How to back up an encrypted vault without any cloud

Local-only means backups are your responsibility — which is exactly why nothing of yours sits on someone else's server. Here's a simple routine that keeps it that way.

To back up an encrypted vault without a cloud, export the encrypted container — one opaque file that still needs your credential to open — and keep copies on your own media using the 3-2-1 rule: three copies, on two kinds of media, with one copy off-site. Because the container is ciphertext, those copies are safe to store anywhere; the only copy you guard carefully is your Recovery Kit, which you keep separate.

Why "no cloud" shifts the job to you — and why that's good

A cloud-backed vault quietly keeps a copy of your data on a company's servers. That's convenient, and it's also a permanent copy you don't control, exposed to breaches and lawful requests. A local-only vault keeps nothing off your device, which removes that whole risk — and hands you one responsibility in exchange: making your own backups. Done once as a habit, it's a few minutes a month.

The 3-2-1 routine, adapted for an encrypted container

1. Export the encrypted container. From the vault app, produce an encrypted export. It's an opaque blob — useless without your password, pattern or Recovery Kit — so you don't have to trust where it's stored.
2. Three copies. The working vault on your phone counts as one. Make two backup copies.
3. Two kinds of media. Put one copy on an external SSD or USB stick, and another on different media — a second drive, an SD card, a computer's disk. Two media types mean one failure doesn't wipe out every copy.
4. One copy off-site. Keep one somewhere physically separate — a drawer at work, a relative's house, a safe-deposit box — so a fire, flood or burglary at home can't take all of them at once.
5. Keep the Recovery Kit apart. Store your printed Kit separately from the backups, so losing one bag doesn't hand someone both the container and its key.

Why this stays private

Every backup copy is ciphertext. An external drive left at a relative's house, a stick in a desk drawer — none of them reveal anything without your credential. You get redundancy without trusting any of the storage, and still nothing lives in a cloud.

Test a restore — a backup you've never restored is a guess

Once or twice a year, import a backup copy into a fresh install and confirm it unlocks with your credential. This catches the two failure modes that silently ruin backups: a corrupted file, and a forgotten password. If a restore ever fails, you want to find out during a test, not during a real emergency.

A sensible cadence

Re-export after meaningful changes — when you've added files you'd hate to lose. The container is a point-in-time snapshot, so a stale backup misses recent additions.
Refresh the off-site copy periodically so it doesn't drift too far behind.
Retire old media securely; an old drive can still hold an old (but still valid) encrypted container.

Doing this with Kistvault

Kistvault's export produces exactly this kind of opaque encrypted container, and Kistvault never uploads it anywhere — there's no backend in the loop. Restoring is just importing the container into a fresh install and unlocking with your password, pattern or Recovery Kit. The back up your own container scenario walks through it.

Bottom line: three copies, two media, one off-site — all ciphertext, Recovery Kit kept apart, and a restore you've actually tested. That's a cloud-free backup you can rely on.