Should I vibe code
Open-source password manager with hosted and self-hosted options
AI will write you a vault in an afternoon. Your entire digital life is the test suite.
?
Their verdict, the Premium price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
You can absolutely get an encrypted blob with a CLI on top. What you cannot get in a weekend is key derivation you trust, a recovery story, and the certainty that a subtle mistake has not quietly made every password you own recoverable.
What actually breaks
not "if". the specific failures.
- Key derivation with the wrong parameters — fast to brute-force, and it looks identical to the correct version
- A vault file corrupted mid-write, with no second copy
- The master passphrase, forgotten, with no recovery path that you did not also have to build
- Clipboard leakage to every other app on the machine
- Autofill you never built, so you start pasting passwords into the wrong windows
You are on a laptop that is not yours, trying to log into the thing that will fix the outage. The password is in your vault. Your vault is a Go binary on your desktop at home, behind a passphrase you rotated last month and stored — you are now certain — nowhere. There is no reset link. There is no support address. There is you, at 3am, discovering that you are the vendor.
Is that you?
the verdict is a default, not a law
- It is a read-only viewer for a vault format that already exists, like KeePass
- You are learning cryptography, and the vault contains nothing you would miss
- It stores low-stakes secrets that are all individually recoverable by email reset
- It holds the credentials to your email, your bank, or your infrastructure
- Anyone other than you would depend on it
- You cannot describe your key derivation parameters from memory
- There is no second, independently readable copy of the encrypted data
If you build it anyway
the checklist, then the prompt that enforces it
- Use an audited high-level library — age, libsodium, or the platform keychain. Never assemble primitives yourself.
- Argon2id for key derivation, with parameters written down in the README and justified.
- The vault format must be readable by something that is not your code. If your binary is lost, the data is not.
- Automatic encrypted backups to a second location, verified by a restore test you have actually run.
- Never print a secret to stdout or a log. Clipboard entries expire.
- Write the threat model down before the first line of code. If you cannot, you do not have one.
Before you write any code for a password vault, do the following.
1. Refuse to implement any cryptographic primitive directly. Use filippo.io/age
or libsodium exactly as documented. If a step seems to need custom crypto,
stop and tell me the design is wrong.
2. Write a threat model first, as a comment block: what you are protecting
against, and explicitly what you are NOT (malware on my machine, a
compromised OS, rubber-hose attacks).
3. Derive the key with Argon2id. State the memory, iteration and parallelism
parameters in the README and explain why those numbers.
4. The on-disk format must be documented well enough that a competent person
could write a reader in a different language from the spec alone. Include
that spec in the repo.
5. Implement 'export' before you implement 'add'. I must be able to get my
data out before I am allowed to put any in.
6. Every write is atomic: write to a temp file, fsync, rename. Never truncate
the live vault.
7. On every write, also write a timestamped encrypted backup to a directory
from an env var. Add a 'verify' command that decrypts the newest backup and
confirms it parses.
8. Never write a secret to stdout, a log, or an error message. Clipboard is
cleared after 20 seconds.
9. In the README, state plainly: there is no recovery. If the passphrase is
lost, the data is gone. Then tell me to go and use Bitwarden instead.
10. Out of scope, and say so rather than faking them: browser autofill,
passkeys, sharing, sync.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Bitwarden is open source, costs about $1.65 a month, and you can self-host the server if what you wanted was control rather than savings. That is the version of this project that already works.
$1.65/mo is cheaper than your weekend.
Export to a documented interchange format on day one, and test importing that export into KeePassXC or Bitwarden before you trust the tool with anything real. If you cannot complete that round trip, you do not have a password manager, you have a file.
Unofficial Bitwarden-compatible self-hosted server used by many technical users.
Questions
Can an AI agent actually build a working password vault?
Yes, and quickly. That is precisely the problem. The output will encrypt and decrypt correctly on the happy path, which makes it feel finished, while the parts that matter — key derivation parameters, atomic writes, recovery, clipboard hygiene — are exactly the parts that fail silently.
What if I only put unimportant passwords in it?
Then it is a fine learning project. The risk is not the first day, it is month six, when it is the most convenient place to put something and you stop distinguishing.
Is self-hosting Bitwarden a reasonable middle ground?
It is the correct middle ground. You get control of the data and keep the audited client, the recovery story and the browser extensions. Self-hosting an audited implementation is a completely different risk profile from writing your own.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice