How safe is XOR with multiple independent but non random keys? I will approach the question from practical side. All the examples are not  real, but for illustration purpose only.

I have a message, the secret Bitcoin key, which I want to store safely.

MESSAGE = KwjwmREseNZmZ8yeNKrurN6qPuh9FhrLAefYa2nTLafLkGmWW9ta

To do this I come up with 4 keys which look independent,  somewhat private, and can be recovered.

Key 1 is a set of last words from page 100 and up in my favorite book to match the message length:

KEY1 = help knows the at sortes state the citizens color science costs unfairness

Key 2  is the Merkle Root from Bitcoin blockchain block number 121047, which could be my 2 kids' birthdays 121 and 047 (for the day number within year easily available at blockchain.info)

KEY2= 1b28458e4191e60f4553357cb7b54a9cc15ea0a27e8f5df27dab6d3aab3d3be4

Key 3 is the name of the file of my main wedding photograph, stored in my albums, mail, and shared with friends.

KEY3= IMG_20170511_144510.jpg

Key4 is another Bitcoin address generated solely for the purpose of being a key, two copies will be stored in home safe and safety deposit box in the bank 

KEY4= L1jkNAKpG1hu7omtYW6fFFDGw1AaYrdkiUr4NpBANziKVHdZgx8v

The keys are not re-used anywhere. KEY3 is replicated to match the length of the message. The message and all keys are XORed (byte by byte) to get the secure code. 

The question is:  How safe is the resulting code?  Can I store it online? Can security hold if 1 or 2 keys (but no more)  are compromised?   

I understand that there might be no correct answer, but would appreciate any thoughts  if I miss some vulnerabilities.  Should I have more keys? What kind of keys would help? Can I mix in more plain text keys?

If you ask why not to use a password with good encryption, it is trickier for me to verify the program doing the encryption, while doing XOR is trivial in HTML with few lines of JavaScript on any old offline smart phone (to be destroyed afterwards), and will be trivial in the future.

Thanks.

PS. I can try to figure out how to post the HTML doing the job if anyone is interested.
How safe is the resulting code? Can I store it online?


Very unsafe. No matter how you come up with these keys (passphrases, really), it will have extreme biases. These biases are going to be enough to make some pretty good guesses about your plaintext. This is what makes RC4 insecure in the WEP protocol, and RC4's biases are comparatively minor.  

This also has the problem that passwords in general have, which is that you as a human can't accurately remember complex passwords. You'll have to either write them all down (in which case they can be discovered) or use some scheme which actually lowers their strength (your keys 1 through 3).


  Can security hold if 1 or 2 keys (but no more) are compromised?


For every key that is discovered, the biases of the other keys become more apparent. If 2 keys are discovered (particularly keys 2 and 4) it becomes pretty much a puzzle you find in a newspaper to solve.

My advice is to stick to known algorithms. If you need to encrypt something with a password, use something like bcrypt to expand your password into a high-entropy key, then use that key to encrypt with something like AES in a good mode like CTR.