Brute-force all 256 single-byte XOR keys with automated English frequency & chi-squared scoring.
Execution runs 100% locally inside the browser sandbox using HTML5 Canvas, Web Cryptography Subtle API, and Web Workers. No data is ever transmitted across the network.
Zero network latency. Operates completely offline with zero dependencies on third-party backend servers or cloud services.
Built according to official RFC specifications, cryptographic test vectors, and enterprise-grade data transformation standards.
Paste obfuscated hex, base64, or raw ciphertext string.
All 256 keys (0x00 to 0xFF) are tested with statistical frequency scoring.
Review top-ranked plaintext and copy the recovered key and message.
It scores plaintexts using a combination of English letter frequency correlation (ETAOIN SHRDLU), printable ASCII character ratio, and dictionary word matching.
Yes, you can toggle between Auto, Hex, Base64, and Raw UTF-8 string modes.
Explore related utilities in the Security & Network suite
Audit CSP, HSTS, X-Frame-Options, and security headers with OWASP grading (A+ to F).
Compare memory hardness, GPU ASIC resistance, and security parameters across KDF standards.
Generate secure RFC 6238 Base32 TOTP secret keys and standard otpauth:// URIs for Google Authenticator.
Generate RFC 6844 CAA iodef DNS records to receive unauthorized TLS issuance alerts.
