if I use an one time pad key generated using a cryptographically secure random source like python's secret module , to encrypt a message, will the one time pad scheme be secure?

I think the entire security of one time pad scheme will depend on cryptographically secure random source, since such randomness is already used for iv , nonces in modern cryptography , my one time pad should be secure enough right?

  • $\begingroup$ Secure maybe, but how does the recipient decipher? If that's by XOR with the key, how do they get the key? $\endgroup$
    – fgrieu
    Jul 22 at 11:11
  • $\begingroup$ I came across a password manager which claims to use One Time Pad for security. They store key and ask for password from user which is used to derive or generate passwords for multiple accounts. Sorry for bad english i dont know how to describe it is from here i read github.com/Anish-M-code/PyPass $\endgroup$ Jul 25 at 14:04
  • $\begingroup$ Don't trust any encryption program with a short or otherwise memorable key (or master password) that promises security with the One Time Pad. That just can't be: absent other crypto, knowing plaintext/cipertext pairs (here, actual password/database entry) reveals some or all of the key (or master password), and enough of that allows to decipher other database entries into the real password. $\endgroup$
    – fgrieu
    Jul 25 at 14:33
  • $\begingroup$ @fgrieu the program described by OP uses master password as plaintext , generates random key unique for a given account , and program encrypts plaintext and random key using one time pad cipher to generate password for particular account. It looks secure $\endgroup$ Aug 14 at 14:05

1 Answer 1


No. One time pads have to be generated from a physical entropy sources like diodes, radioactivity, e.t.c. You are only creating a stream cipher if you use the secrets module as that draws upon an underlying cryptographically secure pseudo random generator.

This style of question appears over and over, so reading through those tagged with OTP is a must.

my one time pad should be secure enough right?

Most of the time yes. But there are those who believe in the virtues of information theoretic security for extreme use cases. Also see quantum key distribution for much more sophisticated models.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.