One-Time Pad (OTP) Cipher

XOR perfect secrecy - generate cryptographically secure random keys, encrypt and decrypt.

Last reviewed: April 2026
Reviewed by , software engineer · last updated April 2026

New to this tool? Click here for instructions

Educational tool. A real OTP requires: a truly random key used exactly once, securely delivered to the recipient, and destroyed immediately after use. Reusing the key destroys all security.
Key (hex)
No key yet - click Generate New Key or enter one below.
Plaintext
Ciphertext (hex)
Generate a key or paste one, then enter your plaintext.

How to Use the One-Time Pad Tool

To use the One-Time Pad (OTP) Cipher tool, follow these steps:

1. Generate a Key: Click 'Generate New Key' to create a cryptographically secure random key that matches the length of your message. Alternatively, you can paste an existing hex key.

2. Enter Plaintext: Type or paste your message into the 'Plaintext' field. The key will auto-adjust to match the message length.

3. Encrypt: Click 'Encrypt' to generate the ciphertext. The tool will XOR each byte of the plaintext with the corresponding key byte, producing the ciphertext as a hex string.

4. Decrypt: To decrypt, switch to 'Decrypt' mode, paste the ciphertext and key, and click 'Decrypt' to recover the plaintext.

When to Use the Tool in Real Workflows

The One-Time Pad (OTP) Cipher is ideal for scenarios where absolute secrecy is required, such as in military communications, diplomatic exchanges, or any situation where the confidentiality of a message is paramount. It is particularly useful when the key can be securely exchanged between the sender and receiver in person or through a secure channel.

How It Works

The OTP Cipher works by XOR-ing each byte of the plaintext with a corresponding byte from a random key of equal length. This XOR operation is self-inverting, meaning that both encryption and decryption use the same operation. The key is used exactly once and then destroyed to maintain perfect secrecy. The XOR operation ensures that any value XOR-ed with a random byte produces an equally random result, and XOR-ing the result with the same key byte recovers the original value. This property makes the OTP theoretically unbreakable, as an attacker with unlimited computational power cannot determine the actual plaintext without the key.

Tips, Edge Cases, or Limitations

1. Key Distribution: The practical limitation of the OTP is key distribution. Before any communication can happen, the sender and receiver must securely exchange a key as large as all the messages they plan to send. Reusing the key destroys all security.

2. Cryptographically Secure Key Generation: This tool uses `window.crypto.getRandomValues()` to generate keys, which is suitable for cryptographic key generation. It is different from `Math.random()`, which is not cryptographically secure and should never be used for encryption keys.

3. Client-Side Encryption: The OTP Cipher is a client-side tool, meaning all computations are performed in the user's browser. This ensures that no data is sent to a server, maintaining privacy and security.

Frequently Asked Questions

A one-time pad (OTP) is a cryptographic technique that uses a secret key of equal length to encrypt and decrypt messages. Each key is used only once and then destroyed.
The OTP provides perfect secrecy because for any ciphertext and any possible plaintext of that length, there exists exactly one key that would produce that plaintext from that ciphertext. An attacker with unlimited computational power cannot determine the actual plaintext without the key.
The practical limitation of the OTP is key distribution. Before any communication can happen, the sender and receiver must securely exchange a key as large as all the messages they plan to send. Reusing the key destroys all security.
Reusing a one-time pad key destroys all security. An attacker can then determine the plaintext by XOR-ing the ciphertext with the reused key.
Yes, this tool uses cryptographically secure key generation and performs all computations client-side, ensuring that no data is sent to a server. However, the practical limitation of the OTP is key distribution, which must be handled securely.

Quick reference

One-Time Pad (OTP) Cipher Quick Reference
Parameter Description Example Notes
Key Length Must match message length exactly 100-character random string Key must be truly random and never reused
Key Usage Used only once per message One-time pad Reusing keys compromises security
Encryption Method Character-wise XOR operation ASCII values combined with key Perfect secrecy if key is random and unique
Security Theoretically unbreakable No known ciphertext-only attacks Requires perfect key management
Key Distribution Must be securely shared Physical delivery of key material Vulnerable to interception during exchange
Practical Limitations Key storage and distribution challenges Large keys needed for long messages Not feasible for mass communication

Example walk-through

Worked example: step-by-step

Step 1. Convert plaintext and key to numerical values (A=0, B=1, ..., Z=25). For example:

Plaintext:  H E L L O  (7 4 11 11 14)

Step 2. Add each plaintext letter to its corresponding key letter modulo 26:

Key:        X M C K A  (23 12 2 10 0)

Step 3. Perform modular addition: (7+23) mod26 = 4, (4+12) mod26 = 16, etc.

Step 4. Convert numerical results back to letters: 4=E, 16=Q, 13=N, 21=V, 14=O.

Step 5. Combine ciphertext letters: E Q N V O (equivalent to "EQNVO").

Step 6. Verify decryption by reversing the process with the same key.

Expected output:  E Q N V O  (4 16 13 21 14)