A password manager restored halfway is worse than one that is lost: it looks complete. The accounts are there, the entries are there, and nobody notices a thing until the day someone types their master password and nothing decrypts.

This guide covers the whole chain for Vaultwarden: what a backup has to contain besides the database, why copying a SQLite file while it is open is not a backup, a script that cannot report success on a truncated archive, a restore into a throwaway container where you actually open the vault, and the queries that tell you a restored vault is still a vault. It needs only sqlite3 , tar , docker and the AWS CLI.

The vault is not in the database

Vaultwarden knows none of your passwords. Every entry is encrypted in the browser before it is sent, and the server only stores the encrypted blob, in the data column of the ciphers table.…