Chris Spackman's NeoCities Page

One-Time Pad

The One-Time Pad (OTP) is a symmetric cipher that uses a random key that is as long as the message itself, and the key is used only once. Think of it like two people sharing a notebook full of random letters — each page is used to encrypt one message, then that page is torn out and destroyed. The One-Time Pad is the only cipher that is provably unbreakable when used correctly.

Try It

Result

Step-by-Step

How It Works

Each letter in the plaintext is paired with the corresponding letter in the key. To encrypt, add them together using modular arithmetic:

• Encrypt: ciphertext letter = (plaintext letter + key letter) mod 26
• Decrypt: plaintext letter = (ciphertext letter − key letter) mod 26

For example, with plaintext H (7) and key K (10): (7 + 10) mod 26 = 17, which is R. To decrypt R (17) with key K (10): (17 − 10) mod 26 = 7, which is H.

Why It Is Unbreakable

If the key is truly random and used only once, the ciphertext reveals nothing about the plaintext. Here is why: for any ciphertext, every possible plaintext is equally likely. If you intercept the ciphertext "RIJVS", it could decrypt to "HELLO", "WORLD", "PIZZA", or any other five-letter combination — it depends entirely on the key, and without the key there is no way to know which one is correct.

This is not just "hard to break" like other ciphers — it is mathematically proven to be impossible to break, even with unlimited computing power. No other cipher can make this claim.

The Catch

If the One-Time Pad is unbreakable, why does not everyone use it? Because it has serious practical problems:

• The key must be truly random. Not "random-looking" — genuinely random. Patterns in the key weaken the cipher.
• The key must be as long as the message. Want to encrypt a 1 MB file? You need a 1 MB key. Want to encrypt a movie? You need a key the same size as the movie.
• Each key can be used only once. Reuse a key on two messages and an attacker can XOR the ciphertexts together to eliminate the key, leaving a relationship between the two plaintexts that can be exploited.
• The key must be shared securely. Both the sender and receiver need the same key. But if you have a secure way to share a key as long as the message… why not just use that secure channel to send the message itself?

The Key Distribution Problem

This is the fundamental challenge of symmetric encryption: how do you share the key? The One-Time Pad makes this problem painfully clear because the key is so large.

This problem is exactly what drove the invention of modern cryptography. Two brilliant solutions emerged:

• Diffie-Hellman Key Exchange — lets two people agree on a shared secret over a public channel, without ever transmitting the key itself.
• RSA Public/Private Key Generation — uses a pair of mathematically linked keys so that anyone can encrypt a message to you, but only you can decrypt it. No shared secret needed.

The One-Time Pad shows us why we need these tools. It is the bridge between traditional and modern cryptography.

Things to Try

• Encrypt "HELLO" with key "KWRSG", then try decrypting the result with a wrong key like "ABCDE". You get valid-looking text! This is why the OTP is unbreakable — any key produces a plausible plaintext.
• Encrypt two different messages with the same key. Why is key reuse dangerous? (Hint: what happens if an attacker subtracts one ciphertext from the other?)
• Use "AAAA" as the key (all A = all zeros). What happens to your message? What does this tell you about what A means as a key letter?
• Click "Generate Random Key" several times. Does the key look random? Could you predict the next one?