XOR Encoder / Brute-forcer

Apply a repeating XOR key to text, hex or Base64, or rank all 256 single-byte keys by printable ratio — entirely on this device.

0 bytes uploaded

KeyKey formatInput formatOutput format

Brute-force tries all 256 single-byte keys — the key field is unused

Brute-force previews are printable ASCII — output format applies to Apply

· is any byte outside printable ASCII. Tab, newline and carriage return count toward the ratio but draw as · so every row stays one line.

Input — paste text, hex or Base64

Output

0 B · 0 lines · Text

Press ? for shortcuts

Do it offline:$ xortool-xor -f data.bin -s 'key' > out.bin

How to use it

Choose a mode: Apply runs a key you already have; Brute-force tries all 256 single-byte keys and ranks the results by printable ratio.
Set the input format — Text, Hex or Base64. The tool auto-detects it from the paste and shows a badge you can click to override.
In Apply, type or paste the key and mark it as text or hex; in Brute-force the key field is unused, because the sweep supplies every key itself.
Read the output and copy or download it — or, in Brute-force, press a candidate row's Use key button to send it into Apply, see the full plaintext and share a permalink.

XOR is its own inverse, so one operation both applies a repeating key and takes it back off — feed the same key twice and the original bytes return. Paste your data as text, hex or Base64, or switch to the sweep that runs all 256 single-byte keys and ranks them by how much printable ASCII each produces. That ranking is a fallible heuristic, and the page says so rather than claiming proof.

Examples

Attack at dawn

2a110d0a06124b040d4b01181c0b

The 3-byte key repeats across the 14 input bytes, and a chip says so. The bytes are binary, so the result is shown as hex.

2a110d0a06124b040d4b01181c0b

Attack at dawn

Set the input format to Hex, keep the same key, and the ciphertext decodes straight back — the Apply mode that made it also undoes it.

7e424f0a4c464b4d0a43590a697e6c51521a58751b5975441a5e754958535a5e1a570420

The flag is CTF{x0r_1s_n0t_crypt0}.

Two keys tie at a perfect printable ratio, 0x29 and 0x2a. Only 0x2a's output ends in a real line's newline; 0x29 is plausible noise. Use key 0x2a to read the string.

1c0111001f010100061a024b53535009181c

the kid don't play

A published Cryptopals fixed-XOR vector: two equal-length hex buffers XOR to a readable phrase. The key exactly covers the input, so nothing repeats.

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

XOR undoes itself

Run the output back through the same key and the original bytes return — applying and removing a key are one operation, so there is no encode-and-decode split.

A zero key changes nothing

XOR against 0x00 returns every byte untouched, so an all-zero key is flagged as the identity and scores exactly as printable as the input already was. A high ratio hints at the key; it never proves the plaintext is right.

Why dozens of keys can tie at a perfect score

Small keys keep short lowercase text inside the printable band, so many land at ratio 1.00 together — a measured 51 of 256 for one short sentence. The printed tie count stops a crowded top of the list from reading as a single answer.

Binary output is shown as hex, not mojibake

When the XORed bytes are not valid UTF-8, or carry null and control codes, the result switches to hex and a chip names the reason — never replacement glyphs over bytes that would not decode.

Format quirks are reported, not silently fixed

A 0x prefix, colon or space separators, mixed-case hex, missing Base64 padding, URL-safe Base64 or a data: URI are each accepted and listed as a chip, so you see what was read before the XOR ran.

Oversized input is refused, not trimmed

Apply stops above 1 MB, Brute-force above 256 KB — the sweep does 256 times the work, so its ceiling sits lower. Either way the whole paste is declined with the limit named, never half-processed.

Common errors

Enter a key — XOR needs at least one byte.: Apply has to XOR against something, so a blank or whitespace-only key is refused. A hex key that decodes to no bytes, such as 0x on its own, earns the same message; Brute-force needs no key and never shows it.
Input is not valid hex — `g` at position 8 is not a hex digit: The input format is Hex but a character outside 0–9 and a–f appears — here a stray g in a pasted ciphertext. The exact position is named, so fix the typo or switch the format to Text if the paste was never hex.
Input is larger than the 1 MB limit for this tool. For bigger payloads use the CLI: xortool-xor -f data.bin -s 'key' > out.bin: Apply declines the whole paste above 1 MB rather than XORing part of it. The xortool-xor line applies a known key to a file on disk, outside this tool's input cap; Brute-force's lower 256 KB ceiling reflects scoring all 256 keys.

FAQ

Is XOR encryption?

Repeating-key XOR is reversible by anyone who guesses or brute-forces the key, and a single-byte key falls to the 256-key sweep in one pass. Use it as an analysis and CTF utility, not as protection for anything that matters.

What does the printable ratio mean?

It is the fraction of output bytes in printable ASCII — 0x20 through 0x7E plus tab, newline and carriage return. Real text scores near 1.00, but so do many wrong keys on short inputs, so it guides the eye rather than deciding.

Can it recover a multi-byte key?

No. Brute-force searches only the 256 single-byte keys; recovering an unknown longer key needs key-length and frequency analysis this tool does not run. Once you know a multi-byte key, paste it into Apply, or use a dedicated cryptanalysis workbench.

Why is my output showing as hex?

The bytes are not valid UTF-8, or they carry null and control codes, so the result is shown as hex with a chip explaining which. Pick the Hex or Base64 output to keep that view, or recheck the input format and key.

Keyboard shortcuts

⌘/Ctrl + Enter: Re-run the current mode at any input size.
⌘/Ctrl + S: Download the output as a file.
⌘/Ctrl + C: Copy the whole output when nothing is selected.
⌘/Ctrl + Shift + C: Force-copy the output even with a live selection.
t: Cycle to the next color theme (idle while typing).
? or ⌘/Ctrl + /: Open the shortcut overlay.
Esc: Dismiss the topmost dialog; input and key stay put.

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

Cryptopals — Crypto Challenge Set 1 · RFC 20 — ASCII format for network interchange · MITRE ATT&CK — T1027 Obfuscated Files or Information · xortool — XOR analysis tool (hellman)

Last reviewed: 2026-08-07