Bitwarden Data Export: The Cleanest Exit We Have Scored

This is the highest score we have given, and it is worth explaining what a high score actually measures, because it is not product quality.

It measures how little the product does to keep you. On that specific question, Bitwarden is the clearest example on this site of software that appears entirely unbothered by the prospect of you leaving.

The encrypted export, which almost nobody offers

Every password manager faces the same awkward constraint: an export has to be readable by the product you are importing into, so an export is plaintext. Your entire credential history, sitting on your disk, in a file anyone could open.

Bitwarden offers an alternative. Alongside the plaintext .json and .csv, it provides encrypted JSON in two variants:

• Account restricted — the file will only import back into the account that created it. Useful as a personal backup, useless to anyone who steals it.
• Password protected — imports into any account using the export password, so it works for a genuine migration while still being encrypted at rest.

That second option is the one that matters, because it removes the uncomfortable trade at the heart of every other migration in this category. You can move to another product without your vault ever existing in readable form on a disk.

Bitwarden still gives the plaintext warning where it applies, and does not soften it: "Unless you use an encrypted export, do not store or send the exported file over insecure channels, like email, and delete the file immediately after use."

Attachments actually come out

The .zip export packages a JSON file together with your attachments. For individual vaults, that means the documents you have stored — scans of identity papers, recovery code screenshots, certificates — leave with you as files rather than as references to a vault you no longer have.

This is rarer than it should be. Attachments are the thing most often left behind in a credential migration, because they are large, awkward, and easy for a vendor to omit without anybody noticing until later.

The documented limit is that the zip covers individual vaults. If you run an organisation vault with attachments, that is the gap to check before you rely on this.

The format fork, which still matters

Even here, the choice of format changes what you get.

JSON — encrypted or plaintext — carries cards, identities, stored passkeys and SSH keys in addition to logins and notes.

CSV carries logins and notes, and drops the rest.

So the rule is the same as everywhere else in this category and worth repeating because people keep reaching for the spreadsheet: export JSON unless something downstream specifically demands CSV. The convenience of a readable file is not worth silently losing every payment card and identity record in your vault.

What genuinely does not come out

Two things, and Bitwarden names both: "No export formats include trash items or Sends."

Trash is a real and easily-fixed gap. People delete items they later want, and Bitwarden keeps them in trash for a period. Those are not in any export. If there is anything in your trash you would miss, restore it before exporting — it takes a minute and it is invisible otherwise.

Sends are the ephemeral share links Bitwarden creates. Excluding them is arguably correct, since they are transient by design, but if you have active Sends that colleagues or clients are relying on, closing the account breaks them and nothing in your export records that they existed.

Set against what other products in this category leave behind, two named and minor exclusions is a remarkably short list.

No caps, no expiry, no paywall

Three absences that each earn full marks.

There is no record ceiling — nothing like Trello's thousand-action cap that quietly truncates your history.

There is no expiring link and no limit on download attempts — nothing like Google Takeout's seven days and five downloads, or Notion's seven-day window after a thirty-hour build. The file is written locally and it is simply yours.

And the documentation states no plan-tier restriction, which is consistent with a company whose free plan already includes unlimited devices and unlimited passwords. Leaving does not require buying anything first.

Why the missing point

Twenty-nine rather than thirty, and the deduction sits on completeness for the trash and Sends exclusions.

That is a deliberately harsh reading of a minor gap, and it is meant to be. A rubric where the best product scores full marks stops being able to distinguish anything, and there is a legitimate scenario — someone who deleted an item last week and needs it — where the trash exclusion costs a user something real.

The verdict

29 out of 30. The cleanest exit on this site.

There is a reasonable argument that this is what a product does when its competitive position does not depend on friction. Bitwarden is open source, cheap, and has a free tier that is a complete product — a company in that position has no particular reason to make leaving difficult, and it shows in every line of the export documentation.

For the contrast, read the 1Password exit report, where a more polished product has a sharper edge on the way out. The buying comparison between them is 1Password vs Bitwarden.