What is the BCUP file format?
A .bcup file is an encrypted password vault created by Buttercup, a free and open-source password manager written by developer Perry Mitchell. It stores logins, secure notes, payment details, and other credentials in a single file that only Buttercup can read.
The contents are protected with AES-256 encryption in CBC mode. The encryption key is derived from your master password using many rounds of PBKDF2, and a SHA-256 HMAC guards the data against tampering. Before encryption, the vault is serialized to text and GZip-compressed. Older vaults use "Format A", which records the vault's full change history and therefore grows over time; newer vaults use "Format B", a compact JSON structure that can cut file size to a fraction of the old layout.
Security & safety
RISK: LOWA .bcup file is inert encrypted data, not executable, so opening it cannot run code. The real risk is confidentiality: it contains your passwords protected only by your master password, so anyone who obtains the file can attempt to brute-force it. Use a strong master password and keep backups, because losing the password makes the vault unrecoverable.
Format details
in a nutshellFULL NAMEButtercup Vault Fileaka Buttercup Password Archive, Buttercup Vault
DEVELOPERPerry Mitchell / Buttercupsince 2015
CATEGORYEncoded Files
MIME TYPEapplication/octet-stream
TYPEEncrypted, compressed text container (AES-256-CBC over GZip-compressed vault data)
Programs that open BCUP files
Windows1 app
Buttercup Desktop
Open-source Install Buttercup, choose Vaults then Add New, pick File and Load Existing, select your .bcup file, and enter the master password to unlock it. 
macOS1 app
Buttercup Desktop
Open-source Open Buttercup, add a new vault of type File, choose Load Existing, browse to the .bcup file, and type the master password. 
Linux1 app
Buttercup Desktop
Open-source Run the Buttercup AppImage, add a File vault, select Load Existing, open the .bcup file, and enter the master password. 
Android1 app
Buttercup for Android
Open-source Install the Buttercup app, add a vault from local storage or a connected cloud service, choose your .bcup file, and unlock it with the master password.
iOS1 app
Buttercup for iOS
Open-source Open Buttercup, add a vault from Files or a cloud provider, select the .bcup file, and enter the master password to decrypt it.
Web1 app
Buttercup Browser Extension
Open-source Install the Chrome or Firefox extension, connect it to a .bcup vault stored locally or in a linked cloud service, and unlock with the master password to autofill logins. Technical details
deep spec| Encoding | Text wrapper containing Base64-encoded binary ciphertext |
| Byte order | N/A (text-delimited container) |
| Container | iocane-encrypted payload wrapping GZip-compressed vault data |
| Compression | GZip applied to the serialized vault before encryption |
| Encryption | AES-256 in CBC mode; key derived from the master password via PBKDF2 (many rounds, salted); SHA-256 HMAC computed over the encrypted data for integrity/authentication |
| Typical size | A few kilobytes to a few megabytes depending on entry count and stored attachments |
| Structure | The vault is first serialized (Format A: line-by-line command history; Format B: JSON), GZip-compressed, then AES-256-CBC encrypted. The encrypted output plus its salt, IV, iteration count and HMAC are packed into a delimited text string and written to the .bcup file. |
| Integrity | SHA-256 HMAC verifies both integrity and authenticity before decryption; a wrong master password or tampering causes decryption to fail |
| Encryption Detail | PBKDF2 key derivation, AES-256-CBC cipher, SHA-256 HMAC, per-vault random salt and IV |
| Platforms | Windows, macOS, Linux, Android, iOS |
| Notes | Format A stored the vault's full command history, so files grew on every change even after deletions. Format B switched to a compact JSON structure, cutting file sizes to roughly 20-50% of Format A. Encrypted attachments are stored separately in a .buttercup directory beside the .bcup file. |
| Structure Summary Formats | Format A = deltas/command list; Format B = JSON vault tree with groups and entries |
| Released | 2015 |
| Latest version | Format B (JSON-based vault structure) |
| Specification | github.com |
BCUP conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about BCUP files.
Frequently asked questions
How do I open a .bcup file?
Install Buttercup on your device, add a new vault, choose File then Load Existing, select the .bcup file, and enter its master password. The data is only readable inside Buttercup because it is encrypted.
I forgot my Buttercup master password. Can I still open the vault?
No. The vault is encrypted with AES-256 and the key comes from your master password via PBKDF2. Buttercup never stores or transmits that password, so there is no recovery or reset. Without it the file cannot be decrypted.
Can I open a .bcup file without Buttercup?
Not practically. There is no general viewer for the format. Developers can decrypt it with the open-source buttercup-core library if they know the master password, but everyday users need the Buttercup app.
Is it safe to store my .bcup file in Dropbox or Google Drive?
Yes, that is a common and supported setup. The file stays encrypted in the cloud, so even if the storage account is compromised the contents remain protected by your master password. A strong password is still essential.
Why does my .bcup file keep growing in size?
Older vaults use Format A, which stores the full history of every change, so the file grows even when you delete items. Migrating the vault to Format B switches to a compact JSON layout and can shrink it to about 20-50% of the old size.
Where are my attachments stored?
Encrypted attachments are not kept inside the .bcup file itself. Buttercup stores them in a separate .buttercup directory in the same folder as the vault, so keep that folder with the vault when moving or backing up.
References
1Buttercup official sitebuttercup.pw
2How Buttercup creates an encrypted password archive (Perry Mitchell)perrymitchell.net
