XOR brute force (single-byte key)

All 256 single-byte keys. For each one it XORs the whole file, decodes the result as latin1, and scores it by counting characters that are letters or spaces. It sorts by that score and prints the top five, each labelled with the key in hex followed by the recovered text, so you can pick the readable one.

No. It only tries keys one byte long. Text encrypted by the XOR cipher tool with a key like the word key uses three bytes, and none of the 256 single-byte candidates will recover it. Breaking a repeating key means finding the key length first and then attacking each position, and that is not automated here.

The scorer only counts letters and spaces, so on short inputs, on text that is not English, or on binary data several keys can score alike. That is why five candidates are shown rather than one. The tool never claims the top line is correct; it presents them as candidates for you to judge.

Each candidate is decoded as latin1, which maps every byte to a character so nothing is lost or replaced by a question mark. For a wrong key that looks like garbage, which is what you want. For UTF-8 plaintext with non-English characters, even the correct key shows them as pairs of odd symbols, though the underlying bytes are right.

It takes whatever you drop, but it builds all 256 decoded copies before sorting, so a large file costs a lot of memory in your browser tab and only five copies survive into the output. Cutting the ciphertext down to a sample first is usually enough to find the key.

No. All 256 attempts happen in a Web Worker in this tab, and only the five best-scoring candidates are shown on the page. Nothing is sent anywhere, nothing is stored between runs, and it works with the network off. The other 251 candidates are discarded when the run finishes rather than saved.