NQ Vault is an extremely popular app. It has more than 30 million users worldwide and it’s the recipient of many great reviews on Google Play. It’s a free download and pro upgrade costs $19.99.

The app is supposed to help secure your personal data. NQ’s website refers to the mechanism that protects those files as “strong encryption.” Is it? That depends. Do you consider XOR strong encryption?

XOR is a pretty common component in complex ciphers. By itself, XOR is easy to implement and requires little processing power. With a constant repeating key, it can be a quaint hack with which to hide files. As a security hacker recently discovered, this is how NQ implements its file protection.

ninjadoge24 encrypted a small png image using NQ Vault. He then examined the file in a hex editor. To his surprised it was only partially encrypted. It struck him as a substitution pattern. A thought quickly entered his head: “What if it’s just XOR? Like just fuckin’ XOR?”

To test his hunch, he entered the hex value of the unencrypted file into a hex calculator and applied XOR to it. Guess what? It matched the NQ Vault’s “encrypted” values.

Decrypting XOR is trivial. If you visit ninjadoge24’s blog, he’ll show you how to brute force your way through it.

Honestly, this should be considered a mother fscking crime. NQ claimed this app used “strong encryption” but you could bust it with all the computing power that’s generated by a hamster wheel.