I want reliable backups of my Bitwarden vault and my two-factor authentication recovery codes, preferably stored separately. I exported the vault as an encrypted JSON file and put it in a password-protected 7-Zip archive. The recovery codes are in a separate Word document inside another password-protected 7-Zip archive.
I'm considering cloud storage such as OneDrive, one or more USB drives, and printing the recovery codes for storage in a safe. I use a Windows 11 PC and am mainly worried about malware or keyloggers, someone obtaining the backup files, and losing a physical drive. Is it reasonably safe to store these backups in OneDrive, or together on one USB drive? Are there weaknesses in this approach that I should address?
2 Answers
Printing the 2FA recovery codes and keeping them in a locked, fire-resistant place is a good option because it avoids exposing them to malware and makes them easy to recover when a device is unavailable. For the vault, use multiple encrypted copies rather than depending on a single thumb drive. The main risk with your current plan is entering the archive password on an infected PC: encryption protects the stored file, but not the password if a keylogger captures it. Keep Windows and the password manager updated, use reputable security software, and create or access the backups only on a trusted, clean system. Also confirm that the vault export is actually encrypted and that the 7-Zip archive uses a modern encryption method such as AES-256.
The safest practical approach is redundancy: keep an encrypted digital copy in cloud storage, an encrypted copy on a USB drive, and a paper copy of the recovery codes in a physically secure place. OneDrive is acceptable if the files are strongly encrypted before uploading; don’t rely only on the cloud provider’s folder protection. Use a long, unique archive password that you can remember, and store that password separately from the backup files. Keeping both archives on one encrypted USB drive is fine, but it creates a single point of failure, so use at least two drives stored in different secure locations. Test that you can actually decrypt and restore the files.
A safe copy is useful, but it’s not a backup if it’s the only copy. I’d keep one drive at home and another somewhere separate, and periodically replace or verify them.