Ruby, 72 bytes

Not super happy with this but that’s okay.

->a,b{[a.size,b.size].max.times{putc (a[_1]||?\0).ord^(b[_1]||?\0).ord}}

Attempt This Online!

R, 136 134 bytes

\(a,b){'+'=nchar;'?'=utf8ToInt;if(+a<+b){j=a;a=b;b=j};s=?a;names(s)=?b;n=names(s);n[is.na(n)]=0;intToUtf8(bitwXor(s,as.numeric(n)),T)}

Attempt This Online!

• There is one little problem with the outputting of the \x00 symbol - it appears as an empty string "", therefore my output shown as a list of characters with the quotation marks.

Python 3.8 (pre-release), 63 bytes

lambda a,b:bytes(map(lambda c,d:c^d,a,b))+a[len(b):]+b[len(a):]

Try it online!

Uiua ^SBCS, 19 12 bytes

⍜∩(⋯-@\0)⬚0≠

Try it!

-7 thanks to Tbw

⍜∩(⋯-@\0)⬚0≠­⁡​‎‎⁡⁠⁡‏⁠‎⁡⁠⁢‏⁠‎⁡⁠⁣‏⁠‎⁡⁠⁣⁡‏‏​⁡⁠⁡‌⁢​‎‎⁡⁠⁢⁡‏⁠‎⁡⁠⁢⁢‏⁠‎⁡⁠⁢⁣‏⁠‎⁡⁠⁢⁤‏‏​⁡⁠⁡‌⁣​‎‎⁡⁠⁤‏‏​⁡⁠⁡‌⁤​‎‎⁡⁠⁣⁢‏⁠‎⁡⁠⁣⁣‏⁠‎⁡⁠⁣⁤‏‏​⁡⁠⁡‌­
⍜∩(     )     # ‎⁡under both; call a function, then another, then invert the first on two things
    -@\0      # ‎⁢convert string to code points
   ⋯          # ‎⁣convert to bits
         ⬚0≠  # ‎⁤are they not equal? (0 as default)

Vyxal, 4 bytes

C÷꘍C

Try it Online!

Because Vyxal auto-pads lol.

Explained

C÷꘍C
C     # convert each character in each string to it's ordinal value
 ÷꘍   # bitwise xor each item
   C  # and convert the result back to characters

Alternatively, using Keg mode:

Vyxal K, 1 byte

꘍

Try it Online!

Perl 5, 14 bytes

sub f{pop^pop}

Try it online!

x86 machine code, 29 bytes

Machine code:

00000034: 31 d2 e3 08 8a 11 41 41 84 d2 e1 fe ac 84 c0 75  1.....AA.......u
00000044: 06 e3 09 89 ce 31 c9 30 d0 aa eb e4 c3           .....1.0.....

Commented assembly:

        .intel_syntax noprefix
        .globl .strxor
        // Doesn't follow standard calling convention.
        // Input:
        //      EDI: Output buffer large enough for longest string
        //      ESI, ECX: Null terminated strings to XOR
        // Output:
        //      NON-null terminated string stored in EDI.
.strxor:
.Lloop:
        // Always clear EDX.
        xor     edx, edx
        // We mark the end of the shorter string
        // by setting ECX to null.
        jecxz   .Lskip_ecx
.Lno_skip_ecx:
        // Read a byte from ECX into DL.
        mov     dl, byte ptr [ecx]
        // Increment twice because LOOPZ decrements.
        inc     ecx
        inc     ecx
        // Was it '\0'?
        test    dl, dl
        // If so, set ECX to NULL by using LOOPZ in place.
        // CMOVZ ECX, EAX also works, but needs P6.
        // This works with i386 and is the same size.
.Lclear_ecx:
        loopz   .Lclear_ecx
.Lskip_ecx:
        // Load from ESI and autoincrement
        lods    al, byte ptr [esi]
        // Test for '\0'
        test    al, al
        jnz     .Lno_swap
.Lswap: // '\0' found
        // If ECX is null, we are at the end of both strings.
        jecxz   .Lend
        // Otherwise, we swap ESI and ECX, and then clear ECX.
        // Set ESI to ECX.
        mov     esi, ecx
        // And set ECX to NULL.
        xor     ecx, ecx
        // fallthrough
.Lno_swap:
        // XOR the two bytes together
        xor     al, dl
        // Store to EDI and autoincrement
        stos    byte ptr [edi], al
        // Loop unconditionally.
        jmp     .Lloop
.Lend:
        ret

Try it online!

The code reads two null terminated strings from esi and ecx, and stores the NON null terminated string in edi.

The logic is probably easier to see in the equivalent C code.

void strxor(char *dst, const char *src1, const char *src2)
{
    for (;;) {
        char x = '\0';
        if (src2 != NULL) {
            x = *src2++;
            if (x == '\0') { // eos
                src2 = NULL;
            }
        }
        char y = *src1++;
        if (y == '\0') {
            if (src2 == NULL) { // both eos
                return;
            } else { // src2 is longer
                src1 = src2;
                src2 = NULL;
            }
        }
        *dst++ = x ^ y;
    }
}

I don't null terminate because null bytes naturally show up in the output and it saves a byte.

I may also add a version with explicit lengths which accepts null bytes, but the solution would be significantly less elegant.

Scala 3, 30 29 bytes

a=>b=>a zipAll(b,0,0)map(_^_)

Try it online

Scala 2, 41 39 38 bytes

Used infix notation to turn .map into just map

a=>b=>a zipAll(b,0,0)map(a=>a._1^a._2)

Inputs and output are lists of integers

Try it online

Husk, 11 bytes

ż§oc-¤nc¤vc

Try it online!

Unfortunately Husk doesn't have a bitwise XOR command (that I could find), so we need to do: arg1 OR (v) arg2 minus arg1 AND (n) arg2, costing an extra 5 bytes...

Stax, 7 bytes

ôM◙L╞@←

Run and debug it

Excel, 158 153 108 bytes

(Not counting closing parens)

Compatibility Notes:

• Minimum version: CONCAT() came to be in later versions of Excel 2016 (from CONCATENATE()).

The Formulae

• Inputs: A1, B1
• A2: =MIN(LEN(A1:B1)), 14
• B2: =LEN(A1)-LEN(B1), 15

Code (124):

=CONCAT(CHAR(BITXOR(CODE(MID(A1,SEQUENCE(A2),1)),CODE(MID(B1,SEQUENCE(A2),1)))))&RIGHT(IF(B2>0,A1,B1),ABS(B2))

One unfortunate caveat is that Excel ignores non-printable characters in cells. Alternatively, if you'd rather I use "\xXX" characters, I have this:

=CONCAT("\x"&DEC2HEX(BITXOR(CODE(MID(A1,SEQUENCE(A2),1)),CODE(MID(B1,SEQUENCE(A2),1))),2))&RIGHT(IF(B2>0,A1,B1),ABS(B2))

at 118 bytes. This just prints all XOR'ed characters as "\xXX" characters and leaves the trailing characters alone. Eg: Hello! and World!! produce \x3F\x2A\x3E\x20\x2B\x00!

How it Works:

1. The SEQUENCE(A2) effectively creates a range of (1..A2). As far as I can tell, I cannot re-use this by caching it in a cell, which is why I had to use it twice.
2. Each item is then converted to numbers with CODE() and BITXOR()ed against each other.
3. The CHAR() converts this to a character, while DEC2HEX(...,2) converts it to a 2 width 0-padded hex number.
4. CONCAT() puts the array together
5. RIGHT(...) tacks on the trailing characters of the longer string.

C (gcc),  44  43 bytes

x(o,r)char*o,*r;{*o|*r&&x(o+1,r+1,*o^=*r);}

Try it online!

Uses recursion, note that to print strings containing the null byte one will have to manage the strings as arrays. (See the footer of the link for an example)

C (gcc),  50  49 bytes

x(o,r)char*o,*r;{*o|*r&&x(o+!!*o,r+!!*r,*o^=*r);}

Try it online!

Slightly safer version (doesn't read past end of strings, requires enough memory to exist past them though - a la strcpy).

C (gcc),  61  60 bytes

x(b,o,r)char*b,*o,*r;{*o|*r&&x(b+1,o+!!*o,r+!!*r,*b=*r^*o);}

Try it online!

As safe as any standard C function taking a buffer, at the cost of a few more bytes.

-1 byte from each thanks to ceilingcat!

C (gcc), ^{60\$\cdots\$ 55} 54 bytes

Saved 2 4 bytes thanks to AZTECCO!!!

Saved a 2 bytes thanks to ceilingcat!!!

#define f(a,b)for(;*a+*b;b+=!!*b)a+=putchar(*a^*b)!=*b

Try it online!

PHP, 36 bytes

[,$a,$b]=$argv;echo"$a\r$b\r",$a^$b;

Usage:

$ php -r '[,$a,$b]=$argv;echo"$a\r$b\r",$a^$b;' -- 'ABCDE' '123';echo
> pppDE

Explanation: first output string A, then carriage return \r, output string B, then another carriage return, then output the XOR (which truncates to the shorter of the 2 strings). Any characters of the longer string will have already been printed.

PHP 7.4, 32 bytes

Using new arrow function syntax.

fn($a,$b)=>($a|$b^$b)^($a^$a|$b)

Explanation: In PHP binary operators, only the | will keep the longest string length and pad with NULs. So we XOR string B with itself, leading to a string with NUL bytes of the same length as B, then OR that with A. This will pad A with NUL bytes and use the length of B, if B is longer than A. We do the same with B, and only then XOR.

Edits:

• arrow function variant
• missed the requirement of outputting the longest string

PowerShell, 86 81 bytes

$k=[char[]]($args[1]);([byte[]]([char[]]($args[0])|%{$_-bxor$k[$i++%$k.Length]}))

Try it online!

-5 bytes thanks to @mazzy

Lua, 105 bytes

i,a,b=0,...print(a:gsub('.',load'i=i+1return a.char((...):byte()~(b:sub(i,i):byte()or 0))')..b:sub(#a+1))

Try it online!

Taking two strings as arguments, this program calls per-character replace on one of them with essentially XOR function, then appends potentially missing fragment from second string (occurs if it is longer) and prints the result. TIO includes test suite.

05AB1E, 8 7 bytes

thanks to Kevin Cruijssen for a byte!

Ç0ζε`^ç

Try it online!

Commented

	 implicit input          ["QQ", "`c345"]

Ç        convert to charcodes    [[96, 99, 51, 52, 53], [81, 81]]
  ζ      Zip with filler ...     [[96, 81], [99, 81], [51, "0"], [52, "0"], [53, "0"]]
 0       ... zero
   ε     Map ...                   [96, 81]
    `      Dump on stack           96, 81
     ^     XOR                     49
      ç    Convert to character    "1"

         implicit output         ["1", "2", "3", "4", "5"]

Python 3.8, 71 bytes

f=lambda a,b:chr(ord(a[0])^ord(b[0]))+f(a[1:],b[1:])if a and b else a+b

Try it online!

Japt, 6 bytes

cÈ^VcY

Try it

cÈ^VcY     :Implicit input of strings U & V
c          :Map the charcodes in U
 È         :by passing each one at index Y through the following function
  ^        :  Bitwise XOR with
   VcY     :  Charcode at index Y in V

Scala, 64 bytes

(a,b)=>(""/:a.zipAll(b,'\0','\0').map(x=>x._1^x._2))(_+_.toChar)

Try it online!

Run with

val f: ((String,String)=>String) = ...
println(f("01","qsCDE"))
...

Uses zipAll to zip the input strings with null bytes as padding, then XORs, finally using foldLeft shorthand /: to turn the whole thing back into a string.

Factor, 48 bytes

: f ( s s -- s ) 0 pad-longest [ bitxor ] 2map ;

Try it online!

Java 10, 109 bytes

(a,b)->{int A=a.length,B=b.length;if(A<B){var t=a;a=b;b=t;A^=B^(B=A);}for(;A-->0;)a[A]^=A<B?b[A]:0;return a;}

I/O as arrays of characters.

Try it online.

Explanation:

(a,b)->{             // Input as 2 character arrays as parameters as well as return-type
  int A=a.length,    //  `A`: the length of the first array `a`
      B=b.length;    //  `B`: the length of the second array `b`
  if(A<B){           //  If the length of `a` is smaller than `b`:
    var t=a;a=b;b=t; //   Swap the arrays `a` and `b`
    A^=B^(B=A);}     //   And also swap the lengths `A` and `B`
                     //  (`a`/`A` is now the largest array, and `b`/`B` the smallest)
  for(;A-->0;)       //  Loop index `A` in the range [`A`, 0):
    a[A]^=           //   Bitwise-XOR the `A`'th value in `a` with, and implicitly cast
                     //   from an integer codepoint to a character afterwards:
      A<B?           //    If index `A` is still within bounds for `b`:
       b[A]          //     XOR it with the `A`'th codepoint of `b`
      :              //    Else:
       0;            //     XOR it with 0 instead
  return a;}         //  Return the modified `a` as result

Note that we cannot use a currying lambda a->b-> here, because we modify the inputs when swapping and they should be (effectively) final for lambdas.

J, 14 bytes

XOR@,:&.(3&u:)

Try it online!

How it works

XOR@,:&.(3&u:)
        (3&u:) strings -> code points
      &.       do right part, then left part, then the inverse of the right part
    ,:         pad shorter one with zeros by making a table
XOR@           XOR the code points
        (3&u:) revert back code points -> string

Python 2, 80 72 69 bytes

lambda*a:''.join(map(lambda x,y:chr(ord(x or'\0')^ord(y or'\0')),*a))

Try it online!

Uneven lengths are annoying...

JavaScript (Node.js), 66 bytes

f=(a,b)=>b[a.length]?f(b,a):(B=Buffer)(a).map((c,i)=>c^B(b)[i])+''

Try it online!

perl -Mfeature=say,bitwise -nl, 22 bytes

$.%2?($;=$_):say$;^.$_

Try it online!

This is way more characters than I first hoped for. If it weren't for those pesky newlines, the 9 character say<>^.<> would do.

How does it work?

For odd input lines, it saves the current line of input (without the trailing newline due to the -n and -l switches) into $;. For even lines, it xors the previous line ($;) and the current line ($_), and prints it. The ^. operator does required bitwise string operation.

Charcoal, 33 bytes

Ｆ⌈ＥθＬι«Ｆθ«≔ζη≔∧‹ιＬκ℅§κιζ»℅⁻｜ηζ＆ηζ

Try it online! Link is to verbose version of code. Takes input as an array of two strings. Explanation:

Ｆ⌈ＥθＬι«

Loop over the longer length of the strings.

Ｆθ«

Loop over the strings.

≔ζη

Save the result of the previous loop, if any.

≔∧‹ιＬκ℅§κιζ

Get the ordinal at the current index, if that is less than the current string.

»℅⁻｜ηζ＆ηζ

Emulate bitwise XOR by subtracting the bitwise AND from the bitwise OR, then convert back to a character.

Raku, 4 bytes

*~^*

Try it online!

Raku has a built-in operator for XORing strings, along with string AND, OR and bitshift. This is a Whatever lambda that takes two parameters.

APL (Dyalog Unicode), 15 bytes

80⎕DR≠⌿↑11⎕DR¨⎕

Try it online!

As the OP clarified that the input codepoints will be in the range of 0-255, it is possible to manipulate the underlying data bits directly. Such a string is guaranteed to have data type 80 (8-bit char array), so we convert it to data type 11 (1-bit boolean array) to access the bits, XOR them, and convert back to data type 80.

80⎕DR≠⌿↑11⎕DR¨⎕  ⍝ Full program, input: two string literals on a line
        11⎕DR¨⎕  ⍝ Convert each string literal to bit array
       ↑         ⍝ Promote to matrix, padding with 0 as needed
     ≠⌿          ⍝ Bitwise XOR
80⎕DR            ⍝ Convert back to 8-bit char array

APL (Dyalog Extended), 17 bytes

⎕UCS⊥≠⌿⍤2⊤↑⎕UCS¨⎕

Try it online!

Well, the task involves converting char to charcode and back AND converting from/to binary, but all current implementations having ⍢ have some quirks so it can't be used here. So here is the very literal implementation of the task.

⎕UCS⊥≠⌿⍤2⊤↑⎕UCS¨⎕  ⍝ Full program, input: two string literals on one line
           ⎕UCS¨⎕  ⍝ Convert to codepoints
          ↑        ⍝ Promote into a 2-row matrix, padding zeros as necessary
                   ⍝ (doing on characters give spaces which is 0x20, not 0)
         ⊤  ⍝ Convert each number to binary
     ≠⌿⍤2   ⍝ Bitwise XOR
    ⊥       ⍝ Convert the binary back to integers
⎕UCS        ⍝ Convert the integers back to chars

Jelly, 4 bytes

O^/Ọ

Try it online!

Takes input as a list of the two strings, e.g. ['abcde', '01234'].

How?

O    # ord: cast to number (automatically vectorizes)
 ^/  # Reduce by XOR. XOR automatically applies to corresponding elements
         and pads as desired to work if the two strings are different lengths
   Ọ # chr: cast to character (vectorizes once again)