{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/bitwarden-encrypted-export-account-portability-key-rotation/", "item": { "id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "slug": "bitwarden-encrypted-export-account-portability-key-rotation", "url": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation.md", "json": "https://update.dsesecurity.com/api/v1/posts/bitwarden-encrypted-export-account-portability-key-rotation/" }, "title": "Choose a portable Bitwarden encrypted export before moving between accounts or regions", "summary": "An account-restricted export cannot be restored to a newly created account with the same email address.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:33:53+00:00", "modified_at": "2026-10-15T13:36:18+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 271, "potentially_affected": "This concerns the portability of Bitwarden encrypted export formats. It does not establish that an export includes every attachment or configuration detail required for a complete service recovery.", "dse_recommendation": "DSE recommends deciding the recovery destination before selecting an export type.", "primary_source": { "name": "Bitwarden — Encrypted exports", "url": "https://bitwarden.com/help/encrypted-export/", "published_on": null, "authority": "bitwarden.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

An account-restricted export cannot be restored to a newly created account with the same email address.

\n

Source facts

\n

Bitwarden offers account-restricted and password-protected encrypted JSON exports. Account-restricted exports depend on the originating account or organization encryption key and can only be imported back there. The documentation explicitly excludes another account with the same email address and an account on a different geographic or self-hosted server. Rotating the originating encryption key can also make an old restricted export undecryptable. Password-protected exports use the chosen password and can be imported into a different Bitwarden account, making them the documented option for that migration requirement.

\n

Source: Bitwarden — Encrypted exports.

\n

Applicability

\n

This concerns the portability of Bitwarden encrypted export formats. It does not establish that an export includes every attachment or configuration detail required for a complete service recovery.

\n

DSE recommendation

\n

DSE recommends deciding the recovery destination before selecting an export type. If the requirement is migration or recovery into a replacement account, document why a password-protected export is appropriate and protect its password separately from the file. For account-restricted exports, include encryption-key rotation in the process that refreshes recovery material. Record source server, account or organization, format, creation date, and intended destination without including secrets. Verify authorized import rights and protect temporary exports through the approved credential-handling process.

\n

Verification

\n

Use a synthetic vault to test the chosen destination scenario. Confirm that the selected format imports where intended, and review key-rotation consequences before relying on an older restricted export. Check a representative item after import and securely remove temporary test files and passwords when the exercise is complete.

\n

Official reference

\n

Bitwarden — Encrypted exports. Reviewed October 15, 2026.

", "content_text": "An account-restricted export cannot be restored to a newly created account with the same email address.\nSource facts\nBitwarden offers account-restricted and password-protected encrypted JSON exports. Account-restricted exports depend on the originating account or organization encryption key and can only be imported back there. The documentation explicitly excludes another account with the same email address and an account on a different geographic or self-hosted server. Rotating the originating encryption key can also make an old restricted export undecryptable. Password-protected exports use the chosen password and can be imported into a different Bitwarden account, making them the documented option for that migration requirement.\nSource: Bitwarden — Encrypted exports.\nApplicability\nThis concerns the portability of Bitwarden encrypted export formats. It does not establish that an export includes every attachment or configuration detail required for a complete service recovery.\nDSE recommendation\nDSE recommends deciding the recovery destination before selecting an export type. If the requirement is migration or recovery into a replacement account, document why a password-protected export is appropriate and protect its password separately from the file. For account-restricted exports, include encryption-key rotation in the process that refreshes recovery material. Record source server, account or organization, format, creation date, and intended destination without including secrets. Verify authorized import rights and protect temporary exports through the approved credential-handling process.\nVerification\nUse a synthetic vault to test the chosen destination scenario. Confirm that the selected format imports where intended, and review key-rotation consequences before relying on an older restricted export. Check a representative item after import and securely remove temporary test files and passwords when the exercise is complete.\nOfficial reference\nBitwarden — Encrypted exports. Reviewed October 15, 2026.", "content_markdown": "An account-restricted export cannot be restored to a newly created account with the same email address.\n\n## Source facts\n\nBitwarden offers account-restricted and password-protected encrypted JSON exports. Account-restricted exports depend on the originating account or organization encryption key and can only be imported back there. The documentation explicitly excludes another account with the same email address and an account on a different geographic or self-hosted server. Rotating the originating encryption key can also make an old restricted export undecryptable. Password-protected exports use the chosen password and can be imported into a different Bitwarden account, making them the documented option for that migration requirement.\n\nSource: [Bitwarden — Encrypted exports](https://bitwarden.com/help/encrypted-export/).\n\n## Applicability\n\nThis concerns the portability of Bitwarden encrypted export formats. It does not establish that an export includes every attachment or configuration detail required for a complete service recovery.\n\n## DSE recommendation\n\nDSE recommends deciding the recovery destination before selecting an export type. If the requirement is migration or recovery into a replacement account, document why a password-protected export is appropriate and protect its password separately from the file. For account-restricted exports, include encryption-key rotation in the process that refreshes recovery material. Record source server, account or organization, format, creation date, and intended destination without including secrets. Verify authorized import rights and protect temporary exports through the approved credential-handling process.\n\n## Verification\n\nUse a synthetic vault to test the chosen destination scenario. Confirm that the selected format imports where intended, and review key-rotation consequences before relying on an older restricted export. Check a representative item after import and securely remove temporary test files and passwords when the exercise is complete.\n\n## Official reference\n\n[Bitwarden — Encrypted exports](https://bitwarden.com/help/encrypted-export/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "url": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose a portable Bitwarden encrypted export before moving between accounts or regions", "item": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/#article", "identifier": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "url": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/", "headline": "Choose a portable Bitwarden encrypted export before moving between accounts or regions", "description": "An account-restricted export cannot be restored to a newly created account with the same email address.", "abstract": "An account-restricted export cannot be restored to a newly created account with the same email address.", "articleBody": "An account-restricted export cannot be restored to a newly created account with the same email address.\nSource facts\nBitwarden offers account-restricted and password-protected encrypted JSON exports. Account-restricted exports depend on the originating account or organization encryption key and can only be imported back there. The documentation explicitly excludes another account with the same email address and an account on a different geographic or self-hosted server. Rotating the originating encryption key can also make an old restricted export undecryptable. Password-protected exports use the chosen password and can be imported into a different Bitwarden account, making them the documented option for that migration requirement.\nSource: Bitwarden — Encrypted exports.\nApplicability\nThis concerns the portability of Bitwarden encrypted export formats. It does not establish that an export includes every attachment or configuration detail required for a complete service recovery.\nDSE recommendation\nDSE recommends deciding the recovery destination before selecting an export type. If the requirement is migration or recovery into a replacement account, document why a password-protected export is appropriate and protect its password separately from the file. For account-restricted exports, include encryption-key rotation in the process that refreshes recovery material. Record source server, account or organization, format, creation date, and intended destination without including secrets. Verify authorized import rights and protect temporary exports through the approved credential-handling process.\nVerification\nUse a synthetic vault to test the chosen destination scenario. Confirm that the selected format imports where intended, and review key-rotation consequences before relying on an older restricted export. Check a representative item after import and securely remove temporary test files and passwords when the exercise is complete.\nOfficial reference\nBitwarden — Encrypted exports. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:53+00:00", "dateModified": "2026-10-15T13:36:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/bitwarden-encrypted-export-account-portability-key-rotation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose a portable Bitwarden encrypted export before moving between accounts or regions" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 271, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Bitwarden — Encrypted exports", "url": "https://bitwarden.com/help/encrypted-export/" } } ] } }