Want to learn more?
Learn why the one-time pad is the only theoretically unbreakable encryption and its practical limitations.
Read the guideWhat the One-Time Pad Does
The one-time pad (OTP) is the only cipher with mathematically proven perfect secrecy. This tool generates a random key and XORs it against your plaintext: each plaintext bit is combined with a key bit, producing ciphertext that — absent the key — is consistent with every possible message of the same length.
Why It Is Unbreakable (Under Strict Rules)
Claude Shannon proved that XOR with a truly random key as long as the message leaks zero information about the plaintext. But that proof rests on three conditions, and breaking any one collapses the security:
- The key must be truly random. A key from a predictable pseudo-random generator is only as strong as that generator — it is no longer information-theoretically secure.
- The key must be as long as the message. Stretching a short key (repeating it) turns the OTP into a Vigenère cipher, which falls to frequency analysis.
- The key must never be reused. Reuse is the classic, fatal mistake: XOR two ciphertexts encrypted with the same key and the keys cancel, leaving the two plaintexts XORed together — often enough to recover both.
That is why it is a one-time pad.
The Practical Catch
OTP is provably secure but rarely practical: you must securely distribute as much truly random key material as you will ever send. Key distribution is the hard part — if you can move a long secret key safely, you could often just move the message. This is why modern systems use shorter keys with algorithms like AES instead.
When to Use It
- Teaching perfect secrecy and the role of randomness and key reuse.
- CTF and puzzle work involving XOR.
- Understanding why "unbreakable" depends entirely on operational discipline.
Key generation and XOR run entirely in your browser — your plaintext and key are never uploaded.
Need Perfect Secrecy for Sensitive Data?
Our security architects design encryption strategies for your most sensitive information.
⚠️ Security Notice
This tool is provided for educational and authorized security testing purposes only. Always ensure you have proper authorization before testing any systems or networks you do not own. Unauthorized access or security testing may be illegal in your jurisdiction. All processing happens client-side in your browser - no data is sent to our servers.