XOR cipher — encrypt and decrypt text with a repeating key

How to use the XOR cipher

1. Choose the Mode: Encrypt text or Decrypt.
2. Type the message, or paste the ciphertext, into Input.
3. Enter the Key and say whether Key is Text or Hex.
4. Pick the Ciphertext format: Hex or Base64. When decrypting, this tells the tool how to read your input.
5. Encrypting shows the Ciphertext and a warning about key length. Decrypting shows the Plaintext and the Plaintext bytes (hex).

What it does and when to use it

XOR is the building block inside almost every modern cipher, and on its own it is the simplest cipher there is. This tool is for capture-the-flag challenges, puzzle hunts, programming exercises and classroom demos where you want to see the bytes. It is also handy for decoding data that a program obscured with a fixed XOR key, which some old games and malware do.

Treat it like other classical ciphers: fun and instructive, but not protection. For other hand ciphers try the Vigenère autokey cipher, which adds letters instead of XORing bits, or the keyword substitution cipher. To look at the raw bytes of a message first, use the hex encoder.

How it works

The text is turned into UTF-8 bytes. Each byte is XORed with a key byte, and the key repeats from the start whenever it runs out: byte 0 uses key byte 0, byte 1 uses key byte 1, and so on, wrapping around. XOR compares bits and returns 1 where they differ, so 0x48 XOR 0x4B = 0x03.

When encrypting, the tool shows a warning. If the key has fewer bytes than the message (both counted as UTF-8 bytes), it says a repeating key is easy to break. Otherwise it reminds you that only a random, never-reused key as long as the message is secure.

Worked examples

Hello with key K. H is 0x48 and K is 0x4B, giving 0x03. Repeating K over all five letters gives 032e272724.

Back again. Decrypt mode with 032e272724 and key K returns Hello, with plaintext bytes 48656c6c6f.

Hex key, Base64 output. Key 2a as Hex (one byte, 0x2A) and Base64 format turn Hello into Yk9GRkU=.

Why short keys fail. Try decrypting 032e272724 with the wrong key J. You get Idmmn: wrong, but clearly close, because each byte is only one bit off. Worse, if an attacker guesses the first letter is H, then 0x03 XOR 0x48 = 0x4B reveals the key K at once.

Limits and tips

• An empty key or empty input gives a prompt instead of a result.
• Hex keys must have an even number of digits.
• Decrypted bytes that are not valid UTF-8 appear as replacement characters; the hex line always shows the exact bytes.