Security · checked 2026-10-13

Can I vibecode 1Password?

KINDA· weekend project

The vault itself is small: a key derived from your master password, one encrypted file, a search box, a password generator and TOTP codes. An agent writes that in a sitting. What takes the rest of the weekend, and stays a gap after it, is everything around the vault: a browser extension that fills forms safely, phone apps, sync between devices and an outside audit of the crypto. For a password manager those gaps are the product, which is why most people who want out move to Bitwarden or Vaultwarden rather than their own code.

$4.99/moprice

$60you'd save a year

one sittingbuild time

—people replaced it

Before you start

What you need on hand.

DifficultyIntermediate · Some system setup or keys.

TimeUnder an hour for the vault; autofill and sync are extra sessions

Claude Code, Codex or CursorAny of them can run the prompt.
Node.js 22The argon2 package compiles a native module, so Xcode command-line tools (macOS) or build-essential (Linux) must be installed.
A CSV export from 1PasswordMade in the desktop app; it holds only logins and passwords.
A place for backupsThe vault is one file; losing it means losing everything.

Before you buildBefore building, look at Bitwarden's free plan or a Vaultwarden server: both are free, audited and come with autofill and phone apps.

1. Install one agent: Claude Code, Codex, Cursor.
2. Make an empty folder and open it in the agent.
3. Paste the prompt below, press enter, and answer its questions as it builds.

The prompt

Build me a local password vault to replace 1Password. Requirements:

- Node.js 22 + TypeScript. One core module used by two front ends: a CLI called
  `vault` (add, get, list, search, edit, rm, gen) and a web page on
  http://127.0.0.1:4500 served by Express with plain HTML and no framework.
- Encryption: derive the key from my master password with Argon2id (the `argon2`
  package, 64 MB memory, 3 passes, random salt) and seal the whole vault with
  XChaCha20-Poly1305 from `libsodium-wrappers`. Plaintext never touches the disk.
- Storage: a single file at ~/.localvault/vault.enc. Every save first copies the
  previous file to ~/.localvault/backups/ with a timestamp; keep the newest 10.
- Items: logins (title, username, password, URLs, notes, TOTP secret, tags) and
  secure notes. Search matches title, URL and tag. Show live 6-digit TOTP codes
  with the `otpauth` package.
- Generator: random passwords (length 8-64, symbols on/off) and 5-word
  passphrases from a wordlist file kept in the repo.
- Import a 1Password CSV export: print the detected column mapping and ask for
  confirmation before writing anything.
- Lock after 5 minutes idle. Copied secrets leave the clipboard after 30 seconds.
  The web server listens on 127.0.0.1 only.
- No accounts, no telemetry, no network calls at runtime, local-first.
- Out of scope: a browser autofill extension, mobile apps, sync and sharing.
- README: install, first run, backup and restore, and an honest warning that this
  is unaudited code, so keep your old vault export until you trust it.

Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.

Share on X

Max MiskowSponsoredAI agents, automations and MVPs, built for your company.Visit site ›

Then keep going

Next prompts, same folder.

The first prompt builds the core. Run these one at a time in the same folder to grow it into your own 1Password.

Add a Chrome extension (Manifest V3) to the password vault in this folder. Requirements:

- The extension talks only to the local server on http://127.0.0.1:4500 and
  sends a per-install token generated by the server and stored in .env.
- On a page with a password field, the popup lists logins whose URL matches
  the site's domain and fills username and password on click.
- Never fill automatically and never fill in iframes from another origin.
- If the vault is locked, the popup says so and links to the unlock page.
- Update the README with how to load the unpacked extension.

Add a password health report to the vault in this folder. Requirements:

- Flag passwords under 12 characters, reused across items, or found in the
  Have I Been Pwned range API (k-anonymity: send only the first 5 characters
  of the SHA-1 hash).
- Run only when I click Check or run `vault audit`; cache results for 7 days.
- Show the report as a table in the web page and in the CLI.
- Update the README with exactly what leaves the machine during a check.

Let the vault in this folder sync through a shared folder. Requirements:

- A setting points vault.enc at any folder (iCloud Drive, Dropbox, Syncthing).
- Before each save, check whether the file changed on disk since it was opened;
  if so, decrypt both, merge item by item using updatedAt, and keep both copies
  of any item edited on both sides.
- Never overwrite without a backup in ~/.localvault/backups/.
- Update the README with the risks of syncing through a cloud folder.

What you lose

One-click autofill and autosave in the browser
Phone apps and sync between devices
Shared family vaults and account recovery
Breach and weak-password alerts (Watchtower)
Independent security audits of the code

Why people still pay

A password manager is the one app where a bug can cost you everything, so people pay for audited crypto, recovery options and autofill that works on every site and phone. Families also lean on shared vaults, and many find 1Password's apps the most comfortable to live in every day.

Moatbrand & trust execution polish switching costs

Do the math

1Password or your own copy?

Over

Your usage

Count my time3h ×$/h

1Password, 1 yr$60

Your own copy, 1 yr$5running + build session

You keep$55pays for itself in 2 months

Estimate · Runs locally with no services to pay for. The build session is token usage on your agent plan.

Leaving 1Password

Take your data, then cancel.

1 · Take your data out of 1Password

1Open the 1Password 8 desktop app (Mac, Windows or Linux) and choose File > Export, then pick the account.
2Pick 1PUX to keep everything, including custom fields, or CSV for logins and passwords only.
3If you use passkeys, export them from the phone app (iOS 26+ or Android 14+) through Credential Exchange; desktop exports leave them out.

2 · Cancel 1Password

1Sign in at 1Password.com and open Billing in the sidebar.
2Scroll down and choose Cancel subscription.
3If you subscribed through the App Store or Google Play, cancel there instead.

After the paid period ends the account is frozen: you can still view and copy items, but not add, edit or autofill. Export before then anyway.
Export files are not encrypted. Import them, then delete the file and empty the trash.
On Families or Teams, only the organizer, owner or someone with billing permission can cancel.
Accounts that sign in through company SSO can't export unless an admin allows it.

Checked 2026-10-13 against 1Password's docs: 1, 2, 3

The escape hatch

Don't feel like building it? These are already free.

VaultwardenOpen sourceA lightweight Bitwarden-compatible server in one container; use it with the official Bitwarden apps and extensions.★ 69k · active Oct 2026 · docker to self-host
serverVisit ↗BitwardenFreeHosted vault with a free plan covering unlimited items and devices; Premium adds extras such as built-in TOTP.★ 14k · active Oct 2026 · they host it
Web, Windows, macOS, Linux, iOS, Android, browserVisit ↗KeePassXCOpen sourceDesktop app around a local KeePass file, with a browser extension; sync the file yourself.★ 29k · active Sep 2026 · one-click install
Windows, macOS, Linux, browserVisit ↗

All 6 free alternatives to 1Password ›

The numbers

1Password pricing

Plan	Monthly	Annual, per month	What you get
Individual	$4.99	$3.99	1 user, unlimited items and devices, 1 GB file storage.
Families	$7.99	$5.99	Up to 5 people, shared vaults, account recovery for members.
Teams Starter Pack	—	$24.95	Up to 10 members; extra seats $4.99 each, up to 20.
Business	—	$8.99/user	Admin controls, reporting, 5 GB storage per user.
Enterprise	custom	—	—

Free tier: No free plan; a 14-day trial without a card.
Billing: Monthly or yearly; you can switch in Billing Settings, but switching moves you to current prices.
Hidden costs: Prices rose on 27 March 2026 (Individual yearly from $35.88 to $47.88) and existing subscribers pay the new price at renewal. The first-year discount does not apply to App Store or Google Play purchases. Tax is added at checkout.
Source: 1password.com

Also on the list

Airtable$24/mo · DatabasesYES

Carrd$1.58/mo · Website buildersYES

Cronitor$15/mo · Cron monitoringYES

Questions

1Password, briefly

Not answered here? Tell us and we'll add it.

Ask a question ›

Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: One-click autofill and autosave in the browser, Phone apps and sync between devices.

About $4.99 a month on the Individual plan, $59.88 a year (checked 2026-10-13).

One-click autofill and autosave in the browser; Phone apps and sync between devices; Shared family vaults and account recovery; Breach and weak-password alerts (Watchtower); Independent security audits of the code. If any of those matter to you, keep paying.