XOR Cipher

What this tool does

XOR Cipher applies a bitwise XOR between the UTF-8 bytes of your input and a repeating key, producing binary output shown as hex or Base64 (since the result usually is not valid text). Decoding reverses the same XOR operation on hex or Base64 input with the same key. Plain repeating-key XOR is a classic teaching cipher, not secure encryption — it is vulnerable to known-plaintext and frequency attacks.

XOR (exclusive or) is the building block behind many real stream ciphers, because XOR-ing the same two values twice always returns the original value, which makes it trivially reversible with just a key. But using XOR with a short, repeating key on its own, as this tool does, is a classic introductory cryptography exercise, not something that provides real security.

This tool XORs the UTF-8 bytes of your input text against the UTF-8 bytes of a key, repeating the key as many times as needed to cover the whole message. Because the XOR result is arbitrary binary data rather than valid text in general, it’s shown as hex or Base64; decoding reverses the exact same operation on that hex or Base64 input using the same key.

How to use XOR Cipher

1. Choose Encode text → XOR output or Decode XOR output → text.
2. Enter the Text / encoded data to process.
3. Enter the Key to XOR with.
4. Choose the Output / input format: Hex or Base64.
5. Press Run to see the result.

Tips for better results

• The exact same key must be used to decode a message encoded with it; XOR is symmetric, so encoding and decoding are literally the same operation applied twice.
• Repeating-key XOR is vulnerable to known-plaintext attacks (if any part of the plaintext is guessed, the corresponding key bytes are instantly revealed) and to frequency analysis on longer messages; never use this for anything that needs real confidentiality.
• If decoding fails with an invalid UTF-8 error, double-check the key and the chosen format (hex vs Base64) both exactly match what was used to encode the message.
• A key the same length as the message, used only once (a one-time pad), is the one case where XOR-based encryption is theoretically unbreakable — but that is a fundamentally different, much stricter setup than the short repeating key used here.

Common use cases

• Learning how XOR-based stream ciphers work as an introduction to symmetric cryptography.
• Demonstrating why repeating-key XOR is breakable, as a hands-on cryptography teaching exercise.
• Lightly obscuring non-sensitive text or data for a puzzle, CTF challenge or game mechanic.
• Understanding the relationship between XOR, one-time pads and real stream ciphers used in practice.

Common mistakes to avoid

• Using this for anything requiring genuine confidentiality; repeating-key XOR is a teaching tool, not secure encryption, and is readily breakable with known techniques.
• Mismatching the format (hex vs Base64) between encoding and decoding, which produces a decode error rather than silently wrong output, since the byte parsing itself fails.
• Assuming a longer key always means more security; a short repeating key is still vulnerable regardless of its length, since the repetition itself is the weakness, not just the key size.