Every snippet, prompt & command, in one bin.
A fast, searchable home for developer knowledge.
Developers keep their essentials scattered across editor snippets, browser bookmarks, chat threads, shell history and random folders. BitBin pulls all of it into one place: organized, tagged and a keystroke away, from the web app, a browser extension or a desktop tray app.
| Live app | bitbin.divyanshuagrahari.dev |
| Demo login | demo@bitbin.dev / 12345678 (a shared, public sandbox: it can't change its own password, name or plan, and its library is reset every day) |
| Your own account | Register with an email: a verification link arrives from noreply@bitbin.divyanshuagrahari.dev. The sending domain is new, so check your spam folder if it doesn't show up |
| Upgrading | Production runs Stripe in test mode: use card 4242 4242 4242 4242, any future date and any CVC. No money moves |
 |
 |
| An item in the drawer, with the Monaco editor | ⌘K search across titles, content, tags and collections |
 |
 |
| Settings: editor, billing, tokens, assistants, desktop app, tags, data and account | Sign in with GitHub or email |
Capture and organize
- Seven item types: snippets, prompts, commands, notes, links, files and images
- Collections: an item can belong to many, collections can be favorited and pinned, and items can be dragged onto them
- Tags with rename, merge and delete, favorites, pins, and a grid or list view remembered per browser
- Monaco code editor with language auto-detection (31 languages), and a markdown editor with GitHub-flavored preview
- Server-side search as you type (⌘ / Ctrl + K),
#tagfilters, and keyboard shortcuts for everything (N new item, C new collection, G then a letter to navigate, 1–7 for each type, ? for the full list) - A dark interface held to WCAG AA contrast, motion that respects
prefers-reduced-motion
AI helpers (Pro): tag suggestions, a description generator, "Explain this code" and a prompt optimizer, on OpenAI or any OpenAI-compatible provider, including models without a JSON mode.
Save from anywhere (Pro)
Two companion apps get things into BitBin without opening it. Both use the same token API (/api/v1) with personal access tokens that are hashed, expiring, revocable, and limited to the permissions they were created with.
| Browser extension | Desktop tray app | |
|---|---|---|
| Platform | Chrome and Edge (Manifest V3) | Windows installer; macOS and Linux from source (Electron) |
| Trigger | Ctrl + B (⌘ + B on macOS), or right-click → Save selection to BitBin | Ctrl + Alt + B (⌘ + ⌥ + B on macOS) from any app, or the tray icon |
| What it saves | The selected text, titled from the page's heading, with a link back | The clipboard (text or a screenshot), or a file you attach or drop |
| Extras | Type and language guessing, collection picker, tags, ✦ Suggest (AI tags and description) | Type guessing, collection picker, tags, ✦ Suggest, start at login, a changeable shortcut |
| Install | Download the ZIP from Settings → Browser extension and load it unpacked | Settings → Desktop app, or run it from desktop/ |
The desktop app keeps its token in the main process, encrypted with the OS keychain where one exists, and runs its windows sandboxed with no Node access. How each works: save from anywhere, save from the desktop.
Your data stays yours
- Export the whole library or one collection: JSON for everyone, and for Pro a ZIP that also holds your snippets, prompts, commands and notes as readable files plus every uploaded file
- Import either format back (ZIP imports restore the files), with a preview, duplicate skipping and original dates, in one all-or-nothing transaction
- Account deletion removes your items, files and subscription
Everything, with its limits: features.
| Free | Pro ($8 / month or $72 / year) | |
|---|---|---|
| Items / collections | 50 / 3 | Unlimited |
| Snippets, prompts, commands, notes, links | ✓ | ✓ |
| Files and images | ✓ | |
| AI helpers | ✓ | |
| Extension, desktop app and token API | ✓ | |
| Export and import | JSON | JSON and ZIP (with files) |
Limits are enforced on the server (under a row lock, so concurrent requests can't overshoot them); the UI only mirrors them.
BitBin is one Next.js 16 App Router application with no separate API server. Pages are React Server Components that read through lib/db, the only module that touches Prisma. Every UI write is a server action that checks the session, validates with Zod, applies plan and rate limits, and runs a query scoped to the signed-in user. Route handlers exist only where real HTTP is needed: auth flows, file transfer, export and ZIP import, Stripe, two crons, and the token API used by the extension and the desktop app.
flowchart LR
subgraph Clients
W[Web UI]
X[Browser extension]
D[Desktop tray app]
end
subgraph "Next.js app on Vercel"
P[Pages · RSC]
A[Server actions]
R[Route handlers]
T["/api/v1 token API"]
C[Cron routes]
L["lib/db · every query scoped by userId"]
end
W --> P & A & R
X & D --> T
P & A & R & T & C --> L
L --> DB[(Neon PostgreSQL)]
R & T & C --> S3[(Cloudflare R2)]
R --> ST[Stripe]
A & T --> AI[OpenAI-compatible API]
R --> RS[Resend]
A & R & T --> UP[(Upstash Redis · rate limits)]
VC[Vercel Cron] --> C
| Area | Choice |
|---|---|
| Framework | Next.js 16 (App Router), React 19 with the React Compiler, TypeScript 5 |
| Data | PostgreSQL (Neon) with Prisma 7 and the pg driver adapter; 10 models, 9 migrations, trigram indexes for search |
| Auth | NextAuth v5: credentials and GitHub, JWT sessions that can be revoked |
| Styling | Tailwind CSS v4 + shadcn/ui |
| Services | OpenAI (or compatible), Stripe, Cloudflare R2, Upstash Redis, Resend, Sentry |
| Clients | Chrome / Edge MV3 extension, Electron desktop app |
| Quality | Vitest, ESLint, GitHub Actions CI with a coverage floor |
More in the architecture overview, the decision records and the tech stack.
The rules are written down in the security guardrails and the security model. In short:
- Tenant isolation in code: the user id comes only from the session (or the API token), every query is scoped by it, and any id or file URL from the client is checked for ownership. Another user's row looks exactly like a missing one.
- Accounts: bcrypt (cost 12), hashed and single-use email tokens, 14-day revocable sessions, identical answers whether or not an email has an account, per-IP and per-address rate limits on every public auth endpoint, and an open-redirect-safe sign-in.
- Browser: a Content Security Policy that lets nothing third-party into a page (the code editor is served from the app's own origin, not a CDN), and cross-site checks on every cookie-authenticated route that changes state.
- API tokens: hashed, always expiring, and limited to the permissions they were created with (
collections:read,items:write,files:write,ai). - Files live in a private R2 bucket and are read only through an ownership-checked, streamed route. Every stored file, from the web, the desktop app or a ZIP import, is checked by extension, type, size and file signature; photos are re-encoded so location metadata is never stored; ZIP imports are capped while they inflate; and a weekly sweep removes files no item points at.
- Payments: the Stripe webhook verifies the raw body's signature and syncs the plan from Stripe, so retried or out-of-order events are harmless.
- Operations: security headers, Sentry with personal data stripped, scripts that refuse to touch a production database, a production dependency audit in CI (0 known vulnerabilities) and secret scanning.
Found a problem? See SECURITY.md.
| Tests | 988 unit tests across 82 files (actions, library code and every route handler), all external services mocked; 45 more for the desktop app |
| Coverage | about 85% of statements over src/actions, src/lib and src/app/api, with an 80% floor enforced in CI |
| CI | audit, lint, tests with the coverage floor and a build on every push and pull request |
| Lighthouse (production build) | accessibility 100, SEO 100, best practices 96, performance 80–95 across 12 pages |
| Concurrency | the Free-plan limits and single-use email links are covered by race tests |
Details and what is checked by hand are in testing; every figure, and how to re-measure it, is on the metrics page.
Requires Node 20+ (CI uses 22) and a PostgreSQL database (a free Neon project works).
git clone https://github.com/Divyanshu2805/bitbin.git
cd bitbin
npm install
cp .env.example .env # set DATABASE_URL and AUTH_SECRET at minimum
npm run db:migrate # create the schema
npm run db:seed # system item types + the demo account
npm run devOpen http://localhost:3000 and sign in as demo@bitbin.dev / 12345678.
.env.example only holds YOUR_… placeholders; each optional service (GitHub, Resend, Upstash, R2, Stripe, an AI provider, Sentry) switches on one area of the app, and the app runs without them. See setup and configuration.
npm run dev # dev server on http://localhost:3000
npm run lint && npm run test && npm run build # before every push (CI runs these too)
npm run test:coverage # tests plus a coverage report; fails below the floor
npm run db:migrate # schema change → new migration (never db push)
npm run db:seed # system item types + the demo accountThe full list is in commands.
src/app/ pages and route handlers (App Router)
src/actions/ server actions: every write from the UI
src/lib/ validation, plan and rate limits, shared logic, integrations, db/ (every query)
src/components/ UI: shadcn primitives, layout, items, dashboard, settings, homepage
prisma/ schema, migrations, seed and the demo library
extension/ Chrome / Edge extension (plain JS, outside the Next build)
desktop/ Electron tray app (plain CommonJS, own package.json and tests)
docs/ documentation
.github/workflows/ CI, and the desktop installer release
Live at bitbin.divyanshuagrahari.dev. Vercel builds and deploys every push to main; the database (Neon), storage (Cloudflare R2), rate limiting (Upstash) and payments (Stripe) are managed services, and two Vercel crons reset the demo account daily and sweep orphaned files weekly. Migrations are applied by hand before a deploy that needs them. GitHub Actions runs the checks in parallel, without gating the deploy.
See deployment, operations and the smoke test.
Everything lives in docs/:
| Section | Covers |
|---|---|
| Features | Everything the app does, with the plans and limits |
| Local development | Prerequisites, setup, configuration, commands, troubleshooting |
| Architecture | Layers, module map, request flows, security model, decision records |
| Data model | Tables, item types, conventions, migrations |
| API reference | Route handlers, server actions, the token API, export format, errors and rate limits |
| Browser extension · Desktop app | What they do, installing, running locally, releasing |
| Engineering practices | Conventions, guardrails, testing and CI, design system, pitfalls, definition of done |
| Project metrics | Measured quality, accessibility, security and scale figures |
| Deployment | Vercel, CI, provider callbacks, operations, smoke test |
| Contributing · Security | Workflow and checks; reporting a vulnerability |
Released under the MIT License.