from scratch: cryptography

I wrote a toy cipher in Python to show friends how basic encryption works.

Spoiler: it's not secure. Don't use this for anything real.

But it's fun to see how XOR and repeating keys can scramble text into gibberish and back again.

What's encryption even for?

You have secrets. I have secrets. We don't want other people reading them.

Encryption is just scrambling data so only people with the key can unscramble it.

In my case, I wanted to show what happens when you XOR bytes together in a repeating pattern. Turns out, it makes a pretty bad cipher, but a pretty good learning experience.

The toy algorithm

This is the simplest symmetric cipher I could think of:

1. Take a message, turn it into bytes
2. Take a key, turn it into bytes
3. XOR each byte of the message with a byte from the key (repeating the key if it's too short)
4. Encode the result as base64 so it's printable
5. To decrypt, XOR again with the same key

Why XOR? Because a ^ b ^ b == a. It's reversible.

Why base64? Because raw bytes are a pain to copy-paste.

Why is this insecure? Because repeating-key XOR is vulnerable to frequency analysis, known-plaintext attacks, and basically everything. Real encryption (AES, ChaCha20) uses way more sophisticated math.

But for learning? This is perfect.

The code

Here's the whole thing. Copy it into toy_cipher.py if you want to mess around.

# toy_cipher.py
import base64

def _xor_bytes(data: bytes, key: bytes) -> bytes:
    """
    Exclusive or the bytes.

    XOR each byte of data with the repeating key.
    """
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))

def encrypt(plain_text: str, key: str) -> str:
    """
    Encrypt a UTF-8 string using XOR and encode the result as base64.

    Returns a printable string that can be safely stored or sent over text channels.
    """
    data = plain_text.encode('utf-8')
    key_bytes = key.encode('utf-8')
    cipher_bytes = _xor_bytes(data, key_bytes)
    return base64.urlsafe_b64encode(cipher_bytes).decode('ascii')

def decrypt(cipher_text: str, key: str) -> str:
    """
    Reverse the encryption process.

    Takes a base64 string produced by `encrypt` and returns the original text.
    """
    cipher_bytes = base64.urlsafe_b64decode(cipher_text.encode('ascii'))
    key_bytes = key.encode('utf-8')
    plain_bytes = _xor_bytes(cipher_bytes, key_bytes)
    return plain_bytes.decode('utf-8')

# Demo
if __name__ == "__main__":
    secret_key = "my-tiny-key"
    message = "Hello, world! 🌍"

    print("Original:", message)

    encrypted = encrypt(message, secret_key)
    print("\nEncrypted (base64):", encrypted)

    decrypted = decrypt(encrypted, secret_key)
    print("\nDecrypted:", decrypted)

Running it

$ python toy_cipher.py
Original: Hello, world! 🌍

Encrypted (base64): JRxBGAZCWVoEFxUJWA2E9uL0

Decrypted: Hello, world! 🌍

24 characters for 18 bytes of input — exactly what you'd expect from base64.

XOR with the same key twice, and you're back where you started.