# How to Vibe Code Your Own Bitwarden (and Stop Paying for It)

> Open-source credential and secrets management

- Site: https://bitwarden.com
- Category: Security & Privacy
- Platforms: Web app, macOS app, Windows app, iOS app, Android app, Browser extension
- Verdict: **Serious undertaking** (45/100 vibecodeable)
- Estimated effort: 6-8 weeks of focused development

## Verdict

Build a web-only single-user subset with client-side encryption, but keep paying for the multi-device native apps and browser extensions.

Replicating Bitwarden's core zero-knowledge encryption model in a Next.js web application is achievable, but building the cross-browser extension autofill engine and native mobile keychain integrations requires navigating a maze of platform-specific security sandboxes and cryptographic edge cases. If you make a single error in key derivation or local storage persistence, you either leak credentials or permanently brick user vaults.

### What you can't replicate

- Global multi-platform native extension ecosystem across Chrome, Safari, Firefox, and Edge
- Audited zero-knowledge enterprise compliance and rigorous third-party penetration testing
- Enterprise federated SSO, SCIM provisioning, and SIEM integrations

## What it does

Zero-knowledge credential and secrets management platform for individuals, families, and businesses.

### Core features

- Zero-knowledge client-side encryption (AES-256 and PBKDF2/Argon2id)
- Encrypted vault CRUD operations (logins, secure notes, cards, identities)
- Secure password and passphrase generator
- Integrated TOTP authenticator generator
- Browser extension auto-fill and web vault dashboard
- Encrypted vault sharing via collections
- Cross-device real-time sync
- Browser autofill script injection

## The business

### Pricing

- Free Individual: Free
- Premium Individual: $1.65/mo
- Families: $3.99/mo
- Teams: $4.00/mo per user
- Enterprise: $6.00/mo per user

### Funding

$100M raised.
- Growth / Series C (September 2022)
Investors: PSG, Battery Ventures

Founded 2015.
Team size: 150-260+.

## The hard parts

- Client-side cryptographic key derivation and secure local storage without master key leakage
- Cross-browser extension architecture with shadow DOM and tab injection scripts for auto-fill
- Conflict-free real-time synchronization of encrypted blobs across multiple offline clients
- Biometric key unlocking securely bound to device operating system keychains

## How to vibe code Bitwarden

### Prerequisites

- Node.js (Free): Runtime environment for building and running the Next.js web application and build tools.
- GitHub (Free): Version control and repository hosting for your codebase.

### Recommended AI tools

- Claude Code: Terminal-based AI coding agent ideal for scaffolding the full stack, setting up crypto routines, and iterating on UI components.
- Cursor: AI code editor for refining React components, Tailwind styling, and debugging encryption hooks.

### Stack

- Frontend: Next.js with Tailwind CSS and shadcn/ui
- Backend: Next.js App Router API Routes
- Database: Turso (libSQL/SQLite over HTTP)
- Auth: better-auth with custom master-password client key derivation
- Payments: None (Personal clone)
- Other: Web Crypto API (SubtleCrypto for AES-256 and PBKDF2)

### Hosting

- Cloudflare (Deploying the Next.js web application frontend and API edge functions): $0/mo
- Turso (Serverless edge SQLite database for storing encrypted user blobs): $0/mo

### Build guide

1. **Project Scaffolding and Database Schema** — Initialize the Next.js project with Tailwind CSS, shadcn/ui, and configure the Turso libSQL client for encrypted data storage.

```
Initialize a new Next.js project using the App Router, TypeScript, and Tailwind CSS. Install shadcn/ui primitives (button, input, dialog, card, dropdown-menu, toast). Install `@libsql/client` for Turso database connectivity. Create a database schema file in TypeScript defining users (id, email, password_hash, salt, kdf_iterations) and cipher items (id, user_id, type, encrypted_data, notes, created_at, updated_at). Write migration scripts to set up these tables against a local SQLite instance or Turso connection.
```

2. **Client-Side Zero-Knowledge Cryptography Engine** — Implement browser-based cryptographic utilities using the native Web Crypto API for master key derivation and AES-256-CBC/GCM encryption.

```
Create a TypeScript cryptography module using the browser Web Crypto API (`window.crypto.subtle`). Implement functions for: 1) Deriving a master key from a master password and email salt using PBKDF2 with 600,000 iterations. 2) Generating a symmetric user data encryption key (protected by the master key). 3) Encrypting vault item payloads (username, password, notes) into ciphertext strings before transmission to the server. 4) Decrypting ciphertext strings locally in memory using the derived master key. Ensure no plaintext master passwords or unencrypted vault data ever leave the client boundary.
```

3. **Authentication and Master Password Workflow** — Build user registration and login flows ensuring the server only verifies authentication hashes while the client retains the decryption keys.

```
Implement authentication pages and API routes using better-auth integrated with Turso. During registration, the client generates a cryptographic salt, hashes the master password via PBKDF2 for server verification, and stores the user record. During login, the user enters their master password on the client, which derives the master key and holds it in volatile session memory. Create a secure session context provider that makes the decryption key available exclusively to authenticated vault views.
```

4. **Vault Item Management and Dashboard** — Build the core vault dashboard allowing users to view, add, edit, and delete logins, secure notes, and credit cards with client-side encryption.

```
Build a dashboard layout in Next.js featuring a sidebar for item categories (Logins, Secure Notes, Cards) and a main content list. Implement modals for creating and editing vault items. When a user submits a new item, serialize the payload, encrypt it using the client-side crypto module, and send the encrypted blob to a `/api/ciphers` endpoint. Populate the list by fetching encrypted items from the server and decrypting them locally on-the-fly using the active master key in memory.
```

5. **Password and Passphrase Generator** — Build an integrated password and passphrase generator tool with customizable character sets and strength estimation.

```
Create a Password Generator component within the dashboard and as a standalone utility modal. Include options for length (default 16), uppercase, lowercase, numbers, and special symbols. Implement a diceware-style passphrase generator using an embedded wordlist with configurable word count and separators. Add a visual password strength meter and a one-click copy-to-clipboard button with timeout clearing for clipboard security.
```

6. **Integrated TOTP Authenticator and Vault Polish** — Add support for time-based one-time password (TOTP) seed storage and real-time code generation within vault items.

```
Extend the vault item schema to support storing TOTP secret keys (base32 encoded strings). Implement an authenticator code calculation utility in TypeScript using HMAC-SHA1 to compute 6-digit TOTP codes refreshing every 30 seconds. Display live countdown rings and codes directly inside login vault item cards with a quick-copy action.
```

### Cost vs paying

**Starting costs (one-time):**

- AI Coding Assistant Subscription: $20.00
- Total: ~$20.00 one-time

**Ongoing costs (monthly):**

- Cloudflare Pages & Turso DB: $0.00
- Total: ~$0.00/mo

- Paying for the SaaS instead: $1.65/mo (Premium Individual)
- Build time: 35-45 hours
- AI tool credits: $20 (1 month of Claude Pro / Cursor Pro)
- Break-even: Not a financial substitution (pay $1.65/mo for actual native apps and browser extensions)

## Sources

- [Bitwarden Official Website](https://bitwarden.com)
- [Wikipedia - Bitwarden Architecture and History](https://en.wikipedia.org/wiki/Bitwarden)