Security · checked 2026-10-19

Can I vibecode Bitwarden Premium?

KINDA· weekend project

The Premium extras are small pieces of code: a TOTP generator, encrypted attachments, a report that flags reused, weak and old passwords, and a recovery key you keep on paper. An agent can build a local vault with all of them in a sitting. The gaps are the ones every password manager has: autofill in browsers and on phones, sync between devices and an outside audit of the crypto. At $19.80 a year there is also little to save. If you want to leave Bitwarden's servers, Vaultwarden runs a Bitwarden-compatible server on your own hardware and keeps the official apps.

$1.65/moprice

$20you'd save a year

weekendbuild time

—people replaced it

Before you start

What you need on hand.

DifficultyIntermediate · Some system setup or keys.

TimeA weekend: a sitting for the vault, longer to trust it

Claude Code, Codex or CursorAny of them can run the prompt.
Node.js 22better-sqlite3 compiles a native module, so build tools must be installed.
Your Bitwarden exportTools > Export vault as .json, not .csv, so cards and identities come along. Delete the file after importing.
Paper or an offline spotFor the recovery kit the app prints once.

Before you buildBitwarden Free already stores unlimited passwords on unlimited devices. Premium adds authenticator codes, file storage and reports for $19.80 a year, which is cheap enough that building your own rarely pays off.

1. Install one agent: Claude Code, Codex, Cursor.
2. Make an empty folder and open it in the agent.
3. Paste the prompt below, press enter, and answer its questions as it builds.

The prompt

Build me a local password vault with the extras of Bitwarden Premium to replace it. Requirements:

- Node.js 22 + TypeScript. One core library and two front ends: a CLI called `vault` (add, get, list, search,
edit, rm, gen, totp, attach, report) and a web page on http://127.0.0.1:4550 served by Fastify with plain HTML.
- Keys: Argon2id (`libsodium-wrappers`, crypto_pwhash) turns my master password into a master key. A random
256-bit vault key is sealed under it, so changing the master password re-wraps one key and touches no items.
- Recovery: at setup also seal the vault key under a random 24-word recovery phrase, print it once as a kit to
store on paper, and add `vault recover` to set a new master password from it.
- Storage: better-sqlite3 at ~/.vaultlocal/vault.db. Each item is one row holding an XChaCha20-Poly1305 blob; the
only plaintext columns are id and updated_at. Attachments are encrypted files in ~/.vaultlocal/files/.
- Items: logins (title, username, password, URLs, notes, TOTP secret, tags), secure notes and file attachments.
Show live 6-digit codes with `otpauth`, and accept a pasted otpauth:// URI.
- Health report: reused passwords, weak ones (`@zxcvbn-ts/core`) and logins unchanged for a year. A breach check
runs only with `vault report --breaches`: it sends the first 5 characters of each SHA-1 to the Have I Been
Pwned range API and prints exactly that before it starts.
- Import a Bitwarden unencrypted JSON export (logins, notes and TOTP seeds) with counts per type and a
confirmation before anything is written. Export an encrypted JSON file.
- Lock after 5 minutes idle; copied secrets leave the clipboard after 30 seconds.
- Tests: a wrong master password fails, one flipped byte in the database is detected, and changing the master
password keeps every item readable.
- Single user. No accounts, no telemetry, local-first; no network calls apart from --breaches, and the web
server listens on 127.0.0.1 only.
- Out of scope: browser autofill, mobile apps, sync, sharing, passkeys, hardware keys.
- README: install, first run, backup and restore, the recovery kit, and an honest warning that this is
unaudited code, so keep your Bitwarden export until you trust it.

Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.

Share on X

Max MiskowSponsoredAI agents, automations and MVPs, built for your company.Visit site ›

Then keep going

Next prompts, same folder.

The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Bitwarden Premium.

Add scheduled backups to the vault in this folder. Requirements:

- A command `vault backup <dir>` that copies vault.db and the files/ folder into a dated
  folder inside <dir>; the files are already encrypted, so copy bytes without decrypting anything.
- Keep the newest 14 backups, delete older ones, and never delete the only copy.
- Verify each backup by opening the copy read-only, checking a header and a count of rows against the
  original, and print a pass or fail.
- `vault restore <backup>` asks for confirmation, moves the current vault to vault.db.bak and
  restores; it must refuse to run while the vault is unlocked.
- Update the README with a launchd or systemd timer and an rclone line for an off-site copy.

Add an emergency packet to the vault in this folder. Requirements:

- A command `vault packet --shares 3 --need 2` that splits the vault key with Shamir secret
  sharing (`shamir-secret-sharing`) and writes each share as a text file with a short instruction page.
- `vault packet-open` takes any 2 shares plus a copy of the vault files and opens the vault read-only,
  with no way to edit or delete.
- Record the date each packet was made and warn in `vault report` when it is older than 12 months or
  the master password has changed since.
- Test: any 2 of 3 shares open the vault, 1 share does not, and a share from an older vault key fails.
- Update the README with how to hand the shares out and what to tell each person.

Add a minimal browser helper to the vault in this folder. Requirements:

- A Chromium Manifest V3 extension in ./extension that talks to a native messaging host
  (`vault native-host`) instead of a network port; the host answers only while the vault is unlocked.
- A popup lists logins whose saved URL matches the current site's registrable domain; clicking one
  fills the username and password into the page's form. Never fill on page load or inside iframes.
- Show the 6-digit code for logins that have a TOTP secret and copy it on click.
- Refuse to fill on http pages and when the domain only partly matches.
- Update the README with how to install the extension unpacked and register the native host.

What you lose

Autofill in the browser and on your phone, which is what you use every day
Sync between devices, with the vault readable everywhere
An independent security audit of the crypto and the apps
Emergency Access for a trusted contact, hardware security key sign-in and passkey storage
Sharing with family or a team

Why people still pay

At $1.65 a month it is the cheap way to get authenticator codes, file storage and a health report next to a vault that already works on every device. Writing your own saves almost nothing, and a password manager is where a home-built app has the hardest time earning the trust that others bought with audits.

Moatbrand & trust execution polish switching costs

Do the math

Bitwarden Premium or your own copy?

Over

Your usage

Count my time12h ×$/h

Bitwarden Premium, 1 yr$20

Your own copy, 1 yr$8running + build session

You keep$12pays for itself in 5 months

Estimate · Runs on your own machine and backups are a folder. At $19.80 a year, Premium costs less than the tokens for a careful build. The build is token usage on your agent plan.

Leaving Bitwarden Premium

Take your data, then cancel.

1 · Take your data out of Bitwarden Premium

1In the web app open Tools, then Export, and choose My vault.
2Pick a format: plaintext JSON, plaintext CSV, encrypted JSON, or a ZIP with attachments (JSON plus your files).
3Only JSON exports include cards, identities, stored passkeys and SSH keys, so choose JSON over CSV.
4Confirm with your master password or an email code. Sends, trash items and organization-owned items are not in an individual export.

2 · Cancel Bitwarden Premium

1In the web app open Settings, then Subscription.
2Note the Next charge date: paid access runs until then.
3Select Cancel subscription. The account shows Pending cancellation until that date.
4On the next charge date the account drops to the free individual plan and paid features are removed; your data stays.

Export the ZIP with attachments before you cancel: only that format includes the files stored under Premium.
The export page does not say whether authenticator seeds are included, so open the JSON and check one login before you rely on it.
Delete unencrypted exports as soon as you have imported them; they hold every password in plain text.
Premium cancelled within 30 days of the subscription's creation can be refunded: contact support. Older subscriptions are not eligible.
Emergency Access is a Premium feature, so tell your contacts before it lapses.

Checked 2026-10-19 against Bitwarden Premium's docs: 1, 2, 3

The escape hatch

Don't feel like building it? These are already free.

VaultwardenOpen sourceAGPL Bitwarden-compatible server written in Rust; use it with the official Bitwarden apps and extensions. Its README lists attachments, Send, organizations and two-step login.★ 69k · active Oct 2026 · docker to self-host
serverVisit ↗KeePassXCOpen sourceGPL-2 or GPL-3 desktop vault kept as a local file, with TOTP and browser autofill; you bring your own sync, such as a synced folder.★ 29k · active Oct 2026 · one-click install
Windows, macOS, LinuxVisit ↗Bitwarden FreeFreeBitwarden's own free plan: unlimited items and devices, passkeys and encrypted export, without TOTP codes, attachments and health reports.★ 14k · active Oct 2026 · they host it
Web, Windows, macOS, Linux, iOS, Android, browserVisit ↗

All 5 free alternatives to Bitwarden Premium ›

The numbers

Bitwarden Premium pricing

Plan	Monthly	Annual, per month	What you get
Free	$0	$0	Unlimited items and devices, passkeys, password generator, encrypted export, Bitwarden Send, sharing with one other user, email support.
Premium	—	$1.65	Built-in authenticator (TOTP), 5 GB of encrypted file storage, vault health reports and alerts, Emergency Access, up to 10 hardware security keys, Yubico OTP and Duo for two-step login, priority support.
Families	—	$3.99	Six Premium accounts, unlimited sharing and collections, 5 GB of personal storage and 5 GB for shared items.

Free tier: Sharing is limited to one other Bitwarden user; no built-in authenticator codes, no file attachments, no vault health reports and no Emergency Access.
Billing: Annual billing only: one yearly charge of $19.80 (about $1.65 a month), in USD and before tax. Premium cancelled within 30 days of the subscription's creation can be refunded through support.
Hidden costs: Storage beyond the included 5 GB is sold separately; the pricing page does not give a price for it.
Source: bitwarden.com

Also on the list

1Password$4.99/mo · SecurityKINDA

Aura$15/mo · SecurityNOT REALLY

DeleteMe$10.75/mo · SecurityNOT REALLY

Questions

Bitwarden Premium, briefly

Not answered here? Tell us and we'll add it.

Ask a question ›

Free covers unlimited passwords on unlimited devices, passkeys, the generator, encrypted export, Send and sharing with one other user.

Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: Autofill in the browser and on your phone, which is what you use every day, Sync between devices, with the vault readable everywhere.

About $1.65 a month on the Premium plan, $19.80 a year (checked 2026-10-19).

Autofill in the browser and on your phone, which is what you use every day; Sync between devices, with the vault readable everywhere; An independent security audit of the crypto and the apps; Emergency Access for a trusted contact, hardware security key sign-in and passkey storage; Sharing with family or a team. If any of those matter to you, keep paying.