Back to Blog
team@tinypod.app

Self-Hosting Vaultwarden Backup Strategies

Your password vault is critical infrastructure. Here are robust backup strategies specifically for Vaultwarden.

vaultwardenbackupspasswordssecurity

Why Vaultwarden Backups Are Critical


If you lose your Vaultwarden database and have no backup, you lose ALL your passwords. This is the most critical backup in your entire self-hosted stack.


What to Back Up


Database

Vaultwarden uses SQLite. The database file contains all vault data.

Path: /data/db.sqlite3


Attachments

File attachments stored with vault items.

Path: /data/attachments/


RSA Keys

Used for push notifications and org invites.

Path: /data/rsa_key*


Config

Environment variables and configuration.


Backup Methods


Method 1: SQLite Backup Command

sqlite3 /data/db.sqlite3 ".backup /backups/vaultwarden-$(date +%Y%m%d).db"


Safe even while Vaultwarden is running.


Method 2: Restic

restic backup /data/


Backs up everything including database, attachments, and keys.


Method 3: Vaultwarden Built-in Export

Admin panel → Backup Database. Downloads a backup through the web UI.


Backup Schedule


  • Daily automated backup (SQLite backup + Restic to B2)
  • Weekly manual verification (restore to test instance)
  • Keep 30 days of daily backups

    • Disaster Recovery


    1. Deploy fresh Vaultwarden on TinyPod

    2. Restore db.sqlite3 from backup

    3. Restore attachments directory

    4. Restore RSA keys

    5. Update DNS if needed

    6. Verify login works


    Testing


    Quarterly: Restore Vaultwarden from backup to a test instance. Verify you can log in and access vault items. If you can't restore, you don't have a backup.


    Additional Protection


    Export your vault periodically (Bitwarden app → Export) and store the encrypted export in a separate location (USB drive in a safe).