What’s the safest way to back up a password vault and 2FA recovery codes?
Asked by
MellowCedar47
I want reliable backups of my Bitwarden vault and my two-factor authentication recovery codes, preferably stored separately. I exported the vault as an encrypted JSON file and put it in a password-protected 7-Zip archive. The recovery codes are in a separate Word document inside another password-protected 7-Zip archive.
I'm considering cloud storage such as OneDrive, one or more USB drives, and printing the recovery codes for storage in a safe. I use a Windows 11 PC and am mainly worried about malware or keyloggers, someone obtaining the backup files, and losing a physical drive. Is it reasonably safe to store these backups in OneDrive, or together on one USB drive? Are there weaknesses in this approach that I should address?
Answers
The safest practical approach is redundancy: keep an encrypted digital copy in cloud storage, an encrypted copy on a USB drive, and a paper copy of the recovery codes in a physically secure place. OneDrive is acceptable if the files are strongly encrypted before uploading; don’t rely only on the cloud provider’s folder protection. Use a long, unique archive password that you can remember, and store that password separately from the backup files. Keeping both archives on one encrypted USB drive is fine, but it creates a single point of failure, so use at least two drives stored in different secure locations. Test that you can actually decrypt and restore the files.
Reply to this answer
Printing the 2FA recovery codes and keeping them in a locked, fire-resistant place is a good option because it avoids exposing them to malware and makes them easy to recover when a device is unavailable. For the vault, use multiple encrypted copies rather than depending on a single thumb drive. The main risk with your current plan is entering the archive password on an infected PC: encryption protects the stored file, but not the password if a keylogger captures it. Keep Windows and the password manager updated, use reputable security software, and create or access the backups only on a trusted, clean system. Also confirm that the vault export is actually encrypted and that the 7-Zip archive uses a modern encryption method such as AES-256.
Reply to this answer
Add your answer
Answers are reviewed before publication.
CopperLark22: A safe copy is useful, but it’s not a backup if it’s the only copy. I’d keep one drive at home and another somewhere separate, and periodically replace or verify them.