Backup and recovery

Paw supports export and restore of vault data. Choose a format based on whether your vault contains attachments and whether the backup file must be encrypted.

Backup formats

Format	Content	Encryption	Notes
`.paw` archive	Credentials, item history, and file attachments	Password-encrypted	Recommended for complete backups
`.cxf.age` document	Credentials and item history	Password-encrypted (age)	CXF format encrypted with age; no attachments
`.cxf` document	Credentials and item history	None (plaintext)	Unencrypted CXF document; no attachments

Attachments: CXF documents cannot store binary attachments. If your vault contains attachments, Paw requires you to export as a .paw archive.

Plaintext warning: A .cxf file is completely unencrypted. Anyone who can read the file can read all stored secrets. Store and transfer .cxf files securely.

Exporting a backup

Desktop app

Unlock your vault.
Open the vault menu in the top bar.
Select Export credentials.
Choose the format (.paw, .cxf.age, or .cxf), set an export password if requested, and select the destination file.

Command line

Run paw cli export:

# Encrypted CXF (default)
paw cli export Personal backup.cxf.age

# Complete Paw archive including attachments
paw cli export --paw Personal backup.paw

# Unencrypted CXF (requires confirmation)
paw cli export --plaintext Personal backup.cxf

Restoring a backup

Restoring a backup always creates a new vault with a fresh master password and its own encryption key. It does not overwrite or merge into an existing vault.

The password protecting a .paw or .cxf.age backup is only used to decrypt the archive during restore. You can choose a different master password for the new vault.

Desktop app

From the vault selector screen, select the + (Add vault) button.
Select Restore backup.
Choose your .paw, .cxf.age, or .cxf file.
Enter the backup password when prompted.
Set a name and master password for the new vault.

Command line

Run paw cli restore:

paw cli restore backup.paw

Use the --name flag to specify the new vault name:

paw cli restore --name "Restored Vault" backup.paw

Third-party password managers

Paw uses the open Credential Exchange Format (CXF). It does not include proprietary importers for other password manager formats. You can restore CXF documents exported from compatible applications.

Recovery limits

Paw has no hosted servers, accounts, or recovery keys. If you lose your master password and have no backup, your vault data cannot be recovered. Keep encrypted backups in a secure, separate location.

Encryption and keys