Apply XOR cipher operations with single-byte and multi-byte keys with hex input/output and key analysis.
This tool XORs input against a key you supply as text or hex, byte by byte, repeating a short key across a longer message the way a stream cipher does. You choose whether input and key are plain text or hex, and whether output comes back as hex or raw bytes. Its key-analysis mode works the other direction: given only ciphertext, it tries candidate single-byte keys and ranks the results by how closely the recovered text resembles readable content. The most common mistake is treating a matched key as proof the plaintext is correct - a wrong key can still produce readable-looking fragments by chance, especially on short ciphertexts.
A concrete input and expected output from the current implementation.
Input
Plaintext: HELLO, Key (hex, single-byte): 2A, mode: encrypt, output as hex
Expected output
626f666665
Each ASCII byte of HELLO (48 45 4C 4C 4F) is XORed with the repeated key byte 2A, giving 62 6F 66 66 65; XORing that hex with the same key returns HELLO.
For multi-byte keys the tool cycles the key across the full input, XORing input byte i with key byte (i mod key length). A single-byte key is the special case where every byte is masked identically. XOR is its own inverse, so running the tool a second time with the same key and mode reversed returns the original input exactly.
When you provide ciphertext without a key, the analysis mode XORs it against all 256 possible single-byte values and scores each result by how much it resembles readable text - for example the proportion of printable ASCII characters - then surfaces the top-scoring candidates for you to inspect rather than declaring one definitive answer.
No. XOR with a repeating key is easily broken once an attacker has a moderate amount of ciphertext or can guess part of the plaintext. Use it for obfuscation, teaching, or CTF-style puzzles only, never to protect real secrets.
Short or ambiguous ciphertexts can score more than one candidate similarly, especially since single-byte keys only span 256 possibilities. Check the top few results yourself instead of trusting the single highest score, particularly on inputs under a few dozen bytes.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.