XOR Cipher

How to use XOR Cipher

1. Pick Encrypt (text → hex) or Decrypt (hex → text).
2. Enter a text key. Its UTF-8 bytes repeat across the message.
3. Enter text to encrypt, or paste hex ciphertext to decrypt. Hex input ignores whitespace and requires complete byte pairs.
4. Read or copy Result. If decrypted bytes are not valid UTF-8, Result contains hex and a warning explains why.

Encryption uses UTF-8 bytes for both text and key. Hex output uses lowercase letters and 2 digits per byte, preserving leading zeroes. All messages below are labeled assumed example; their results are calculated from the same codec as the tool.

XOR truth table

Exclusive OR sets a result bit when the input bits differ and clears it when they match. Apply this rule independently to every bit in a byte.

Worked example: HELLO with key KEY

assumed example: message HELLO, key KEY. These ASCII characters each occupy a UTF-8 byte. The table shows 8-bit groups and the repeating key aligned with the message.

Join the result hex pairs without spaces: 030015070a. Hex is a representation of these bytes; it does not add secrecy.

How a short key repeats

assumed example: HELLO WORLD is 11 bytes; KEY is 3 bytes. Restart the key as often as needed and stop when the message ends.

Repetition uses UTF-8 byte positions, not displayed character positions. Non-ASCII letters can occupy multiple bytes. A longer typed password still does not turn this repeating-key operation into a secure encryption scheme.

Decrypting and why the same key works

XOR twice cancels: a ^ k ^ k = a. A bit toggled by the key toggles back on the next application; a bit left unchanged stays unchanged. The key bytes must start at the same position.

assumed example: decrypt 030015070a with KEY to recover HELLO. The recovered bytes are 48454c4c4f in hex. Select Decrypt and paste the ciphertext; entering the hex digits in Encrypt would encrypt those literal characters instead.

Wrong key and what the tool shows

A wrong key does not always cause a text-decoding error. Valid UTF-8 is a format check, not proof of the correct key or an authentic message.

Why key reuse and short keys are weak

The same key stream cancels between messages

For messages encrypted with the same aligned key stream, Ca ^ Cb = (Pa ^ K) ^ (Pb ^ K) = Pa ^ Pb. This reveals a relationship between plaintexts, even without knowing the key. It does not automatically reveal both messages.

assumed example: HELLO with key KEY → 030015070a.

assumed example: WORLD with key KEY → 1c0a0b0701.

Ciphertext XOR: 030015070a ^ 1c0a0b0701 = 1f0a1e000b

Plaintext XOR (hex): 1f0a1e000b

A known plaintext guess reveals key bytes

assumed example: GO HOME with key SUN gives 141a6e1b1a0316. Suppose an observer guesses HOME at byte offset 3, counting from zero. XOR that guess with the corresponding ciphertext segment:

1b1a0316 ^ 484f4d45 = 53554e53 (SUNS)

If the guess and position are correct, these are the key-stream bytes at those positions. In this assumed example they span the repeating key and its restart. An incorrect guess yields only a candidate key segment.

A single-byte key has 256 possibilities

An unrestricted 8-bit key byte has 256 possible values. Trying them all is a small search, though choosing the intended plaintext still requires context. This count describes raw byte keys; the tool accepts a UTF-8 text key, so arbitrary byte values cannot all be entered as single characters.

assumed example: HELLO with text key K (hex 4b) gives 030e070704. Longer repeating keys reuse the same byte at regularly spaced positions, exposing patterns that can be analyzed together.

Where XOR genuinely appears

• Stream ciphers combine plaintext with a generated keystream using XOR. Their security depends on the keystream construction and correct use, not on the XOR operation alone.
• A one-time pad uses a truly random, secret key independent of the message, as long as the message and used only once. Under those conditions it provides perfect secrecy. A repeated text key does not meet them.
• Parity calculations and simple XOR checksums combine bits to help detect some errors. They do not provide cryptographic authentication.

A short history

Gilbert Vernam’s 1919 patent US 1,310,719, “Secret signaling system,” describes a stream-cipher machine that combines telegraph message signals with a key tape and reverses the combination at the receiver. See Vernam’s patent on Google Patents.

Claude Shannon’s 1949 paper “Communication Theory of Secrecy Systems” formalized perfect secrecy and proved that the one-time pad achieves it under its random, single-use key assumptions. See Shannon’s paper, hosted by Wesleyan University. This result does not apply to a short repeating key.