Right, which is why you would never XOR in this manner, and would hash instead. You don't want the password or content retrievable that easily.