Flip bits with a mask
XOR with 1 flips a bit and XOR with 0 leaves it alone, so the mask 11110000 inverts the high four bits.
11001010 ⊕ 11110000
Result
Type or paste two inputs and the result appears here, or load an example.
Breakdown
The inputs lined up column by column. 0 zero padding k repeated input
Nothing to show yet.
Examples
XOR two numbers
Numbers are XORed bit by bit. The breakdown shows the bits: 1100 ⊕ 1010 = 0110.
12 ⊕ 10 = 6
Combine key components
A key split into components, each held by a different person, is rebuilt by XORing all of them.
8B3F… ⊕ 5E92… ⊕ C4D7…
Repeating-key cipher
The short key repeats across the message. XOR the result with the same key and you get the message back.
attack at dawn ⊕ key
How it works
XOR, one bit at a time
XOR (exclusive or) compares two bits and gives 1 when they differ and 0 when they match. Longer inputs are lined up and XORed bit by bit.
| A | B | A ⊕ B |
|---|---|---|
| 0 | 0 | 0 |
| 0 | 1 | 1 |
| 1 | 0 | 1 |
| 1 | 1 | 0 |
Anything XORed with itself is zero, and XORing twice with the same value undoes the first XOR: (a ⊕ k) ⊕ k = a. That is why XOR shows up in ciphers, checksums, parity and key splitting.
With three or more inputs the result is A ⊕ B ⊕ C …, and the order doesn’t matter. An empty input is left out, so a single input is simply shown in the output format: put hex in Input A, choose ASCII, and the page works as a converter.
Input formats
- Binary
- The digits 0 and 1, one bit each. Spaces, the separators
: - _ , .and0bprefixes are ignored. - Decimal
- A whole number, 0 or more. Spaces and underscores between digits are ignored. It’s stored in as few whole bytes as will hold it, so 32 lines up with one ASCII character.
- Hex
- The digits 0–9 and a–f in either case, four bits each. Spaces, the same separators, and
0xor\xprefixes are ignored. - Base64
- The standard alphabet with
+ /or the URL-safe one with- _, with or without=padding. Spaces and line breaks are ignored. - ASCII
- Each character is one byte, including spaces and line breaks. Characters outside ASCII, such as é or emoji, are encoded as UTF-8, which takes two to four bytes each.
- Files
- Drop a file on an input, paste one, or choose Open file. Its bytes are used exactly as they are, up to 64 MB per file. Several files at once fill the following inputs. If a file holds text such as hex digits, the page offers to use the text instead.
Inputs of different lengths
When the inputs aren’t the same length, choose how to line them up. Every shorter input is treated the same way. With 1011 and 11:
| Align right | Pads the shorter input with leading zeros, the way numbers line up. | 1011 ⊕ 0011 = 1000 |
|---|---|---|
| Align left | Pads it with trailing zeros, so the end of the longer input passes through. | 1011 ⊕ 1100 = 0111 |
| Repeat | Repeats the shorter input to full length, as in a repeating-key cipher. | 1011 ⊕ 1111 = 0100 |
| Truncate | Drops the part of the longer input that has no partner. | 10 ⊕ 11 = 01 |
Output formats
Results keep their leading zeros, so they are as long as the longest input, or the shortest when truncating. ff00ff ⊕ ff0000 is 0000ff, not ff.
- Binary
- Every bit of the result.
- Decimal
- The result as a whole number, which has no leading zeros. Results longer than a million digits aren’t shown in decimal.
- Hex
- Four bits per digit. A result whose length isn’t a multiple of four bits gets leading zeros, and a note says so.
- Base64
- The standard alphabet with
=padding. Like ASCII it needs whole bytes, so other lengths get leading zeros and a note. - ASCII
- One character per byte. Bytes that aren’t printable ASCII appear as escapes such as
\x00,\nand\t, and a backslash appears as\\. Turn off escaping to read the bytes as UTF-8 text. - Download
- Saves the result as a file of raw bytes. It appears when an input is a file, or when the result is too long to show in full. The file is named after the first input file, with
.xoradded or removed, so XORingphoto.jpgwith a key givesphoto.jpg.xor, and XORing that with the same key gives backphoto.jpg.
Privacy
The calculation runs on your device. What you type is never sent anywhere or saved, files you open are read by your browser and never uploaded, and the page loads nothing from other sites: no trackers, ads or third-party fonts. Only your format and display choices are remembered, in this browser.
You can check this yourself:
- Go offline. Turn off Wi-Fi or switch to airplane mode, then keep calculating. Everything still works, because nothing needs the server.
- Watch the network. Open your browser’s developer tools (F12 on most computers), choose the Network tab, and type. No requests appear.
- Read the code. View the page source. Its content security policy includes
connect-src 'none', which tells your browser to block any connection the page tries to open, and the scripts are plain, readable JavaScript.
A share link is the one exception, and only when you make one: it carries your inputs in the link itself, after the #. Browsers never send that part to the server, but anyone you give the link to can read the inputs, and it stays in your browser history.
About this site
xor.pw has been calculating XOR since 2013. Until 2026, every calculation went to the server, where PHP’s GMP library did the work. In 2026, Claude, an AI model made by Anthropic, designed and built this version, working with the site’s owner.
This version runs as JavaScript in your browser, and the server only delivers the page. Each input becomes bytes in a Uint8Array, the bytes are combined with JavaScript’s ^ operator, and decimal numbers are converted with BigInt.