⊕ XOR cipher online

How to use it

Paste your data into the top field. It can be plain text, hex bytes (00 1e 00 25, with or without spaces, 0x is fine) or Base64. In “Auto” the tool guesses the format and says under the field what it found and how many bytes that makes. If it guesses wrong, pick the format yourself.

The key is typed as text or hex. Text becomes UTF-8 bytes: one byte per Latin letter, two per Cyrillic letter. If the key is shorter than the data, it repeats round and round. The result can be shown as text, hex or Base64. The strip above the result shows the first bytes: the data byte, the key byte, and what XOR makes of them.

XOR undoes itself: encrypt the result with the same key again and the original comes back. “Output → input” moves the bytes up so you can check.

Known-plaintext attack

If you know how the message starts, you get the key without guessing: cipher ⊕ plaintext = key. Type the known part and the tool shows the key bytes underneath. A repeating key gives itself away: the bytes start over, and where they do tells you the key length. “Use this key” takes what it found (as text if the bytes read as text, otherwise as hex) and decrypts the whole message.

Real ciphers fell this way: telegrams had standard headers, greetings and signatures. At Bletchley Park such guesses were called “cribs”.

A single-byte key

If every byte was XORed with the same single byte, there are just 256 possibilities. The tool tries them all and ranks them by how much the result looks like text. It’s the classic warm-up in cryptography puzzles and capture-the-flag contests.

FAQ

What is XOR?

Exclusive or: the result bit is 1 when the input bits differ, and 0 when they match. A 1 in the key flips the data bit; a 0 leaves it alone. More in the lesson on XOR and the one-time pad.

Is a XOR cipher secure?

With a short repeating key, no: it falls to a known piece of plaintext or to letter statistics. With a key of truly random bytes as long as the message, used once, it’s a one-time pad, and it can’t be broken at all. For everyday secrets, use AES password encryption.

Why does the output have “�” in it?

The bytes after XOR aren’t valid UTF-8: either the key is wrong or the data is binary. Switch the output to hex.

Where does my data go?

Nowhere. Everything is computed in your browser.