Shares 1Password's exact reasoning: a form storing text is trivial, but encrypting it correctly enough that a breach doesn't expose every password is applied cryptography most teams should rent, not build.
Just pay
Effort: not worth startingRunning cost: $0/mo to start
Why CanICodeThis says Just pay
A form saving a username and password against a site name is trivially simple as a raw database operation
A UI listing saved entries with search is ordinary front-end work
For understanding how encryption works conceptually, building a toy version is a genuinely good learning project
The parts that'll cause problems
Real client-side encryption, so that even a database breach doesn't expose plaintext passwords, is applied cryptography with a long history of subtle, serious mistakes even experienced teams make
Secure sharing of specific credentials between team members without exposing them elsewhere needs real access-control design
This is a case where 'technically buildable in a weekend' and 'safe to actually use with real passwords' are very different bars — the honest advice is: don't, for anything real
How I'd build this
frontend
Next.js
database
Supabase
hosting
Vercel
MVP scope
If purely for learning: a toy vault with basic encryption, clearly never used for real credentials
Postpone to v2
Real end-to-end encryption done correctly (this is precisely the hard, high-stakes part — use an established password manager for anything real instead)
What it actually costs to build
AI agent — with a subscription (Claude Pro/Max, Cursor, etc.)
$0 marginal
AI agent — pay-per-use API, no subscription
$86–$172 one-time
Hosting, once it's running
$0/mo (free tier)
Domain name, if you want your own
~$12/yr
Existing tools solving a similar problem typically run $2.99–$2.99/mo — see how they compare below.
The build prompt
Don't build this for real use — the stakes are the whole reason, not the difficulty. If you want to understand the mechanics as a learning project:
1. A toy vault with basic encryption using an established library (never hand-roll your own).
2. Clearly label it as never used for real credentials, and never put a real password in it.
Out of scope, permanently: real end-to-end encryption done correctly — this is precisely the hard, high-stakes part where subtle mistakes have serious consequences, and it's exactly what an established password manager already gets right. Use one for anything real.