Backups are where zero-knowledge designs often quietly fail. An export that downloads plaintext JSON is convenient — and it creates the most dangerous file on your computer. Encrypted export keeps the seal intact while still giving you a portable copy you control.
Portability should not require surrendering confidentiality. If you ever need a backup, a migration path, or simply peace of mind offline, you should leave with sealed data — not a gift-wrapped dump of every login you ever saved.
What encrypted export is for
Vault App’s Enterprise encrypted vault export is built for holding a backup without turning backup into a bypass of end-to-end encryption. You get a file structured for restore into Vault, protected with a password you choose. We do not need to see the contents to let you take them with you.
That matters for threat models that include cloud account compromise, device loss, or simply not wanting a single online dependency for every secret you own. An encrypted export is a sealed suitcase. A plaintext export is an open suitcase with a sticky note that says “do not look.”
How to treat the file
Store exports offline or in a location worthy of vault-level secrets. Do not leave them in a desktop folder that syncs to three clouds. Do not email them to yourself. If your threat model changes — new devices, new people with physical access, a suspected compromise — rotate your master password and produce a fresh export.
The password that protects the export is part of the security boundary. Choose it with the same seriousness as a master password. Losing both the export password and the ability to unlock the live vault is equivalent to losing the secrets; that is intentional.
Convenience without escrow
Some providers make export easy by decrypting for you on the server. That is key escrow with a download button. Vault App’s approach keeps decryption on the path you already trust: client-side crypto under a password you control.
If you are on Enterprise and care about durable backups, use encrypted export deliberately. If you are evaluating password managers, ask what an export contains and where decryption happens. The answer tells you whether “backup” is a safety net or a leak waiting for a sync folder.