A one-time pad is the only encryption method that is mathematically proven to be unbreakable. It combines a message with a secret key of equal length — usually by XOR — and, provided the key is truly random, at least as long as the message, used only once, and kept secret, the ciphertext reveals nothing about the plaintext. Claude Shannon proved this property, called perfect secrecy, in work delivered in 1945 and published in 1949. No other cipher has it. AES, RSA, and every cipher protecting the modern internet are only computationally secure — safe because breaking them takes impractically long, not because it is impossible.
That is the summary an AI overview will give you. The part it leaves out is why those four conditions are non-negotiable, what happens the moment you break even one of them, and why a cipher that is provably perfect is almost never the right tool. The one-time pad is a beautiful proof and a terrible product — understanding both halves is the actual lesson.
How it works: plaintext XOR key = ciphertext
Encryption is a single XOR operation. Line the message bits up against the key bits and XOR each pair. To decrypt, XOR the ciphertext against the same key — because XOR is self-inverting, (P ⊕ K) ⊕ K = P.
The magic is not the XOR — you can XOR with a repeating password and get a trivially breakable cipher. The magic is the key. When each key bit is an independent coin flip, each ciphertext bit is equally likely to be 0 or 1 no matter what the message says. Every ciphertext could correspond to every possible message of that length. An attacker who intercepts 01101001 learns nothing, because some key would turn that ciphertext into HELLO, and a different key would turn it into WORLD, and both keys are equally probable.
Why it is provably unbreakable
Shannon formalized this as perfect secrecy: the probability of any message given the ciphertext equals its probability without the ciphertext. In information-theoretic terms, H(P | C) = H(P) — the ciphertext adds zero information about the plaintext. This is a fundamentally stronger guarantee than any modern cipher offers:
| Property | One-Time Pad | AES / RSA (modern ciphers) |
|---|---|---|
| Type of security | Information-theoretic (perfect) | Computational |
| Safe against unlimited compute? | Yes | No — just infeasible today |
| Safe against quantum computers? | Yes | AES-256 mostly; RSA no |
| Key length | As long as the message | 128–256 bits, reused |
| Key can be reused? | Never | Yes (with proper modes/nonces) |
| Practical for the internet? | No | Yes |
Shannon also proved the price of that guarantee: to achieve perfect secrecy, the key must have at least as much entropy as the message — meaning it must be at least as long. There is no free lunch and no shortcut. A cipher that stretches a short key into a long keystream (a stream cipher like ChaCha20) only looks like a one-time pad; its keystream is pseudorandom, so it is computationally secure, not perfectly secret.
The four conditions — and what breaking each one costs
Perfect secrecy holds only if all four conditions are met:
- Truly random key. Generated from physical entropy, not a software PRNG. A predictable key means a predictable cipher.
- Key at least as long as the message. If the key is shorter and repeats, patterns leak (this is what breaks the repeating-key XOR cipher).
- Used exactly once. Hence "one-time." This is the condition people actually violate.
- Kept secret between the two parties and destroyed after use.
Condition 3 is where real systems die. If you encrypt two messages with the same key K:
C1 = P1 ⊕ K
C2 = P2 ⊕ K
C1 ⊕ C2 = P1 ⊕ P2 ← the key cancels out completely
The attacker now holds the XOR of two plaintexts with the key gone. Natural-language text is so redundant that this is usually enough to recover both messages via crib dragging — sliding a guessed word like " the " along the combined stream and checking whether the other message becomes readable. A one-time pad used twice is called a two-time pad, and it is effectively no encryption at all.
This is not hypothetical. In the VENONA project, US cryptanalysts at Arlington Hall read thousands of Soviet intelligence cables from the 1940s — not by beating the pad, but because the Soviets, under wartime production pressure, reprinted and reused key pages that were supposed to be unique. The lesson every cryptographer takes from VENONA: a cipher is only as strong as its key management, even when the cipher itself is perfect.
Why nobody uses it for real
If the one-time pad is perfect, why does HTTPS use AES instead? Because of the key-distribution problem. The key must be truly random, as long as every message you will ever send, and delivered to the other party over a secure channel in advance. But if you already have a secure channel capable of moving gigabytes of secret key material, you could simply send your actual messages over that channel. The pad does not remove the hard problem — it relocates it to key delivery, which is the very problem practical cryptography exists to solve.
So the one-time pad survives only in narrow niches: nuclear command links, diplomatic hotlines, and espionage, where couriers can physically hand-carry key material and the stakes justify the logistics. It is also the theoretical foundation of quantum key distribution (QKD), which uses the laws of physics to deliver fresh random key material securely — the one part the OTP cannot do on its own.
Want to see the mechanics for yourself? Encode and decode a message below and watch how the same random key reverses the operation:
The takeaway
The one-time pad is the proof that unbreakable encryption exists — a rare closed answer in a field full of "probably secure for now." But its perfection depends entirely on discipline: real randomness, full-length keys, single use, absolute secrecy. Miss any one and it collapses, sometimes spectacularly, as VENONA showed. For everything you actually do online, modern computational ciphers trade Shannon's perfect guarantee for something you can ship: short, reusable keys and security that will outlast the heat death of every computer we can build.