How can I decrypt a message that was encrypted with a one-time pad? Would I need to get that pad, and then reverse the process? I'm confused here.

  • 1
    One time pads can be "decrypted" into anything, making them unbreakable. They are used by sovereign head of states (including USA) to communicate. Their one "vulnerability" is distribution of the key.
    – November
    Oct 2, 2012 at 18:50
  • If your question is not how to "break" an OTP, but just how, in the normal order of things as an authorized user, you would go about the process of decryption, then yes, you would need the pad, and then XOR the PAD again, with the cipher text, to recover the plain text. That would be legitimate decryption.
    – JesseM
    Jun 22, 2017 at 21:59

7 Answers 7


One-Time Pad is unbreakable, assuming the pad is perfectly random, kept secret, used only once, and no plaintext is known. This is due to the properties of the exclusive-or (xor) operation.

Here's its truth table:

A xor B = X

A | B | X
0 | 0 | 0
0 | 1 | 1
1 | 0 | 1
1 | 1 | 0

Number of 0s in column A = 2
Number of 1s in column A = 2
Number of 0s in column B = 2
Number of 1s in column B = 2
Number of 0s in column X = 2
Number of 1s in column X = 2

Note that it introduces no bit-skew - the number of 0s and 1s in the inputs are equal to the number of 0s and 1s in the output, i.e. two of each. Furthermore, if you know only one element from a row, you cannot predict the values of the other two, since they are equally probable.

For example, let's say we know that X is 0. There's an equal probability that A = 0 and B = 0, or A = 1 and B = 1. Now let's say we know that X is 1. There's an equal probability that A = 0 and B = 1, or A = 1 and B = 0. It's impossible to predict. So, if you only know one element, you cannot possibly determine any information about A or B.

The next interesting property is that it is reversible, i.e.

A xor A = 0
B xor B = 0

A xor 0 = A
B xor 0 = B

A xor B xor B  =  A xor 0  =  A
A xor B xor A  =  B xor 0  =  B

So, if we take any value and xor it with itself, the result is cancelled out and it always results in 0. This means that, if we xor a value A with a value B, then later xor that result with either A or B, we get B or A respectively. The operation is reversible.

This lends well to cryptography, because:

  • xor introduces no bitskew
  • xor has equally probable inputs for any given output
  • given any two of A, B, X we can compute the third

As such, the following is perfectly secure:

ciphertext = message xor key

but only if message is the same length as key, key is perfectly random, key is only used once, and only one element is known to an attacker. If they know the ciphertext, but not the key or message, it's useless to them. They cannot possibly break it. In order to decrypt the message, you must know the entire key and the ciphertext.

Keep in mind that the key must be completely random, i.e. every bit must have an equal probability of being 1 or 0, and be completely independent of all other bits in the key.

This actually turns out to be rather impractical, for a few reasons:

  • Generating perfectly random keys is hard. Software generators (and many hardware generators) often have minuscule biases and odd repeating properties. It's almost impossible to gain truly random data in anything but tiny amounts.
  • If the attacker knows the ciphertext and can correctly guess parts of the message (e.g. he knows it's a Windows executable, and therefore must start with MZ) he can get the corresponding key bits for the known range. These bits are useless for decrypting other parts of the message, but can reveal patterns in the key if it's poorly generated.
  • You must be able to distribute the key, and your key must be equally as long as your message. If you can keep your key 100% secret between those of you who are authorised to read the message, why not just keep your message 100% secret instead?

The weak link here is your random number generator. The security of the one time pad is entirely limited by the security of your generator. Since a perfect generator is almost impossible, a perfect one-time pad is almost impossible too.

The final problem is that the key can only be used once. If you use it for two different messages, and the attacker knows both ciphertexts, he can xor them together to get the xor of the two plaintexts. This leaks all sorts of information (e.g. which bits are equal) and completely breaks the cipher.

So, in conclusion, in a perfect one-time pad you need to know the ciphertext and key in order to decrypt it, but perfect one-time pads are almost impossible.


One-time pads are extremely hard to break, in fact they are still used in some situations as if they are done correctly then they are essentially unbreakable. In a one-time pad system every character is changed by a stream of random data which is shared by both sides, without a copy of the pad you will not be able to break the code.

One of the few weaknesses in the system is the random data source. In WWII British one-time pads were being broken and they traced it to a worker whose job it was to pull random numbered balls out of a drum. The way it was supposed to work was that the worker would spin the drum, pull out a ball at random without looking at it, spin again, pick again, etc, etc. The worker started taking shortcuts by pulling out more than one ball after each spin and looking at the numbers, picking out favorites. It introduced patterns which enabled the opposition to break the pads, and lives were lost as a result.

The same is true today with pseudo-random number sources. Encryption protocols that should take millennia to break will really only last for years or decades without a true random data source.

  • 3
    Do you have a reference for that interesting WWII story? Mar 17, 2016 at 16:31
  • 1
    Neal Stephenson's Cryptonomicon mentions a similar (fictional) situation. An operator drawing numbered balls from a bingo drum keeps forgetting to close her eyes, thus rendering one-time pads insecure.
    – user120539
    Nov 30, 2016 at 18:23
  • That wasn't fictional at all, it happened in ww2
    – GdD
    Nov 30, 2016 at 18:27
  • @GdD I meant that this particular event in the story was fictional. RNGs were certainly vulnerable to human biases.
    – user120539
    Dec 9, 2016 at 23:46

Assuming the encryption was competently done, the only way to decrypt is to get the pad.


While one-time-pad encryption is provably impossible to break, note that it is also extraordinarily rare.

Part of the definition of OTP is that the pad must contain truly random data, and truly random data can be hard to come by for computers. Instead, often the pad is composed of pseudo-random data, which is generally what you get when you ask a computer for a random number.

In this case, you no longer have unbreakable encryption. Instead, you have a message XORed with the output of a deterministic and often reversible algorithm, which can be attacked by reproducing the same pseudo-random string. This attack is particularly devastating if you know what algorithm is used and even more so if you know how the seed is generated. In such a case, the code can be cracked in a matter of seconds. But even without knowing the PRNG seed, often the pattern can be derived from the message itself.

Also, OTP encryption is particularly unwieldy because the key is as long as the encrypted message, and must somehow be transmitted to the recipient without being intercepted. Any software that claims to use OTP encryption that does not require you to exchange a key block as large as your message (or larger) is not using truly random data, and is therefore not using OTP encryption.

Also, one of the key features of OTP is that you cannot reuse old pads. If you reuse an old one even once, that can be enough to allow the code to be broken.


The question was, how can you decrypt a message that was created from one time pad, pretty sure that hasn't been answered yet.

Originally the one time pad was used with just characters, and is very basic. Let's say you have a message 'killtheking' (taken from one response), and you want to encrypt it so you need a key. For the key you need at least the same number of characters as the message, so you roll a dice which has 26 sides (one for each letter) 11 times, because there are 11 characters in the message.

Assume the result is aqheivlekrw

now we subtract the position in the alphabet of the letter in they key, from the position in the alphabet of the letter in the message, and the resulting number is the position in the alphabet of the cypher text. Wrap any letters that create a minus result as below (like if the result is 30, then use 26 - 30 = 4 or 'd'.


k - a = (11 - 1) = 10 = j 

'j' is the 10th letter in the alphabet so we use that.

for the rest of the message we get:

i - g = (9 - 7) = 2 =   b
l - h = (12 - 8) = 4 =  d
l - e = (12 - 5) = 7 =  g
t - i = (16 - 9) = 7 =  g
h - v = (8 - 22) = -14 (26 - 14 = 12) = l
e - l = (5 - 12) = - 7 (26 - 7 = 19) = s
k - e = (11 - 5) = 6 = f
i - k = (9 - 11) = -2 (26 - 2 = 24) = x
n - r = (14 - 18) = -4 (26 - 4 = 22) = v
g - w = (7 - 23) = -16 (26 - 16 = 10) = j

so in the end

your message    = killtheking
you key         = agheivlekrw
your cypher     = jbdgglsfxvj

pass the cypher text to whomever you want to recieve it and they do the opposite of what you have done to encrypt it, they have to add the key to the cypher text:

j + a = (10 + 1 = 11) k
b + g = (2 + 7 = 9)   i
d + h = (4 + 8 = 12)  l
g + e = (7 + 5 = 12)  l

and so on.

Computers use XOR because it does the same thing and is a lot quicker and easier to implement, but to understand how it works, I found that it is good to see the 'human' usable example. So on a computer you can encrypt the message by doing:

Cypher = Message XOR Key

and decrypt it again by using:

Message = Cypher XOR Key

It is as simple as that.

  • This does, of course, assume the die is perfectly random. For the example, we can probably assume this safely. But in reality getting a perfectly unpredictable sequence is not that easy. Mar 17, 2016 at 7:22
  • yes, using a loaded dice would kind of defeat the purpose, however, the encryption/decryption method is the same regardless of how effectively your random source is.
    – Neil H
    Mar 17, 2016 at 23:42

If you don't have the key ...

Brute force the ciphertext (permute it) and analyze the output for potential cleartext in the expected language.

Statistical analysis can assist in the detection of potential human-generated language in the output (maybe chi-squared?)

  • 4
    You can't brute-force a one-time pad. If you generate every possible pad, you'd find that it also decrypts the message into every possible output text, so there's no way to tell which one is correct. Oct 2, 2012 at 21:01
  • 4
    But in your answer you say that you could permute the key and analyse the output but you can't. For example, say I sent the message kill the king and you intercept the 13 character (104 bit) ciphertext. You then somehow generate all 2^104 possible one-time pads (good luck doing that on a normal computer). Unfortunately, you find that along with kill the king as a possible output, there's also save the king, save the duck, feed me ducks, (consider padding/compression), etc., and there's absolutely no way to tell which one is correct without knowing something about the key. Oct 2, 2012 at 22:16
  • +1 again. You are doing a much better job of explaining why this is unlikely to succeed than I did, cheers.
    – adric
    Oct 3, 2012 at 15:51

one time pad could de easily cracked if you know the output format. Such as audio headers, gifs images, etc. By reverse engineering the stream back. It could be good for some sort of characters but not for some other fields where the output format could be easily identify by other means. Nothing is 100% secure nowadays.

  • 4
    This is simply incorrect.
    – Xander
    Dec 5, 2013 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .