A little help goes a long way. Find a tool/

Security

XOR Cipher

Free XOR cipher tool. Encrypt text with a text or hex key into hex or base64, and decrypt ciphertext back to text — XOR is self-inverse, so one operation does both.

YOUR WORKSPACEFree to use. No sign-up.
—
Enter text and a key, then press Run XOR.

Deep dive guides

A LITTLE CONTEXT · 4 MIN READThe XOR Cipher: One Operation, Self-Inverse
All 1 related guides

How xor cipher works

XOR (exclusive OR) is the simplest cipher there is: each byte of the message is paired with a byte of the key and combined with the bitwise XOR operation, which outputs 1 when the two input bits differ. The magic property is self-inverse — anything XORed with the same value twice comes back unchanged — so encryption and decryption are the same operation, and this tool runs in both directions.

The key repeats across the message (repeating-key XOR): a key of length 4 is applied to bytes 1, 5, 9... and so on. Text keys are encoded as UTF-8 bytes; you can also paste a key as hex for byte-exact control, which is how CTF challenges usually specify keys. Encrypted output is shown as hex or base64 — both are safe ways to represent the arbitrary bytes XOR produces, which rarely form printable text.

This is a classic teaching cipher and CTF staple, not real encryption: reusing a key across messages lets an attacker XOR two ciphertexts together and cancel the key out, and statistical attacks recover short keys quickly. Real systems build on the same XOR primitive but with keys that never repeat (stream ciphers like ChaCha20) — same operation, vastly better key discipline. Everything runs client-side.

Frequently asked questions

Why is the same tool used to encrypt and decrypt?
Because XOR is its own inverse: (message XOR key) XOR key = message. Encrypting twice with the same key restores the original, so the tool only needs one operation, selected by the direction dropdown.
What is the difference between a text key and a hex key?
A text key is converted to bytes using UTF-8 — the key hello is the five bytes 68 65 6c 6c 6f. A hex key is read directly as bytes: 68656c6c6f is the same key written in hex. Use hex when a challenge specifies exact bytes; use text for convenience.
Why is the output hex or base64 instead of readable text?
XOR treats the message as raw bytes, so encrypted bytes are arbitrary values from 0 to 255 — most are not printable characters. Hex (two characters per byte) and base64 (four characters per three bytes) are standard lossless ways to write arbitrary bytes as text.
What does key repeats mean for short keys?
A one-byte key XORs every byte of the message with the same value; a four-byte key cycles through four values in order. The shorter the key, the more often it repeats, and repetition is what statistical attacks exploit — longer keys are correspondingly harder to break by hand.
Is XOR encryption secure?
Not as shown here. Repeating-key XOR falls to frequency analysis and key-reuse attacks; it is used in puzzles and CTFs to teach byte-level thinking. Real ciphers use the XOR operation inside stronger constructions — a one-time pad (a truly random key as long as the message, never reused) is the only XOR scheme with provable security, and it is impractical for most uses.

Related tools

Security

Caesar Shift Detector

Break a Caesar cipher: all 25 shifts tried and scored for English-ness, best first.

 Security

Base32 Encoder & Decoder

Encode text to Base32 (RFC 4648) or decode Base32 back to text instantly.

 Security

Base64 Batch

Base64-encode or decode a whole list of strings in one click.