XOR Cipher

What this tool is used for

• Recovering plaintext from a single-byte XOR obfuscation found in malware or a CTF challenge.
• Demonstrating why XOR is its own inverse and what that property buys and costs.
• Checking whether a suspicious blob is XORed text by brute-forcing all 256 single-byte keys.
• Building a fixture for a routine that has to handle XOR-obfuscated input.
• Showing why a repeating key leaks structure that a one-time key would not.

Frequently Asked Questions

Why is the key never in the shared link?

Because it is the whole secret. This page keeps the ciphertext URL-bound so a link reproduces your work, but the key lives in memory only — a shareable link carrying both would hand over the message and the means to read it in the same string.

Why is the output hex even when I typed text?

Because XOR produces arbitrary bytes, most of which are not printable characters. Showing them as text would silently mangle anything outside the printable range, so the result is always hex. To read a decrypted message, run that hex through a hex-to-text converter.

How does the brute-force mode actually work?

It tries all 256 single-byte keys, counts how many result bytes fall in printable ASCII (32–126), and ranks by that score. English text scores near 100%, so the plaintext usually surfaces at the top. Note that key 0x00 returns the input untouched, so it wins whenever the input was already printable.

Is XOR encryption ever actually secure?

Only as a one-time pad: a key of truly random bytes, at least as long as the message, never reused. That is information-theoretically unbreakable. Every property that makes it secure is also what makes it impractical, which is why real systems use AES or ChaCha20 instead.

What breaks a repeating-key XOR?

Reuse. Because the key cycles, bytes the same distance apart are encrypted identically, so the key length falls out of repeated patterns or of minimising the Hamming distance between candidate blocks. Once the length is known, each position collapses to a single-byte XOR — exactly what the brute-force tab solves.

Common errors and gotchas

• Reusing a short key across a long message, which makes the period recoverable and the plaintext along with it.
• Expecting text output. XOR produces arbitrary bytes, which is why the result is shown as hex rather than characters.
• Confusing obfuscation with encryption. XOR under a guessable key stops nobody who is actually looking.
• Assuming a successful brute force means the key was one byte. Longer keys survive that search entirely.
• Sharing a link and expecting the key to travel with it, when keeping the key out of the URL is the whole point.