I will approach the question from practical side. All the examples are not real, but for illustration purpose only.

I have a message, the secret Bitcoin key, which I want to store safely.

MESSAGE = KwjwmREseNZmZ8yeNKrurN6qPuh9FhrLAefYa2nTLafLkGmWW9ta

To do this I come up with 4 keys which look independent, somewhat private, and can be recovered.

Key 1 is a set of last words from page 100 and up in my favorite book to match the message length

KEY1 ='help knows the at sortes state the citizens color science costs unfairness'

Key 2 is the Merkle Root from Bitcoin blockchain block number 121047, which could be my 2 kids birthdays 121 and 047 (for the day number within year easily available at blockchain.info)

KEY2='1b28458e4191e60f4553357cb7b54a9cc15ea0a27e8f5df27dab6d3aab3d3be4'

Key 3 is the name of the file of my main wedding photograph, stored in my albums, mail, and shared with friends.

KEY3='IMG_20170511_144510.jpg'

Key4 is another bitcoin address generated solely for the purpose of being a key, two copies will be stored in home safe and safety deposit box in the bank

KEY4='L1jkNAKpG1hu7omtYW6fFFDGw1AaYrdkiUr4NpBANziKVHdZgx8v'

The keys are not re-used anywhere. KEY3 is replicated to match the length of the message. The message and all keys are XORed (byte by byte) to get the secure code.

The question is: How safe is the resulting code? Can I store it online? Can security hold if 1 or 2 keys (but no more) are compromised?

I understand that there might be no correct answer, but would appreciate any thoughts if I miss some vulnerabilities. Should I have more keys? What kind of keys would help? Can I mix in more plain text keys?

If you ask why not to use a password with good encryption, it is trickier for me to verify the program doing the encryption, while doing XOR is trivial in HTML with few lines of JavaScript on any old offline smart phone (to be destroyed afterwards), and will be trivial in the future.

Thanks

PS. I can try to figure out how to post the HTML doing the job if anyone is interested

I will approach the question from practical side. All the examples are not real, but for illustration purpose only.

I have a message, the secret Bitcoin key, which I want to store safely.

MESSAGE = KwjwmREseNZmZ8yeNKrurN6qPuh9FhrLAefYa2nTLafLkGmWW9ta

To do this I come up with 4 keys which look independent, somewhat private, and can be recovered.

Key 1 is a set of last words from page 100 and up in my favorite book to match the message length:

KEY1 = help knows the at sortes state the citizens color science costs unfairness

Key 2 is the Merkle Root from Bitcoin blockchain block number 121047, which could be my 2 kids' birthdays 121 and 047 (for the day number within year easily available at blockchain.info)

KEY2= 1b28458e4191e60f4553357cb7b54a9cc15ea0a27e8f5df27dab6d3aab3d3be4

Key 3 is the name of the file of my main wedding photograph, stored in my albums, mail, and shared with friends.

KEY3= IMG_20170511_144510.jpg

Key4 is another Bitcoin address generated solely for the purpose of being a key, two copies will be stored in home safe and safety deposit box in the bank

KEY4= L1jkNAKpG1hu7omtYW6fFFDGw1AaYrdkiUr4NpBANziKVHdZgx8v

The keys are not re-used anywhere. KEY3 is replicated to match the length of the message. The message and all keys are XORed (byte by byte) to get the secure code.

The question is: How safe is the resulting code? Can I store it online? Can security hold if 1 or 2 keys (but no more) are compromised?

I understand that there might be no correct answer, but would appreciate any thoughts if I miss some vulnerabilities. Should I have more keys? What kind of keys would help? Can I mix in more plain text keys?

If you ask why not to use a password with good encryption, it is trickier for me to verify the program doing the encryption, while doing XOR is trivial in HTML with few lines of JavaScript on any old offline smart phone (to be destroyed afterwards), and will be trivial in the future.

Thanks.

PS. I can try to figure out how to post the HTML doing the job if anyone is interested.