLI scripts post walks through a hardened backup pattern.

Exporting an organisation vault

Personal vault and organisation vaults export separately. To export an organisation:

Web vault → switch to the organisation in the top-left selector.
Manage → Export vault (you need export permissions on the organisation).
Same format choices apply.

An organisation export contains shared collections only — it does not include personal items members hold individually. Each member exports their personal vault separately if they need a personal backup.

Storing the export safely

An encrypted-JSON export is safer than a plain export, but "safer" is not "safe." Treat it as sensitive material:

Move it off your working filesystem (Downloads, Desktop) within minutes of creating it.
If you put it in cloud storage (iCloud, OneDrive, Google Drive), use a different account than your daily one — this defeats the "attacker who already owns one of your accounts" scenario.
Don't email it to yourself. Email is a near-permanent plaintext archive most people forget about.
Keep the file password offline — written on paper, sealed with the rest of your physical recovery materials.
Test restoring it to a throwaway Bitwarden account once a year. An untested backup is a hope, not a backup.

Decrypting a password-protected JSON outside Bitwarden

Password-protected exports are not opaque blobs — they're a documented format Bitwarden publishes. The structure: a salted PBKDF2/Argon2 key derivation, AES-256-CBC ciphertext, HMAC-SHA-256 integrity tag. If you ever need to decrypt outside a Bitwarden client (forensic recovery, legacy account, dead vendor scenario), the file format is implementable from the spec.

For most users, the recovery path is simply: install Bitwarden client → Tools → Import → Bitwarden (json) → upload the file → enter the file password. Bitwarden detects the encrypted format automatically and prompts for the password.

Re-import to Bitwarden, Vaultwarden, or a competitor

The encrypted-JSON path back into Bitwarden:

Web vault → Tools → Import data.
Format: Bitwarden (json).
Upload the encrypted file.
Enter the file password when prompted.
Review imported items, then archive the source file.

To KeePass / KeePassXC: import the plain JSON or CSV. To 1Password: CSV is the safe path; 1Password's importer recognises Bitwarden's CSV column layout.

What an export does NOT include

Worth knowing before you assume a single file is a complete backup:

Attachments. The export references attachment IDs but does not include the attachment binaries. Premium attachments need to be downloaded separately, item by item, or via the CLI.
Account-level settings. Master-password hint, 2FA configuration, emergency-access contacts. These live with the account, not the vault.
Send items. Bitwarden Send (encrypted file/text sharing) is a separate feature, not exported with the vault.
Vault history. Past versions of items aren't part of the export — you get the current state only.
Trash. Items in the trash bin do not export. Restore them first if you want them backed up.

For a complete backup of an organisation: vault export + attachment downloads + a documented note of 2FA settings and emergency-access contacts. For a personal vault: the encrypted JSON and a scripted attachment dump cover ~99% of recovery scenarios.