# How to Vibe Code Your Own Keeper Security (and Stop Paying for It)

> Identity Security for Humans, Machines and AI Agents

- Site: https://keepersecurity.com
- Category: Cybersecurity & Password Management
- Platforms: Web app, Browser extension, iOS app, Android app, CLI
- Verdict: **Solid side project** (68/100 vibecodeable)
- Estimated effort: 2-3 weeks part-time

## Verdict

You can build a personal, zero-knowledge password vault for yourself, but you will hit friction getting secure browser autofill and mobile extension bindings to function reliably.

Replicating a personal vault clone requires implementing client-side AES-256-GCM encryption using the Web Crypto API, storing only opaque ciphertexts on your server. While the database schema and React frontend are straightforward, handling browser extension content scripts for autofill and managing local master key derivation securely without storage leaks takes careful debugging.

### What you can't replicate

- FedRAMP High and SOC 2 compliance posture
- Native mobile autofill service extensions across iOS and Android system boundaries
- Enterprise SCIM provisioning bridges and SAML 2.0 federated connectors

## What it does

Unified zero-trust and zero-knowledge cybersecurity platform for password management, secrets management, privileged access, and session threat detection.

### Core features

- Zero-knowledge client-side encryption (AES-256 with Argon2/PBKDF2 key derivation)
- Secure password, passkey, and file vault storage
- Cross-device real-time sync with local caching
- Credential sharing and time-limited public record links
- Browser extension and web autofill integration
- Password and passphrase generator
- Two-factor authentication (TOTP/Passkeys)
- Dark web breach scanning alerts

## The business

### Pricing

- Personal (Unlimited): ~$3/mo — Unlimited password storage and device synchronization for individuals.
- Family Plan: ~$6/mo — Up to 5 private vaults and secure file storage.
- Business & Enterprise: ~$4-$8/user/mo — Team-wide password management, SSO, SCIM provisioning, and auditing.

### Funding

$60M raised.
- Seed Round (January 2011)
- Series C (August 2020)
- Series D / Growth Equity (May 2023)
Investors: Insight Partners, Summit Partners

Founded 2011.
Team size: Hundreds of global employees.

## The hard parts

- Flawless zero-knowledge architecture ensuring plaintext master keys never touch the server
- Multi-device conflict resolution and encrypted ciphertext sync across platforms
- Secure cross-browser autofill script injection and extension state handling
- Rigorous audit logging and tamper-proof storage without leaking metadata

## How to vibe code Keeper Security

### Prerequisites

- Node.js (free): Runtime for running the Next.js framework and build tooling.
- GitHub (free): Repository hosting and deployment pipeline integration.
- Cursor (free): AI-native code editor used to build and iterate on the vault codebase.

### Recommended AI tools

- Cursor: Ideal for iterative UI work and implementing complex client-side cryptographic helpers with AI assistance.
- Claude Code: Executes multi-file scaffolding and refactoring for the encryption layer and database models.

### Stack

- Frontend: Next.js with Tailwind CSS and shadcn/ui components
- Backend: Next.js Server Actions / API Routes
- Database: Turso (libSQL/SQLite at the edge for storing encrypted blobs)
- Auth: better-auth configured for master password derived key authentication
- Payments: None (personal use clone)
- Other: Web Crypto API (SubtleCrypto for AES-256 client-side encryption), Zod for schema validation

### Hosting

- Cloudflare (Hosting the Next.js frontend and edge API routes): $0/mo

### Build guide

1. **Project Scaffolding & Database Schema** — Initialize a Next.js project with Tailwind CSS, shadcn/ui, and connect Turso for storing encrypted records.

```
Scaffold a new Next.js TypeScript project using App Router. Install Tailwind CSS and set up shadcn/ui components (button, dialog, input, card, dropdown-menu, table). Configure Drizzle ORM to connect to a Turso (libSQL) database. Create a database schema for users (id, email, password_hash, salt, iterations) and records (id, user_id, encrypted_data, updated_at). Ensure all database fields storing vault payload data are designated as opaque text/blob columns so the server never handles plaintext.
```

2. **Client-Side Zero-Knowledge Cryptography Engine** — Implement master password key derivation using PBKDF2/Argon2 and AES-256-GCM encryption in the browser.

```
Implement a cryptographic utility library in TypeScript using the browser's native Web Crypto API (window.crypto.subtle). Write functions for: 1) deriving a master encryption key from a master password and salt using PBKDF2 with 600,000 iterations, 2) encrypting a JSON record payload with AES-256-GCM returning ciphertext, iv, and auth tag, 3) decrypting ciphertext back to JSON using the derived key. Ensure the master password and derived key are kept strictly in ephemeral client memory (session/state) and never logged or sent to the server.
```

3. **Master Password Auth & Vault State** — Build local authentication flow where the client unlocks the vault and holds the decryption key in memory.

```
Build an authentication flow using better-auth or custom session handling where users sign up with an email and a master password. On sign-up, generate a random cryptographic salt client-side, derive a verification verifier hash, and store the salt and verifier on the server. On login, verify the password locally by deriving the key and matching verifiers, then store the active encryption key in React context memory for the duration of the session. Implement a lock vault button that wipes the key from memory and redirects to the login screen.
```

4. **Vault Record Management UI & CRUD** — Build the user interface for adding, editing, organizing, and viewing encrypted vault records (passwords, notes, cards).

```
Create a dashboard vault interface in Next.js with a sidebar and main content area. Implement modals and forms for creating and editing vault records (fields: title, username, password, URL, notes). When saving a record, serialize the fields to JSON, encrypt it using the in-memory master key via the crypto utility from step 2, and send only the encrypted blob string to a Next.js API route that saves it to Turso. When loading the vault, fetch all encrypted records for the user, decrypt them client-side, and render them in a searchable data table or card grid.
```

5. **Secure Password Generator & Polish** — Add a robust password and passphrase generator along with dark mode and clipboard security features.

```
Add a password and passphrase generator component to the vault UI. Users can toggle length (8-64 chars), uppercase, lowercase, numbers, and symbols. Include a passphrase generator option using random dictionary words separated by hyphens. Add a copy-to-clipboard button for passwords that automatically clears the system clipboard after 30 seconds for security. Style the application with a clean, dark-mode-first security aesthetic matching a modern password manager.
```

### Cost vs paying

**Starting costs (one-time):**

- Domain name (optional): $12 one-time
- Total: ~$12 one-time

**Ongoing costs (monthly):**

- Cloudflare / Turso free tiers: $0/mo
- Total: $0/mo

- Paying for the SaaS instead: ~$3/mo
- Build time: 18 hours
- AI tool credits: $20
- Break-even: 4 months

## Sources

- [Keeper Security Official Website](https://keepersecurity.com)
- [Keeper Security Pricing and Features](https://keepersecurity.com/pricing.html)