Make recovery a separate task
A remembered account login, a saved server list and an encrypted backup are different recovery tools. None automatically replaces every other credential. Keep recovery material somewhere independent of the device and vault it protects.
Export a local backup
- Unlock the workspace you intend to back up.
- Open Local Vault Sync in Settings and use the supported export workflow.
- Choose a strong, unique backup passphrase and retain it separately.
- Wait for export to finish. If a credential cannot be read, resolve the error rather than treating the failed export as a complete backup.
- Confirm that the archive actually exists in the destination. A browser download prompt is not proof of a saved file.
- Test restoration using disposable data before relying on the archive.
Local Vault Sync covers saved host profiles, groups and their available credential records. It is not a promise to reconstruct hosted inventory or non-exportable device and passkey credentials. For archives with custom vault metadata, use the vault's own supported importer.
Restore carefully
Preserve the original archive. Check the destination workspace and understand what will be written before importing. Restoration validates the archive and can roll back managed writes after ordinary errors, but a crash or unavailable operating-system keyring still needs careful recovery.
If the app reports an incomplete rollback, stop and inspect the destination before retrying. Repeated imports can make an uncertain state harder to understand.
Lost passwords and devices
Recovering an account does not necessarily decrypt its vault. Use the recovery material required by the particular vault workflow. A device-bound unlock method may need fresh enrollment on a replacement device.
Never send a vault archive, private key, account secret or recovery code to support. Report the app version, failed step and redacted error instead. See account security and troubleshooting.