What is XOR encryption?
XOR (exclusive OR) is the simplest bitwise cipher: each byte of the message is combined with the corresponding byte of a repeating key using the XOR operation. Because XOR is its own inverse, the same function both encrypts and decrypts — apply the key once to encrypt, apply it again to get back the original. It is fast and easy to understand, making it a common teaching example. However, it is not secure for protecting real data: with a short key and enough ciphertext, the key can be recovered through frequency analysis. Use AES-256 for anything that needs genuine confidentiality.
How to use this tool
- 1 Enter a key in the XOR Key field. Check "Key is hex" if your key is in hexadecimal.
- 2 Type or paste your plaintext (or hex bytes) in the Input panel.
- 3 The output updates live. By default the result is shown as hex bytes.
- 4 Click the swap button (↔) to move the output back to the input for decryption — XOR is symmetric.
- 5 Switch to Binary view to see exactly which bits are toggled in each byte.
Frequently asked questions
Is XOR encryption secure?
No. XOR with a short repeating key is trivially breakable — an attacker can recover the key from a small amount of ciphertext using frequency analysis. Use it only for learning or non-sensitive obfuscation. For real encryption, use AES-256-GCM.
Why does decryption look identical to encryption?
Because XOR is its own inverse: A XOR B XOR B = A. Applying the same key twice restores the original data, so the encrypt and decrypt operations are the same function.
What happens when the key is shorter than the message?
The key is repeated (cycled) to match the message length. This is called a repeating-key XOR and is the classic Vigenère-like weakness that makes it easy to crack.
What is the Random key button doing?
It generates 8 cryptographically random bytes using crypto.getRandomValues and fills the key field in hex format. Even a random key does not make XOR secure — use it to explore, not to protect data.
Can I use this to decrypt something I encrypted elsewhere?
Yes, as long as you know the original key and the same encoding was used. Enter the ciphertext as hex (check "Hex input") and the original key, then uncheck "Hex output" to read the plaintext.