XOR Cipher

14 bytes

How to Use the XOR Cipher

1. 1. Enter the message and the key. The key can be ordinary text or hex bytes such as 2a 5f. It is repeated along the message, so a key shorter than the message works.
2. 2. Choose how the cipher text is shown. The result is bytes, most of which are not printable characters, so it appears as hex or as Base64.
3. 3. Encode, then decode. Encode turns text into cipher text. To go back, paste the hex or Base64 into Decode mode with the same key, or use Swap. The same key reverses the operation because XOR undoes itself.
4. 4. Read the working. The table shows the first bytes in binary: the input byte, the key byte and the XOR result.

How XOR Encryption Works

XOR, short for exclusive or and written ⊕, compares two bits and gives 1 when they differ and 0 when they are the same. A computer stores text as bytes, eight bits each, and a XOR cipher combines every byte of the message with a byte of the key. This tool reads text as UTF-8, so a plain letter is one byte, an accented letter two and an emoji four.

Take the first letter of the sample message, A (hex 41), and the first letter of the key key, k (hex 6b). Lining the bits up:

A  01000001
k  01101011
⊕  00101010  (hex 2a)

Doing this for every byte, with the key repeating as k e y k e y …, turns Attack at dawn into the hex bytes 2a 11 0d 0a 06 12 4b 04 0d 4b 01 18 1c 0b, or KhENCgYSSwQNSwEYHAs= in Base64. To decrypt, apply the same key again. Because (a ⊕ k) ⊕ k = a, XOR is its own inverse, so there is one operation for both directions.

Why the output is hex or Base64

Encrypted bytes include values that are control codes or invalid in UTF-8, so showing them as characters would lose data when you copy and paste. Hex writes each byte as two digits; Base64 packs three bytes into four characters and is shorter. Both can be turned back into the exact bytes. If you need those conversions on their own, the Text Encoder & Decoder and Text to Hex Converter do them.

Why a Short XOR Key Is Weak

The message and the key leak into each other. If you know any part of the plain text, XOR it with the cipher text and the key appears: plain ⊕ cipher = key. Messages often start with predictable words, so a repeating key rarely survives.

• A one-byte key has only 256 values. The Try every single-byte key option in Decode mode tries all of them and lists the ones that give readable text.
• A longer repeating key is a Vigenère cipher on bytes. Guess the key length by comparing the bit differences between blocks of cipher text, then solve each key byte as a one-byte problem, using the fact that the most common byte in English text is usually a space.
• A key as long as the message and used once is the one-time pad, the single form of XOR encryption that is provably unbreakable. Its key must be random, secret and never reused.

XOR is still everywhere in real cryptography, but never with a short repeating key. Stream ciphers and counter-mode block ciphers generate a long pseudorandom key stream and XOR it with the data, which is the same structure with a far better key. Treat this tool as a way to see the operation, not as protection for anything private.

Frequently Asked Questions

What is a XOR cipher?

A cipher that combines each byte of the message with a byte of a key using the exclusive-or operation. The key is repeated if it is shorter than the message. Applying the same key a second time restores the original.

How do you decrypt a XOR cipher?

XOR the cipher text with the same key. In this tool, choose Decode, paste the hex or Base64, and enter the key in the same form used to encode. If you do not know the key, try the single-byte key search, or XOR a known piece of plain text against the cipher text to recover the key.

Is XOR encryption secure?

Not with a short, reused key. Known text reveals the key at once, and one- or few-byte keys fall to simple frequency analysis. It is secure only as a one-time pad: a truly random key as long as the message, used once.

Why does my decoded text show strange characters?

The key or format is not the one used to encode. Even one wrong key byte garbles the bytes it touches, and XOR results are often not valid UTF-8. Check that the key is text or hex as you entered it, and that the cipher text format matches.

What is the difference between XOR and the one-time pad?

The one-time pad is a XOR cipher with a random key as long as the message that is never used again. A normal XOR cipher repeats a short key, which is what makes it breakable. The pad is shown in its letters-only form on the One-Time Pad page.

Does the tool work on non-English text and emoji?

Yes. Text is converted to UTF-8 bytes before the XOR, so any character works, and decoding turns the bytes back into the same text. Accented letters take two bytes and emoji four, which you will see as extra rows in the working table.