XOR Encryption Online
Apply a repeating-key XOR transform to UTF-8 text and exchange the reversible ciphertext as validated hex or Base64, entirely in your browser.
Privacy: your files never leave your device. All processing happens locally in your browser.
How to use
- 1.Choose encrypt, enter plaintext plus the exact repeating key, and run the local XOR transform.
- 2.Copy the primary hex or Base64 result and tell the recipient which representation was used.
- 3.To recover text, select decrypt, choose the matching format, paste ciphertext and enter the identical key.
About XOR Encryption Online
XOR Encryption Online applies a repeating-key exclusive OR operation to UTF-8 bytes. Enter plaintext and a key to produce the same ciphertext in hexadecimal and Base64, or select decrypt mode to recover text from either representation. Everything runs in the browser; the page does not upload the message, key or output.
The convention is deliberately explicit. Both plaintext and key are encoded as UTF-8. Each plaintext byte is combined with the corresponding key byte using XOR, and the key begins again when the input is longer than the key. This is often called repeating-key XOR. Two users must follow exactly the same byte encoding and key repetition rule to obtain the same result.
Hex and Base64 are only representations of the resulting bytes. Hex writes two hexadecimal digits per byte and is convenient for inspection. Base64 is shorter and easier to carry through text fields. Switching the output format does not change the XOR ciphertext itself. Encryption displays both forms so you can use whichever a receiving system expects.
Decrypt mode parses the selected representation strictly. Hex must contain complete byte pairs and only hexadecimal digits, although whitespace is ignored. Base64 must use the standard alphabet with correct padding. The parsed bytes are XORed with the UTF-8 key, then decoded with fatal UTF-8 validation. A wrong key commonly produces invalid text and therefore a visible error instead of silent replacement characters.
A successful UTF-8 decode does not prove that the key is correct. Some wrong byte sequences happen to form valid characters, especially with short ASCII messages. Confirm meaningful plaintext through an independent channel. The tool has no checksum, authentication tag, salt, nonce, password stretching or key-management system.
Repeating-key XOR is not modern encryption. Repetition exposes patterns, known plaintext can reveal key bytes, short keys are especially weak, and attackers can alter ciphertext without detection. Do not use this page to protect passwords, personal records, payment details, private keys or any information where confidentiality or integrity matters. Use a reviewed authenticated-encryption system for sensitive data.
The key field is treated as text rather than a hexadecimal key. For example, the key word key becomes the UTF-8 bytes 6B 65 79. Entering 6B6579 would instead use the six visible characters in that string. This distinction is important when comparing results from command-line programs or programming libraries.
Unicode text can occupy several bytes per visible character. Emoji and many non-Latin scripts therefore consume multiple key positions. This implementation XORs bytes, not JavaScript UTF-16 code units and not user-perceived grapheme clusters. The fixed definition makes mixed-language results reproducible across standards-compliant browsers.
Input and key data are limited to 100,000 bytes to keep conversion, rendering and copying responsive. Whitespace inside plaintext is significant. Whitespace inside encoded ciphertext is ignored for convenient line wrapping, but no other cleanup or guessing is performed. An empty input or empty key is rejected.
Isolated tests cover fixed ASCII and Unicode vectors, exact hexadecimal and Base64 output, both decryption formats, malformed encodings, empty keys and invalid UTF-8 after decryption. A Unicode round trip additionally confirms that byte boundaries survive encryption and decryption. These tests establish this page's declared convention, not cryptographic security.
To exchange a harmless puzzle, agree on the exact key text, encrypt the message and send either ciphertext form. The recipient selects the same representation, enters the identical key including case and spaces, and decrypts. If the result fails, compare the key's exact characters and confirm that the transport did not trim or rewrite the ciphertext.
Treat the result as reversible obfuscation for education, interoperability checks and capture-the-flag exercises. The warning is part of the product behavior: a familiar encryption label must not imply protection that repeating-key XOR cannot provide. For real security, choose an authenticated cipher and a vetted application that handles keys safely.
Methodology & sources
Plaintext and key are encoded with TextEncoder. Every input byte is XORed with keyBytes[index modulo keyLength], then serialized as lowercase hex and standard padded Base64. Decryption strictly parses bytes, repeats the same operation and requires fatal UTF-8 decoding.
Frequently asked questions
Related tools
- Text To HEXEncode text into exact UTF-8 hexadecimal with continuous, spaced, or 0x-prefixed output and explicit Unicode replacement warnings.
- Base64 Encode / DecodeEncode or decode Base64 instantly with full UTF-8 support — emoji and accents work, all in your browser.
- Vigenere Cipher DecoderEncrypt or decrypt classic Vigenere text with a known repeating A–Z key entirely in your browser.
- AES Encryption OnlineEncrypt text into a portable authenticated AES-256-GCM JSON package or decrypt a package with its password entirely in your browser.
- A1Z26 Cipher TranslatorTranslate English letters to the explicit A=1 through Z=26 puzzle format and decode validated number groups without ambiguous word boundaries.
- ASCII ConverterConvert standard 7-bit ASCII text to decimal codes or decode decimal codes back to exact ASCII characters locally.