Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Back up the password manager’s native encrypted vault file, not a routine CSV or HTML export. Keep recoverable copies in separate locations, retain the exact master password and every additional unlock factor, and periodically open a copy in a safe test environment. A backup that cannot be unlocked is not a backup.
The exact file format and menu names depend on the application. KeePassXC provides a well-documented example: its encrypted KDBX database can be stored on a computer or cloud service, while the database password, key file or hardware-token recovery secret remains essential to recovery.
What a secure vault backup must accomplish
A useful backup has to solve several different problems at once. It must preserve the latest data, remain confidential if another person obtains the storage medium, survive deletion or device failure, and still be usable when the original computer or installation is unavailable.
- Confidentiality: the stored copy should remain encrypted, rather than exposing every password as readable text.
- Recoverability: you need the exact master password and any required key file, token secret or other second factor.
- Redundancy: separate copies reduce the chance that one failed disk, lost device or accidental deletion destroys the only copy.
- History: versioned storage can restore an earlier file after corruption, an unwanted edit or accidental replacement.
- Usability: you should be able to locate the file and open it with the intended password manager.
No single storage location satisfies every risk. A synchronized folder may provide convenient off-device copies and version history, while a removable drive provides an offline option. Both still depend on the vault’s own encryption and on preserving its unlock material.
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
Back up the native encrypted database, not an ordinary export
Password managers usually have a native database format designed to preserve their complete data model. That is the file to copy for routine backup. In KeePassXC, the database is an encrypted KDBX file. The KeePassXC Team states that a database protected by a strong, long password remains encrypted while stored on a computer or cloud storage service.
A CSV, XML or HTML export is different. Export functions commonly produce unencrypted text and may omit attachments, custom fields or application-specific features. The KeePass project also notes that CSV and XML describe lower-level fields without a universally shared password-database structure, which can make later imports confusing or incomplete. Use such an export for a deliberate migration or recovery procedure, not as the normal protected copy.
How to identify the right file
Open the password manager’s documentation and identify its native database extension and backup command. Do not assume that a file with a familiar name is complete: some applications maintain auxiliary key files, attachments or token configuration outside the main database. Record where each required component lives before copying anything.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make the copy while the database is closed, or use the application’s documented backup function. Copying a file while it is being written can capture an inconsistent state. In KeePassXC, you can configure an automatic pre-save backup destination and also use the on-demand Save Database Backup command. Labels can differ between releases, so confirm the current menu wording in the installed version.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
A practical secure-backup workflow
- List the recovery ingredients. Write down the native vault filename and location, the application and version that can open it, the exact master password, and any key file or hardware-token recovery secret. Do not put the password in the same unprotected folder as the vault.
- Create a consistent native-file copy. Close the manager first, or invoke its built-in backup feature. Open the resulting copy’s properties and confirm that its size and modification time look plausible. Keep the original working vault unchanged until the copy is complete.
- Place a copy away from the working device. A synchronized storage folder can serve as an additional location when the vault file remains encrypted. Prefer a service or filesystem with automatic backups or version history so an overwritten or deleted file can be recovered. Check the manager’s encryption and synchronization model before applying this approach to an unfamiliar application.
- Keep an offline copy if you need one. Copy the encrypted native file to a removable drive stored separately from the computer. A USB flash drive is only a storage medium: it can fail, be lost or be stolen, and it does not replace the vault’s password. Maintain more than one removable copy if losing one device would leave you without a usable backup.
- Protect every unlock factor. Retain the long master password through a secure method. If the database requires a key file, preserve an unchanged copy and keep it separate from the only database copy. If a hardware token is involved, follow the token maker’s recovery procedure and preserve the configured recovery secret. KeePassXC warns that losing the password, key file or required token secret can permanently lock the database.
- Verify a copy in a safe test location. Copy the backup to a temporary test directory or spare device, then open it with the intended password manager and all required key material. Confirm that representative records, attachments and custom fields are present. Do not edit the production vault during this check.
- Repeat after meaningful changes. Update the backup after adding or changing important credentials, and after moving the vault or changing its key material. The documentation establishes the need for recoverability, but it does not prescribe one universal calendar interval.
Storage choices and their trade-offs
Choose locations by considering confidentiality, resistance to loss, the amount of recent data they contain and whether you can recover without the original device. The following comparison describes the roles each method can play; no row is sufficient by itself in every situation.
| Method | Confidentiality if accessed | Resilience and history | What recovery still requires | Best use |
|---|---|---|---|---|
| Native vault in a versioned synchronized folder | Strong when the manager’s native file remains encrypted; account access and sharing settings still matter | Off-device copy and, where offered, older versions after deletion or corruption | Master password plus any key file or token secret | Convenient current copy with rollback capability |
| Encrypted native vault on a removable drive | Protected by the vault’s encryption, but the physical drive can be read, lost or stolen | Independent of the computer; no automatic history unless you create multiple dated copies | Working drive, compatible manager and all unlock material | Offline or disconnected recovery copy |
| Printed readable export | Anyone holding the pages can read the secrets | Unaffected by disk failure, but vulnerable to fire, water, loss and physical theft | Access to the pages; rebuilding the vault may require manual entry | Optional last-resort disaster recovery |
| CSV, XML or HTML export kept as a file | Usually unencrypted plaintext; a compromise exposes the listed secrets | Easy to copy but may omit features and offers no native-database guarantees | Compatible import process and protection of the plaintext file | One-time migration or controlled print workflow, followed by secure deletion |
KeePassXC-specific details
KeePassXC stores its database in an encrypted KDBX file. Its Getting Started Guide recommends a long, randomized database password and makes clear that losing the password can permanently remove access. The same guide recommends storage with automatic backups or version history to help recover from corruption or accidental deletion.
Automatic and on-demand database backups
KeePassXC can save a pre-save backup to a destination you configure. It also provides an on-demand Save Database Backup action. Use these features with the database closed or in the application’s normal save flow, then copy the resulting KDBX to a second location. A backup command is not a substitute for checking that the destination is accessible and that the file can be opened.
Key files and hardware tokens
A key-file-protected database needs the exact original key file. Do not regenerate it, edit it or convert it and assume the result is equivalent. KeePassXC recommends distributing a key file by a different method from the synchronized KDBX file and keeping a backup in a safe location. Storing both components beside each other means one theft can provide everything needed to unlock the database; storing neither component leaves the encrypted file unusable.
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
Hardware-token protection creates a similar dependency. Keep the token and its documented recovery secret according to the manufacturer’s procedure. If the token’s configured secret is lost and there is no recovery path, the database may be permanently inaccessible.
Why plaintext exports are dangerous
An export can look like a convenient universal backup because it opens in a browser or spreadsheet. That convenience is exactly the problem: the exported file may contain usernames, passwords, recovery codes, notes and other secrets without encryption. KeePassXC also warns that exports may not include every database feature, such as attachments or custom fields.
Use a plaintext export only for a defined purpose, such as moving data to another manager or producing a paper emergency copy. Keep the file in a restricted temporary location, do not synchronize it casually, and remove it when the operation is complete. Emptying a visible folder may not remove all residual copies: temporary directories, recycle or trash areas, browser caches, print spools and backup snapshots can retain data.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Optional paper backup: useful, but readable by design
A paper copy can remain available when computers, drives or accounts are inaccessible. It is not an encrypted backup, however. Anyone who finds the pages can read the secrets, and the pages can be photographed or copied. Store them as highly sensitive documents in a physically protected place, and consider whether the exposure is acceptable for your threat model.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
KeePassXC’s documented print workflow
KeePassXC’s paper-backup guidance describes HTML Export as available since KeePassXC 2.5.0, in a 2020 article. The documented sequence is:
- Select
DatabasethenExportand chooseHTML File. - Create the temporary unencrypted HTML file in a controlled location.
- Print the pages, checking that all required records are legible.
- Delete the temporary HTML file rather than merely moving it to trash.
- Store the printed pages securely and limit who can access them.
The computer and printer are part of the exposure. Printer hard drives, print spools, network-printer queues, browser caches, deletion remnants and malware can all create additional copies. A network printer may send the document through systems you do not control. Paper improves availability in some disasters while reducing confidentiality; treat it as an optional emergency measure, not the routine encrypted-vault backup.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to test and maintain recoverability
Testing should answer practical questions, not merely confirm that a file exists. Use a copy of the backup in a location that cannot overwrite the working vault.
- Can you find it? Confirm the path, filename and storage-account permissions.
- Can the application read it? Open the copy with the intended manager, or with a documented compatible version if the original device is unavailable.
- Can you unlock it? Enter the master password and supply the exact key file or token recovery material.
- Is the content complete? Inspect recent entries, an older entry, an attachment and a custom field if your database uses them.
- Can you recover an older version? If the storage system offers history, locate a previous version and confirm how restoration works.
Do not wait for an emergency to discover that a password was mistyped, a key file was replaced or a synchronized folder removed the only copy. When you change the master password, key file or token configuration, make a fresh backup and test the new recovery set.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Common failure situations and fixes
The backup file exists but will not open
First verify that you are using the correct native file, not a partial export or temporary file. Copy it to a new test location, try the documented manager version and provide the matching key file if required. Do not modify the original while troubleshooting. If a versioned storage service has an earlier intact copy, restore that copy and test it separately.
The vault opens, but recent entries are missing
You may have copied an outdated file or backed up before the latest save completed. Compare modification dates, check the application’s backup destination and inspect available file-history versions. Once you locate the current vault, create a new native backup and verify it before replacing older copies.
You lost the master password or key file
Encrypted-vault design intentionally prevents a universal bypass. Search your protected recovery records and every approved location for the unchanged key file or documented token secret. If the required unlock material cannot be recovered, the encrypted database may remain permanently inaccessible.
The removable drive failed or disappeared
Do not treat one USB drive as the only backup. Replace it with a new encrypted-vault copy from another location, then verify that copy. Keep separate locations so a single lost or failed device does not eliminate recovery.
A plaintext export remains on a computer
Remove the export from its original folder and any temporary, trash or recycle locations, and review printer queues, browser downloads and synchronized folders. If the file may have been exposed, treat every secret in it as potentially disclosed and change affected credentials from a trusted device.
Quick Recap
A concise decision checklist
- Have you identified the manager’s native encrypted vault format?
- Was the copy made in a consistent state using the application’s backup feature or a closed-file copy?
- Is at least one copy stored separately from the working device?
- Does at least one location provide version history or another way to recover an older file?
- Are the master password and every additional unlock factor preserved safely?
- Have you avoided keeping routine CSV, XML or HTML exports?
- Have you opened a test copy and checked representative data?
- If you printed an emergency copy, did you delete the temporary export and protect the pages?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
