One-Time Pad

How to Use the One-Time Pad

1. 1. Get a pad. Press Generate a random pad and choose a length at least as long as your message. The tool uses your browser's cryptographically secure random number generator, and only when you press the button. The pad shown at first is a textbook example, not a secret.
2. 2. Encrypt. Type the message. Only the letters A–Z are used; spaces, digits and punctuation are dropped and accents are folded to plain letters. The cipher text appears in groups of five.
3. 3. Decrypt. Switch to Decode, paste the cipher text and use the same pad from the same starting letter. Each pad letter is subtracted instead of added.
4. 4. Move on. After each message, press the button to start the next at the first unused pad letter. A pad letter used once must never be used again.

How the One-Time Pad Works

Number the alphabet from A = 0 to Z = 25. To encrypt, add each pad letter's number to the message letter's number and subtract 26 if the total reaches 26 — arithmetic modulo 26, like a Caesar shift whose size changes with every letter. To decrypt, subtract the pad number and add 26 if the result goes below zero.

H E L L O   message   7  4 11 11 14
X M C K L   pad      23 12  2 10 11
= E Q N V Z   sum     30 16 13 21 25  (30 − 26 = 4)

The pad is secret, random, at least as long as the message and used for one message only. If all four hold, the cipher text carries no information about the message except its length. Claude Shannon proved this in 1949 and called it perfect secrecy. To see why, take the cipher text EQNVZ. Under the pad TQURI it decrypts to LATER, and under XMCKL to HELLO. Every five-letter word is equally possible, because some pad produces it, and no pad is more likely than another.

The idea has a short history. Frank Miller described a one-time pad for telegraph codes in 1882. Gilbert Vernam of AT&T built a teleprinter version in 1917 that combined the message with a punched-tape key, which is what the XOR cipher does on bits, and Joseph Mauborgne of the US Army Signal Corps proposed that the key tape be random and never repeated.

Why Reusing a Pad Breaks It

Suppose two messages are enciphered with the same pad letters. Subtract one cipher text from the other and the pad cancels: (P₁ + K) − (P₂ + K) = P₁ − P₂. What remains is the difference between two pieces of ordinary language, and that has patterns. Guess a word that might appear in one message, subtract it from the difference at each position, and wherever the guess is right a readable fragment of the other message appears. This is called crib dragging.

Tick Show what goes wrong when a pad is reused to try it. With the default messages, the guess HELLO placed at position 1 reads WORLD in the second message. This is not a thought experiment. In the Venona project, US codebreakers worked on Soviet messages enciphered with one-time pads whose pages had been duplicated during a production rush in 1942. Starting in 1943 they collected the traffic, and over the following decades they read parts of thousands of messages. Venona was declassified by the NSA in 1995.

A Teaching Aid, Not a Messaging Tool

• The pad appears on your screen and can be copied. A real pad must exist in two places only and be destroyed after use. Pasting it into chat, mail or a notes app defeats the purpose.
• Browser randomness is not a physical source. The generator is a good cryptographic one, but a pad from any computer is pseudorandom, so the guarantee of perfect secrecy is theoretical here.
• The cipher gives no authentication. An attacker who flips cipher letters changes your message in predictable ways without knowing the pad.
• Sharing the pad is the hard part. You need a secure channel as large as all the messages you will ever send, which is why the pad is used only by a few people with a pre-arranged supply.

For anything private, use an end-to-end encrypted messenger instead. Use this page to understand why the one-time pad is the standard of theoretical security, and why practical systems replace its pad with a short key that expands into a long key stream.

Frequently Asked Questions

What is a one-time pad?

A cipher in which each message letter is combined with a letter of a random key that is as long as the message and used only once. Added modulo 26 for letters, or XORed for bits, it gives perfect secrecy when the key is truly random and never reused.

Why is the one-time pad unbreakable?

Because every pad is equally likely, every plain text of the same length is equally likely too. The cipher text EQNVZ could be HELLO or LATER or any other five-letter string, and nothing in it favours one. Shannon proved that this property needs a key at least as long as the message.

What happens if you reuse a one-time pad?

It becomes breakable. Subtracting two cipher texts made with the same pad cancels the pad and leaves the difference of the two messages, which an analyst can attack by guessing words. The Soviet reuse of pad pages is what allowed Venona to read messages that were otherwise secure.

How do you generate a truly random pad?

Real systems use physical sources such as radioactive decay or electronic noise. This tool uses your browser's cryptographically secure generator with unbiased letter selection, which is excellent for demonstration but pseudorandom, so call it a teaching pad rather than a theoretically perfect one.

Can I use this tool for real secret messages?

No. The pad is shown on screen and may sit in your clipboard, and you would still need a safe way to give it to the reader. Use an audited end-to-end encrypted messenger for private communication.

What is the difference between a one-time pad and a Vigenère cipher?

Both add key letters to message letters modulo 26. A Vigenère key is short and repeats, which lets analysts find its length and solve each position like a Caesar shift. A one-time pad key never repeats and is random, so no such pattern exists.