Tools

XOR Calculator

XOR two hexadecimal strings together.

What is XOR?

XOR (exclusive OR, written as ⊕) is a fundamental binary operation in cryptography and computer science. It compares two bits and returns 1 when they differ and 0 when they match. The truth table is exhaustive: 0⊕0=0, 0⊕1=1, 1⊕0=1, 1⊕1=0. This deceptively simple operation underpins almost every modern encryption algorithm, message authentication code, and key derivation function used in payment systems. In payment security, XOR is everywhere: PIN Block construction under ISO 9564, key component combining for split-knowledge ceremonies, MAC calculations under ANSI X9.19 and ISO 9797-1, IV chaining in CBC mode, the round-function mixing inside DES and AES, and the keystream layer in DUKPT and stream ciphers. The reason XOR is so popular is its self-inverse property: A ⊕ B ⊕ B = A. This means the same operation that encrypts a block also decrypts it when applied with the same key, which is why XOR forms the foundation of the one-time pad — the only cipher with proven unconditional security, provided the key is truly random, kept secret, and never reused.

How to Use This Tool

  1. Enter two hexadecimal strings of equal length in the input fields.
  2. The tool computes the bitwise XOR and instantly displays the result in HEX.
  3. View the binary representation to see the bit-level operation across each nibble.
  4. Copy the result directly for use in cryptographic operations or key reconstruction.
  5. For longer keys, pad with leading zeros to keep both inputs the same length.

Common Use Cases

  • Combining key components to form cryptographic keys under split-knowledge / dual-control policies (PCI PIN Security Requirement 18).
  • Calculating clear PIN Blocks by XORing the formatted PIN field with the formatted PAN field (ISO 9564 Format 0 and Format 3).
  • Verifying key check values (KCV) during key injection ceremonies and after key translation.
  • Computing PIN offset values for IBM-3624 PIN verification (PVV).
  • Deriving session keys from base derivation keys via XOR with diversification data (DUKPT, key block translation).
  • Performing CMAC and OMAC computations during ISO 9797-1 algorithm 3 MAC verification.
  • Debugging and reverse-engineering encryption operations that use XOR as an intermediate step.
  • Testing and validating MAC and CBC-MAC computations across different key types.

XOR Truth Table

XOR outputs 1 exactly when the two input bits differ — the property every construction below relies on:

ABA ⊕ B
000
011
101
110

Worked Example: XOR Two Hex Values

Each hex character is 4 bits, so the operation runs nibble by nibble. Here is A5 ⊕ 3C, bit by bit, and the same idea scaled up to combining two key components into a working key:

A5  = 1010 0101
3C  = 0011 1100
      ---------
99  = 1001 1001   (A5 ⊕ 3C)

Key component ceremony (split knowledge):
Component 1:  0123 4567 89AB CDEF 0123 4567 89AB CDEF
Component 2:  FEDC BA98 7654 3210 FEDC BA98 7654 3210
              -----------------------------------------
Key:          FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF
Combine and split key components with KCV verification →

Frequently Asked Questions

What is the XOR truth table?▾
XOR returns 1 when inputs differ and 0 when they match: 0⊕0=0, 0⊕1=1, 1⊕0=1, 1⊕1=0. This is the only Boolean operation where the output is true exactly when the inputs are unequal, which is also why it is sometimes written as "≠" in formal logic.
Why must the two hex strings be the same length?▾
XOR operates on corresponding bit pairs. Each hex character represents 4 bits (a nibble), so a 16-character HEX string is 64 bits. For a meaningful result, both inputs must have the same number of bits. In payment systems, keys and blocks are always fixed-length (16, 32, or 48 HEX characters for 8, 16, or 24 bytes), so this constraint is naturally satisfied.
How is XOR used in key management?▾
Cryptographic keys are often split into 2 or 3 components for security (split knowledge). To reconstruct the full key, the components are XORed together: Key = Component1 ⊕ Component2 ⊕ Component3. This ensures no single person ever knows the complete key — a core requirement of PCI PIN Security and FIPS 140-3 Level 3.
How does XOR relate to AES and DES encryption?▾
Both AES and DES use XOR as the primary mixing operation inside their round functions: the round subkey is XORed into the state, the round function output is XORed with the input (Feistel structure in DES), and the final ciphertext block is XORed with the plaintext through the round transformations. Without XOR, neither algorithm would be reversible.
Is XOR encryption secure on its own?▾
XOR alone is not secure encryption — if the same key is reused across multiple messages, the XOR of two ciphertexts equals the XOR of the two plaintexts, which exposes patterns and enables cryptanalysis. However, when used inside AES, 3DES, or as a one-time pad with a truly random key of equal length to the message and used exactly once, XOR provides the mathematical foundation for proven-secure encryption.
What is the difference between XOR and OR?▾
OR returns 1 when at least one input is 1 (so 1⊕1=1). XOR returns 1 only when exactly one input is 1 (so 1⊕1=0). This difference is critical in cryptography: XOR is reversible because each output bit gives you information about both input bits when combined with one of them. OR is not reversible, which is why no symmetric cipher uses OR as its mixing function.
Can I XOR a HEX string with an ASCII string?▾
Yes, but you must first convert both inputs to the same encoding. Use our Data Converter to translate ASCII to HEX, then feed both HEX strings to this XOR Calculator. Cryptographic operations almost always work on raw bytes (HEX), so converting to HEX first is the standard workflow.

More Tools

Data Converter

Convert data between HEX, ASCII, Binary, Decimal, and Base64.

PIN Block

Calculate and reverse ISO 9564 Format 0 PIN Blocks.

LUHN Validator

Validate and generate numbers using the Luhn algorithm.

TLV Parser

Parse EMV Tag-Length-Value data structures.