What Is a One-Time Pad? Encryption and OTP Explained

A one-time pad encrypts a message using a secret random key as long as the message, with fresh pad material for every encryption. Under strict conditions, observing its ciphertext gives an attacker no additional information about the message.

The abbreviation OTP can also mean a login password or passcode. A one-time pad, a login OTP, and a link that opens once solve different problems.

Conditions for a true one-time pad

For an n-bit message, the binary construction requires n fresh secret pad bits:

Sample the pad uniformly: every n-bit key must have the same chance of selection.
Generate it independently of the message and other pad material.
Keep it secret from the observer.
Use each pad segment to encrypt only one message. Never reuse overlapping segments for another encryption.

These assumptions underpin the security proof in Mike Rosulek's one-time pad chapter. A memorable phrase or repeating key does not satisfy them.

A four-bit XOR example

XOR, written ⊕, produces 0 when two bits match and 1 when they differ. Encryption combines the message and pad; decryption applies the same pad again.

Step	Operation	Result
Encrypt	`1010 ⊕ 0110`	`1100`
Decrypt	`1100 ⊕ 0110`	`1010`

Here the message is 1010, the pad is 0110, and the ciphertext is 1100. Repeating the XOR cancels the pad. This example illustrates the mathematics; real messaging also needs secure key handling and authentication.

What perfect secrecy actually means

In Claude Shannon's original paper, section 10, perfect secrecy means that learning the ciphertext leaves the observer's probabilities for messages unchanged.

This does not require all messages to be equally likely. If one same-length message was more plausible beforehand, it can remain more plausible afterward. The ciphertext contributes no further evidence. The usual fixed-length model also does not hide traffic timing, participants, or message length.

Why pad reuse breaks the guarantee

If two same-length messages use the same pad K, then C1 = M1 ⊕ K and C2 = M2 ⊕ K. Combining their ciphertexts cancels K:

C1 ⊕ C2 = M1 ⊕ M2

The attacker learns a relationship between the messages. This does not automatically reveal both complete texts. However, a known plaintext segment exposes the matching pad segment and the corresponding part of the other message. Predictable structure can also help an attacker test guesses.

Practical limits beyond the equation

Both parties must already share enough secret pad material. They must protect its storage, keep their positions synchronized, and prevent used segments from being applied again. Key distribution grows with the amount of information sent; the XOR operation does not solve that problem.

A pad alone provides neither integrity nor sender authentication. Changing a ciphertext bit changes the corresponding decrypted bit, without a built-in warning. Confidentiality alone cannot establish who sent a message or whether it was altered.

One-time pad vs login OTP vs one-view link

Term	Purpose	Meaning of “one-time”
One-time pad	Encrypt message content	Pad material is used for one encryption
Login OTP	Authenticate possession of an authenticator	A generated code is accepted once while valid
One-view link	Limit access through a service	New reveals stop after a successful unlock

NIST's authenticator guidance, section 3.1.4, describes login OTPs generated using an authenticator secret and a time value or counter. They authenticate; they are not pads for encrypting messages.

Where LOCK.PUB fits

LOCK.PUB's One-Time Secret applies an access policy. It does not implement a one-time pad or provide end-to-end encryption: the server processes memo plaintext. A successful password reveal blocks new reveals; it does not delete stored content or recall downloads, screenshots, or other copies.

For practical sharing, read the secret memo guide. The encryption at rest vs in transit guide explains the different trust boundaries.

Frequently asked questions

Is a one-time pad unbreakable?

The ideal scheme provides perfect secrecy under its assumptions. Exposed pads, reused segments, compromised endpoints, and tampering require separate consideration.

Can a short seed produce a true pad?

A secure pseudorandom generator can expand a short seed into a longer mask, offering computational security under assumptions. Its output is not uniformly distributed over all longer strings, so it does not provide the pad's perfect secrecy.

Does “one-time” mean the message disappears?

For a pad, it describes key usage. For a link, it describes access. Neither term alone proves deletion or removes copies someone already made.