XOR cipher
Enter a message and a key, and every byte of the message is XORed with the next byte of the key, repeating the key as needed. Apply the same key to the result to get the message back — the swap button does it for you.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Enter the message and choose its format: text, hex or Base64.
- Enter the key as text or hex.
- Choose how to show the result. Hex is the safe default.
- To reverse, press “Use result as input”: the result moves to the input, the formats swap, and with the same key you see the original.
How it works
The message and the key are turned into bytes (text as UTF-8). Byte i of the result is message byte i XOR key byte (i mod key length). Because (m ⊕ k) ⊕ k = m, the same key undoes the operation.
Example
Hello XOR the key key:
| Byte |
H 48 |
e 65 |
l 6c |
l 6c |
o 6f |
| Key |
k 6b |
e 65 |
y 79 |
k 6b |
e 65 |
| XOR |
23 |
00 |
15 |
07 |
0a |
The result is 230015070a in hex, IwAVBwo= in Base64. Notice the 00: wherever the message and key have the same character, the result shows a zero byte, which is one of the patterns that give a repeating key away.
Tips
- Use the one-time pad tool if you need a random key as long as the message.
- Hex keys allow any byte values, not only printable characters.
- XOR is used inside real ciphers (stream ciphers, AES modes) together with a key stream that never repeats; on its own it only hides data from a casual look.
Frequently asked questions
How does XOR encryption work?
XOR compares two bits and gives 1 when they differ. XORing a byte with a key byte flips the bits where the key has 1s; XORing again with the same key flips them back. That is why one operation both encrypts and decrypts.
Is XOR with a repeating key secure?
No. A short repeating key is easy to break: known text, repeated patterns or simple statistics reveal it. XOR is only unbreakable as a one-time pad, with a truly random key as long as the message that is never reused.
Why is the output hex by default?
XOR often produces bytes that are not printable characters or valid UTF-8. Hex and Base64 show any bytes safely. Text output works when the result happens to be valid text, for example when you decrypt.
How do I decrypt?
Put the encrypted hex or Base64 into the input, choose that format, enter the same key and choose text output. The swap button moves the result into the input and switches the formats in one click.
Is the text taken as ASCII or UTF-8?
UTF-8. ASCII characters are one byte each; accented letters, Cyrillic and emoji are two to four bytes, and each byte is XORed separately.