If it's mathematically unbreakable, why isn't it used everywhere?

The three conditions the proof depends on are brutal in practice: the pad must be truly random, exactly as long as the message, shared with the recipient in advance over some other secure channel, and never reused. Securely distributing a pad as long as everything you'll ever send is a harder problem than the one the pad solves, which is why modern cryptography uses shorter keys and different techniques instead.

One-Time Pad Generator

The one-time pad is the only cipher proved unbreakable, and the proof depends on three conditions that are hard to meet: the pad must be truly random, exactly as long as the message, and never reused. This generates such a pad, shifts each letter by its own pad value, and then removes the pad again to show the plaintext returning exactly. These parameters are far too small to protect anything and are chosen so the arithmetic can be followed by hand. This is a teaching demonstration, not a security tool — real work belongs in a reviewed cryptographic library.

Message

Letters only are encrypted; spaces and punctuation are dropped.

Seed (optional)

A word reproduces the same values — useful for teaching, useless for secrecy.

Your result will appear here.

What this generator does

Draws one pad value per letter, shifts each letter by its own value within the alphabet, and then subtracts the same pad to recover the message. The recovered text is compared with the original before display.

How to use this tool

Type a message; only letters are encrypted.
Run, and read the pad and the ciphertext.
Check the recovered text against your message.
Note that the pad is exactly as long as the message — that is the whole cost.

Understanding the controls

Message: Letters are encrypted; spaces and punctuation are dropped, since they would otherwise leak the shape of the message.
Seed: Reproduces the same pad, which is convenient for teaching and precisely what must never happen in real use.

Worked examples

"ATTACK AT DAWN", seeded with "demo": The 12 letters (spaces dropped) become ATTACKATDAWN. Pad VDBLFWBZDVMN shifts it to ciphertext VWULHGBSGVIA — and subtracting the same pad from that ciphertext returns ATTACKATDAWN exactly, letter for letter.

Common use cases

Demonstrating the one-time pad with a message you choose
Teaching why key length is the pad's fundamental problem
Showing that removing the pad returns the plaintext exactly
Producing worked examples for a cryptography lesson
Generating pad and ciphertext pairs for a classroom exercise

How this generator works

Each letter becomes a number from 0 to 25, its own pad value is added, and the result wraps around the alphabet. Because every pad value is uniformly random and used once, every ciphertext letter is equally likely to be any letter, whatever the plaintext said — which is why the cipher is unbreakable and why reuse destroys it completely. Before display the pad is subtracted again and the result compared with the plaintext letter for letter.

Randomness and fairness

Uses your browser's cryptographic random source for the pad by default. A seed switches to a reproducible sequence, which is deterministic and not cryptographically secure — and a reproducible pad is precisely what a one-time pad must never be. These parameters are far too small to protect anything and are chosen so the arithmetic can be followed by hand. This is a teaching demonstration, not a security tool — real work belongs in a reviewed cryptographic library.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

Letters only, so spaces and punctuation are dropped rather than encrypted — real use would encrypt bytes.
The pad has to be shared securely in advance and is as long as the message, which is the practical problem the whole field grew up trying to avoid.
Reusing a pad breaks it completely: two messages under one pad leak the difference between them immediately.
A seeded pad is not random at all, so the seeded mode is for teaching only.

Privacy and your data

Encryption happens entirely in your browser. Your message and pad never leave the page and are not included in analytics.

Frequently asked questions

Why does the ciphertext give away nothing about the plaintext, even its length pattern?: Because every ciphertext letter is the plaintext letter plus a value that is itself uniformly random across all 26 possibilities — so whatever the plaintext letter was, the ciphertext letter is equally likely to be any letter at all. Even repeated plaintext letters (the two A's in ATTACK, for instance) become different ciphertext letters here, because each position draws its own independent pad value.
If it's mathematically unbreakable, why isn't it used everywhere?: The three conditions the proof depends on are brutal in practice: the pad must be truly random, exactly as long as the message, shared with the recipient in advance over some other secure channel, and never reused. Securely distributing a pad as long as everything you'll ever send is a harder problem than the one the pad solves, which is why modern cryptography uses shorter keys and different techniques instead.