How to vibe code: a beginner’s guide

What does it mean to vibe code?

To vibe code is to build an app or website by telling an AI what you want, in plain language, and letting it write the code. You judge the result by using it, not by reading the code. Andrej Karpathy, a co-founder of OpenAI, named it in a post on X on February 2, 2025, describing a way of coding where you “forget that the code even exists.”

That is fine for a prototype. For anything that holds real users’ data or takes payments, you still need to check what the AI built, and this guide shows you what to check. For the longer background, see what is vibe coding.

Which tool should you use to vibe code?

If you don’t code, start with a browser-based app builder: you type, it builds and hosts the app, and you never install anything. If you already code, an AI code editor fits better. Here are the beginner-friendly options and their free plans, checked on each company’s pricing page as of October 2026.

Free plans are enough to learn and build a first version. Expect to pay once you want a custom domain, more building time or real payments. For a full comparison, see the best vibe coding tools.

How do you write a good first prompt?

A good first prompt says who the app is for, the one job it does, the main screens and what the user sees after each action. Vague prompts like “make me a fitness app” give you a generic demo. Specific prompts give you something close to what you pictured. Here are three you can adapt.

• Name the audience and the one job before any features.
• Describe screens and actions, not technology: “a booking form that emails me,” not “a POST endpoint.”
• Say what to leave out. “No admin panel yet” keeps the first version small.
• Attach a screenshot or sketch if you have one: most tools read images.

How to vibe code an app, step by step

1. 1

   Write one sentence about the app

   Who it is for, what it does and why they would use it. If you can’t write it in one sentence, the AI can’t build it well either.

2. 2

   Pick a tool and start on the free plan

   Choose a browser-based builder from the table above. Don’t pay until you have built something you want to keep.

3. 3

   Send a specific first prompt

   Use one of the example prompts as a template: audience, job, screens, look, and what to leave out.

4. 4

   Test it like a user

   Click through every screen on your phone and laptop. Try wrong inputs, empty forms and the back button. Write down what breaks.

5. 5

   Fix one thing per message

   Ask for one change at a time and test after each. If a fix breaks something else, roll back to the last working version instead of piling on more prompts.

6. 6

   Add sign-in, then payments in test mode

   Add sign-in so each person sees only their own data. Add payments in test mode and run the full checkout yourself before you switch to live.

7. 7

   Run the security checks

   Check database access rules, keep secret keys out of the app’s visible code, and add limits on anything that costs you money per use. The next section explains each one.

8. 8

   Deploy and share with five people

   Publish to the tool’s free address or your own domain, and send it to five people from your audience. Watch them use it if you can.

What security checks do vibe-coded apps need?

Vibe-coded apps need three checks before real users arrive: who can read and change the data, where secret keys live, and limits on anything that costs money. AI tools build what you ask for, and they don’t always lock things down unless asked.

This is a real risk, not a theory. In May 2025 a vulnerability, CVE-2025-48757, was published describing database access rules in Lovable-generated apps (up to April 15, 2025) that let outsiders read or write data. Lovable disputes it, saying each customer is responsible for protecting their app’s data. Either way, the lesson for any tool is the same: check your app’s access rules yourself.

How do you vibe code a website?

Vibe coding a website is the easiest place to start: describe the sections, tone and audience, and the AI builds and hosts the page. A website without sign-in or a database also avoids most of the security work above.

• List your sections in order: headline, offer, proof, prices, contact.
• Paste in your real copy and photos rather than letting the AI invent them, so nothing fake ends up live.
• Ask for a contact or booking form that emails you, and test it with your own address.
• Ask the AI to add a page title and description for search engines, then connect your own domain.

What are the most common vibe coding mistakes?

The most common vibe coding mistake is asking for too much at once. A prompt with fifteen features gives you an app where none of them work well, and every fix touches everything else. The second is trusting the app because it looks finished: a polished screen can still save data in the wrong place or show one user another user’s records.

• Building the whole app in one prompt instead of one screen or feature at a time.
• Letting the AI invent content, prices or testimonials, then forgetting to replace them before launch.
• Never testing with a second account, so you miss data leaking between users.
• Pasting secret keys straight into the chat or the app’s visible code.
• Switching tools halfway through instead of learning one well.
• Skipping version history: most tools let you roll back, so use it before each risky change.

A simple habit avoids most of these: after every change, sign in as a second test user, click through the main flow, and only then ask for the next change. It feels slower, and it saves hours of untangling later.

When should you stop vibe coding and bring in a developer?

Bring in a developer when each fix breaks something else, when you handle sensitive data such as health or payment details, or when you have paying users who depend on the app. Vibe coding is fastest at the start and slowest when an app grows past what you can test by clicking around.

• The same bug comes back after three or more fix attempts.
• You store health, financial or children’s data, or sell in a regulated industry.
• You need a custom integration the tool doesn’t support.
• Paying users report problems you can’t reproduce.
• You want a security review before a launch or a fundraise.

A good middle path: keep building in the tool, and pay a developer for a few hours to review access rules, keys and payments. If you want the next step after a prototype, our AI app builder page covers pricing, launch and running it.