Vibe coding explained simply: building apps by describing them, what it can do and where the risks are

What vibe coding means

With vibe coding, you describe in plain sentences what a program, app or website should do. The AI writes the code, and you only look at the result, not at the code itself. If something is not right, you tell it, again in everyday language.

The term was coined in February 2025 by Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla. He used it for a way of working in which you rely entirely on the AI and, in effect, forget that the code even exists. Collins Dictionary chose vibe coding as its word of the year 2025.

Google distinguishes two variants. In pure vibe coding, you trust the AI completely; according to Google, this suits quick ideas and weekend projects in particular. In the responsible variant, someone checks and tests the generated code and takes responsibility for the result.

How vibe coding works

Google describes the process as a loop: you describe your goal, the AI produces a first version, you try it out and give feedback, for example: that works, but show an error message if the file is missing. You repeat this until the result is right.

Tools for beginners usually show the app taking shape in a preview right next to the chat. At the end, it can often be published on the internet with a single click so that others can use it.

The difference from traditional programming: you do not need to know a programming language, but you do need to say precisely what you want. Google points out that the quality then depends heavily on how well the AI works and how thoroughly you check the result.

How to build a small website step by step on your own computer with a so-called coding agent is covered in our article on coding agents for non-programmers. This page is about the term and what you can realistically expect.

Tools in autumn 2026

For beginners, there are services that run entirely in the browser. Two examples:

Google AI Studio: Google explicitly recommends it for beginners without programming knowledge. You describe an app in a few sentences, AI Studio generates the code and files and shows a live preview alongside. Google AI Studio is available in Germany, but according to Google you must be at least 18. For advanced users, Google lists further tools, such as the Gemini CLI, which runs in the text-based command line (the terminal), or Google Antigravity, which lets AI helpers work in a program for editing code, in the terminal and in the browser.

Lovable: the provider advertises that anyone can build websites and web apps by chatting, without technical knowledge. Getting started is free, with five build credits per day and at most 30 per month. According to its pricing page, opened from Germany, the Pro plan costs 25 euros a month including VAT for 100 credits. How many credits a request uses depends on the task: according to Lovable, turning a button grey costs 0.5 credits and adding a login feature 1.2.

There are other platforms too, such as Replit. Prices and plans change frequently in this market, so check them on the provider's site before subscribing.

Limits and risks for non-programmers

A hands-on test by the German tech magazine t3n in May 2026 shows both sides: without any programming knowledge, a small to-do app was built in about an hour. When the tasks became more complicated, the AI got stuck, and the problem could not be solved without expert knowledge.

Security matters even more. For its report of July 2026, the security company Veracode had numerous AI models solve programming tasks. The code was almost always formally correct, but in around 44 per cent of tasks it contained a known security flaw. Even the best model tested passed only 68 per cent of the security tests. Code that runs is not automatically secure.

Two incidents show what can happen. In websites generated with Lovable up to mid-April 2025, effective access rules for the database were sometimes missing, so strangers could read and change data without logging in. The US National Vulnerability Database (NVD) lists this as a vulnerability; Lovable disputes the classification, arguing that each customer is responsible for protecting the data in their own app. In July 2025, Replit's AI agent deleted a company's live database during an experiment, even though an explicit code freeze was in place. Replit then announced additional safeguards.

What this means for you: at least in the view of providers such as Lovable, you are responsible for the data in your app, even if you have never read its code.

What it is good for and what it is not

Our assessment: vibe coding is a good way to try out ideas, for example a calculator for the household budget, an invitation page for a family celebration or a prototype you want to show others. As long as no other people's personal data, payments or passwords are involved, the risk stays manageable.

Be careful as soon as an app has logins, stores other people's data or moves money. Even Google's own process includes a human expert checking the application for security, quality and correctness before it is published. For non-programmers, this means in practice: have such projects reviewed by a professional before launch, or stick to projects without sensitive data.

Simple habits help too: do not paste real customer data or passwords into the chat, save working versions along the way and do not give the AI access to data you cannot afford to lose. The Replit case shows why this matters.