Export the encrypted container as an archive: the same ciphertext as on disk — every wrap slot, the journal, the index — with nothing decrypted. It exports while the vault is locked, and opening it later still requires your credential or Recovery Kit.
The threat it solves
Local-only storage has an honest cost: a lost or broken device could mean lost data — unless you hold your own backup. Export makes that backup yours to keep and yours to place, without ever putting your files on someone else's server.
How it works
- Export locked. Produce the container archive while the vault is locked — a path that can't decrypt can't leak.
- Store it anywhere. An external drive, your own cloud, a second machine — your call.
- Import to recover. On a clean device, import it and open with your credential or Kit. An import never overwrites a live vault.
The key difference
The export is pure ciphertext. Its SHA-256 is a transfer check, not the authenticator; the real authentication is the header MAC and per-chunk AEAD already inside. On the way back in, entry paths are checked against an allow-list of container shapes.
Questions
Readable without my password?
No — opaque ciphertext. Your credential or Kit is still required.
Export while locked?
Yes — and that's deliberate, since a locked export can't leak plaintext.
Does Kistvault keep a copy?
Never. It's not uploaded anywhere; the backup is yours alone.