OneTaskBy Tim King · Updated
XOR Cipher
Repeating-Key XOR and Single-Byte Brute Force, Ranked by How English the Output Looks
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the XOR Cipher works
This XOR cipher tool combines each byte of your input with a repeating key, the building block of many simple obfuscation schemes. Enter text or hex, give a key as text or hex, and read the result as hex or text. Switch to brute-force mode to try all 255 single-byte keys and rank them by readability.
How the XOR cipher works
XOR compares two bits and outputs 1 when they differ. Applied to bytes, data XOR key scrambles the data,
and applying the same key again restores it, because x XOR k XOR k = x. With a repeating key, byte one
uses key byte one, byte two uses key byte two, and the key wraps round when it runs out. Encryption and
decryption are the same operation.
Breaking single-byte XOR
Malware and CTF puzzles often hide strings with one repeated byte. With only 255 possible keys, each can be tried in turn. The results are scored by how many characters are common English letters and spaces, so the real plaintext usually rises to the top of the table. Paste the ciphertext as hex and choose Try every single-byte key.
Why XOR alone is weak
A short repeating key leaves patterns: the same plaintext at the same key position gives the same output, and a known fragment of plaintext reveals the key directly. Only a truly random key as long as the message, used once, is secure. That is the one-time pad, and it is rarely practical.
FAQ
Why is the output shown as hex by default?
XOR usually produces bytes outside the printable range, including control characters that would vanish or break a text box. Hex shows every byte exactly, so the result can be copied back in and decoded again. Choose Text output when you expect the result to be readable.
How do I decode a hex string with a hex key?
Set Input is to Hex, paste the bytes with or without spaces, enter the key such as 4b or de ad be ef,
set Key is to Hex, and choose Text output. Prefixes like 0x, commas and colons are ignored.
What does the Letters column mean?
It is the share of the result made of letters and spaces, a quick measure of how much it looks like English. Real text scores well above 0.8, while wrong keys usually produce scattered symbols and score much lower. Short inputs can give false leaders, so check the top few.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Text To Hex Converter
Convert text to hexadecimal bytes and back again.
Classic Ciphers
Vigenère, Beaufort, Atbash, ROT47 and rail fence, encode and decode.
ROT13 And Caesar Cipher
Encode and decode ROT13 and Caesar shift ciphers.
Hex Dump Viewer
View any file as hex and ASCII, with type detection and entropy.
.env File Checker
Lint a .env file for syntax errors, duplicates and weak secrets.