XOR any text or hex payload against a repeating key and read the result as hex, Base64, or UTF-8 text. The key repeats across the data, an oversized key is flagged rather than silently truncated, and bytes that are not valid UTF-8 are shown as οΏ½ with a warning telling you to switch to hex. Everything runs in your browser. Be honest about what this is: a repeating-key XOR is trivially breakable and belongs in CTFs, reverse engineering, and obfuscation β for actual encryption use AES Encrypt / Decrypt. Related tools: ROT13 & Caesar Cipher, Morse Code Translator, and Base64 Encode / Decode.
XOR Cipher
XOR text or hex against a repeating key, with hex, Base64, or text output
Input is
Key is
Output as
The key repeats over the data, so byte n is XORed with key byte n mod key length.
Result will appear hereβ¦XOR is its own inverse: run the output back through with the same key to recover the original bytes. That also means a repeating-key XOR is trivially breakable β it is for CTFs, obfuscation and learning, not for protecting anything. For real encryption use AES-256-GCM.
Frequently asked questions
Is a repeating-key XOR secure?
No, and it is not close. Once the key repeats, the ciphertext leaks structure: guess the key length (Hamming-distance or index-of-coincidence tests do this automatically), split the bytes into that many columns, and each column is a single-byte XOR you can solve by letter frequency in milliseconds. A known or guessed fragment of plaintext breaks it instantly by crib dragging. This tool exists for CTF challenges, firmware and malware analysis, simple obfuscation, and learning how XOR works β not for protecting anything. Real encryption needs a proper cipher: use the AES Encrypt / Decrypt tool, which uses AES-256-GCM with a PBKDF2-derived key. (A one-time pad β a truly random key at least as long as the message, never reused β is the one XOR construction that is secure, and it is not what a short repeating key gives you.)
Why does XORing the output a second time give me my text back?
Because XOR is its own inverse: (a XOR k) XOR k = a. Encoding and decoding are the same operation with the same key, which is why there is no encrypt/decrypt switch. Press "Use as input" to feed the result straight back in β set the input mode to match (hex output becomes hex input) and pick Text output, and the original comes back.
What happens if my key is longer or shorter than the data?
A short key simply repeats: byte n of the data is XORed with byte n mod (key length) of the key. A key longer than the data is truncated β only the leading bytes are used, and the tool warns you when that happens so you know the tail of the key had no effect. An empty key is an error rather than a silent pass-through, since XORing with nothing would hand back the plaintext unchanged.
Why is the text output full of οΏ½ characters?
XOR produces arbitrary bytes, and most byte sequences are not valid UTF-8. When you ask for Text output, the bytes are decoded as UTF-8 and anything invalid is shown as U+FFFD (οΏ½) β which means those bytes cannot be copied back out faithfully. Switch the output to Hex or Base64 to see and copy the exact bytes. The tool counts the replacement characters and warns you when this happens. Hex input is tolerant of 0x prefixes, spaces, colons, and newlines, but rejects odd digit counts and non-hex characters. Everything is computed in your browser; nothing is uploaded.
Get weekly dev tools and tips