How to Export Your Bitwarden Vault (2026): Every Format, and What It Leaves Behind

Exporting a Bitwarden vault takes about thirty seconds. What takes longer - and what almost nobody is told - is understanding what the file does not contain, and where you can safely put it afterwards.

Because an export is, by definition, your entire password collection outside its protection. Done carelessly, the backup becomes the weakest point of the whole setup.

The export itself

From the web vault or the desktop app: Tools → Export vault, pick a format, confirm with your master password, and the file downloads. From the browser extension, the same option lives under Settings. Nothing is modified in your vault, so you can repeat it as often as you want.

Choosing the format, honestly

Encrypted JSON with a password of your choosing is what you want for a backup you keep. The file is unreadable without that passphrase, and it can be restored into any account - including a brand-new one, which matters if what you lost is the account itself.

Encrypted JSON tied to your account is offered as the safer-sounding option, and it is safe, but it can only be imported back into the same account. As a disaster-recovery backup it therefore protects you against everything except the disaster you were preparing for.

Plain JSON is readable by any text editor, which is exactly the point when you are migrating to another manager - and exactly the danger the rest of the time. Use it for the few minutes the migration lasts, then delete it properly.

CSV is the lowest common denominator. It carries the least structure and loses the most: custom fields, item types beyond logins, and the organisation of your folders. Choose it only when the destination refuses everything else.

What the file leaves behind

This is the part worth reading twice, because it is where backups quietly fail.

Attachments are not included. The export carries your items - logins, secure notes, cards, identities - but not the files attached to them. If you store recovery codes, certificates or scanned documents as attachments, they must be downloaded one by one. A backup you believe complete and that is not is more dangerous than no backup at all, because you stop worrying.

Organisation items are not included. A personal export covers your personal vault only. Anything shared through an organisation - a family collection, a team vault - needs its own export, which only an owner or admin can run. People typically discover this after leaving a team.

Password history is not preserved, and neither is the trash. If you were counting on retrieving an old password from an export, it will not be there.

Where to put the file

An unencrypted export sitting in Downloads is a plain-text list of every account you own. Two rules make the difference:

1. If it is plain JSON or CSV, it is temporary. Import it, verify the import, then delete it - and empty the trash. On an SSD, ordinary deletion is usually enough given the file's short life; what matters more is not letting it linger for months.
2. If it is an encrypted backup, treat the passphrase as the real secret. Storing it inside the vault the backup protects is a circular dependency: the day you need the file, you will not be able to open it. Write it down physically, or keep it with your other recovery material.

Cloud sync is not automatically wrong for an encrypted export - but be aware that you are handing an encrypted archive of your entire credential set to a third party, and that its safety now rests entirely on that one passphrase.

Verify the export, once

An untested backup is a hope, not a backup. Do this once, right after your first export:

• Open the file. A plain JSON should show your items; an encrypted one should be unreadable noise. If an "encrypted" export is readable, you exported the wrong format.
• Count the items and compare with your vault's item count. A large gap usually means organisation items you did not export.
• If it is your disaster-recovery copy, try importing it into a fresh test account. It is the only way to learn now, rather than on the day it matters, that the account-tied format cannot be restored elsewhere.

The short version

Export via Tools → Export vault. Choose encrypted JSON with your own passphrase for a backup, plain JSON only for a migration you finish the same day. Remember that attachments and organisation items are not in the file. Store the passphrase outside the vault it protects, and test a restore once - before you need it.