I want reliable backups of my password manager vault and my two-factor authentication recovery codes, preferably stored separately. I'm using Windows 11 and currently have an encrypted Bitwarden JSON export inside a password-protected 7-Zip archive, plus a separate Word document containing my recovery codes in another password-protected 7-Zip archive.
I'm considering cloud storage such as OneDrive's Personal Vault, one or more USB drives, and printing the recovery codes on paper. My main concerns are malware or keyloggers on my PC, someone obtaining the backup files, and losing or forgetting a physical drive when traveling.
Would it be reasonably safe to store these files in OneDrive Personal Vault or together on one USB drive? Are there any important weaknesses in this backup plan, and what storage arrangement would provide a good balance of security and convenience?
2 Answers
Keeping the two backups separate is a good idea, but the separation only helps if the encryption is strong and the passwords are independent. Password-protected 7-Zip archives using AES-256 are generally reasonable for this purpose, provided you choose long, random archive passwords and verify that the files can actually be opened and restored.
A compromised PC could capture the archive passwords while you create or open the backups, so make the archives from a trusted, fully updated system and avoid opening them on an infected machine. Consider printing the recovery codes rather than keeping them in an editable document, and store that paper somewhere private and protected from fire. For the vault export, keep multiple encrypted copies, including one offline copy that is not permanently plugged into the computer.
A practical approach is to keep the printed recovery codes in a secure physical location and store the encrypted vault export on one or more USB drives. Keep at least two copies in separate places so a lost, damaged, or forgotten drive doesn’t leave you locked out. A home safe is usually sufficient for many people; a safe-deposit box is an option if you want stronger protection against fire or theft.
Cloud storage can also work, but treat it as an untrusted location. Use a modern, strongly encrypted archive with a long unique password that is not stored alongside the archive. Enable multi-factor authentication on the cloud account, preferably with a hardware security key or an authenticator app. Personal Vault adds useful account protections, but it should not be your only layer of encryption.
That makes sense. I’m mainly trying to avoid relying on a single USB drive while keeping the vault and recovery codes from becoming one complete package if either backup is exposed.
Putting both encrypted archives on one drive is acceptable as one copy, but it creates a single point of failure. I’d use separate drives or locations for additional copies, and avoid leaving either drive connected to the PC except when updating or testing the backup.