The One-Time Pad: The Only Provably Unbreakable Cipher

How XOR Encryption With a Random Key Works

A one-time pad encrypts by combining each unit of plaintext with a corresponding unit of a secret key, using an operation that can be perfectly undone with the same key. For binary data this operation is the exclusive-or, commonly abbreviated XOR, which flips each bit of the plaintext wherever the matching key bit is a one, and leaves it unchanged wherever the key bit is a zero. For text-based systems, such as the historical pads used by spies and diplomats, the equivalent operation is modular addition: each letter of the message is shifted forward in the alphabet by an amount determined by the corresponding letter of the key, wrapping around from Z back to A. The two operations are mathematically equivalent in effect, both mix message and key so thoroughly that the output looks like meaningless noise. Decryption simply reverses the process: applying the same XOR or subtracting the same key value recovers the original plaintext exactly. The entire security of the scheme rests on one object, the key stream, which must be generated independently of the message and must be exactly as long as the message. If the key is even one character short and gets reused or padded predictably, the guarantees described below no longer apply, and the cipher degrades into something far weaker than its reputation suggests.

Shannon's Proof of Perfect Secrecy

In 1949, Claude Shannon published Communication Theory of Secrecy Systems, formally defining what it means for a cipher to be unbreakable and proving that the one-time pad achieves it. Shannon's concept, called perfect secrecy, states that the probability distribution of possible plaintexts, given the observed ciphertext, must be identical to the probability distribution of plaintexts before the ciphertext was ever seen. In plain language, intercepting the ciphertext teaches an attacker absolutely nothing about the message, not even a hint that narrows the possibilities. The intuitive reason this works for a one-time pad is that for any ciphertext an attacker captures, there exists some possible key that would decrypt it to any plaintext of the same length they might guess. Without knowledge of the key, every equal-length plaintext remains equally likely, whether it says a harmless grocery list or a critical military order. This is fundamentally different from every other cipher in existence, which may resist attack today only because no one has yet found a shortcut or because computers are not fast enough. The one-time pad's security holds regardless of computing power, algorithmic cleverness, or future mathematical breakthroughs, which is why it is described as unconditionally or information-theoretically secure rather than merely computationally secure.

The Strict Requirements for the Guarantee to Hold

Shannon's proof comes with conditions that are unforgiving in practice. First, the key must be truly random, generated by a physical process like radioactive decay, atmospheric noise, or dice rolls, not by a pseudorandom number generator or algorithm, because any deterministic process that produces the key introduces patterns an attacker could in principle exploit, breaking the perfect uniformity the proof depends on. Second, the key must be used exactly once and never again for any other message, in whole or in part; reusing even a fragment of key material against a second message opens the door to statistical attack. Third, the key must remain completely secret, known only to the sender and intended recipient, and must be exchanged through a channel that is itself secure, transported by trusted courier, memorized, or agreed upon in advance. Fourth, the key must be at least as long as the plaintext, since any shortfall forces reuse of key material to cover the remaining message. Every one of these conditions is a practical burden rather than a mathematical nicety. Violate any single one, whether by using a flawed random number generator, reusing a page of the pad, or letting the key leak, and the cipher's real-world security can fall dramatically short of its theoretical promise, sometimes becoming trivially breakable.

Venona: A Real-World Catastrophe From Key Reuse

The clearest historical demonstration of what happens when the one-time pad rule is broken is the Venona project. During the 1940s, Soviet intelligence agencies encrypted diplomatic and espionage cables using one-time pads that were supposed to be used only once per key sheet. Under the pressure of wartime demand, however, Soviet cryptographic staff reused portions of key material across multiple messages, producing what cryptanalysts call a depth of two or more ciphertexts encrypted with overlapping key. United States Army and, later, joint US-UK codebreakers, working for over three decades from 1943 into the 1980s, discovered this reuse and exploited it. By comparing ciphertexts that shared key material, analysts could strip away much of the supposed randomness, reconstruct fragments of the underlying key, and gradually recover portions of the original Russian text through painstaking statistical and linguistic analysis. The results were extraordinary: Venona exposed a substantial Soviet espionage network operating inside the United States, including sources connected to the Manhattan Project. The lesson is stark. The one-time pad's perfect secrecy is not a property of the algorithm alone; it depends entirely on flawless operational discipline. A single instance of key reuse, even under wartime pressure and even by a sophisticated intelligence service, was enough to turn an unbreakable cipher into a solvable puzzle.

Why It's Impractical Despite Being Theoretically Perfect

If the one-time pad is truly unbreakable, why doesn't everyone use it instead of AES or other modern ciphers? The answer is the key-distribution problem, and it is severe enough that the one-time pad sees almost no everyday use. Because the key must be as long as the message and can never be reused, two parties who want to exchange an unlimited amount of secret communication over time would need to pre-share an unlimited amount of truly random key material, securely, in advance, and store it without any of it being copied, lost, or compromised. For a single short telegram this is manageable; for continuous modern communication involving gigabytes or terabytes of data, generating, distributing, and safely storing a matching quantity of true randomness is wildly impractical. Whatever secure channel you'd need to distribute the key could often just be used to send the message itself, which is the central paradox of the scheme. Modern cryptography instead relies on computationally secure ciphers, which use short, easily distributed keys, sometimes exchanged via clever mathematical protocols like Diffie-Hellman, combined with algorithms believed to be infeasible to break with any realistic amount of computing power. This sacrifices Shannon's absolute mathematical guarantee for enormous practical convenience. The one-time pad survives today mainly in niche, low-volume, extremely high-stakes settings, such as certain diplomatic or intelligence channels, where the cost of pre-distributing physical key material is worth paying for a guarantee no other cipher can match.

Frequently asked questions

Try it live

Everything above runs in your browser — open The One-Time Pad: The Only Provably Unbreakable Cipher and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.