RC4 Encryption

RC4 encryption online

RC4, also known as ARC4, is a legacy stream cipher that combines plaintext with a generated keystream. It has exploitable statistical biases; RFC 7465 prohibits RC4 cipher suites in TLS. Use this tool only for legacy compatibility, test vectors, or data recovery.

How to use this tool

Choose text, a local file, or URL content and its encoding. Enter exact key bytes or configure a passphrase KDF, including its hash, salt, iterations, and derived-key size. Set Drop to the number of initial keystream bytes discarded by the target implementation, then copy or download the Hex or Base64 ciphertext.

Matching cipher parameters

The key material, KDF settings, and Drop value must match the receiving implementation or RC4 decryption. Hex and Base64 only represent ciphertext bytes. RC4 uses no block mode, padding, or IV in this tool.

Never reuse the same RC4 keystream for different plaintexts. Dropping initial bytes changes compatibility with variants such as RC4-drop, but it does not remove RC4’s fundamental weaknesses or make it suitable for new systems.

Use the standalone PBKDF2 or EvpKDF tools when you need to inspect derived bytes separately. This RC4 tool uses the derived bytes directly as RC4 key material when passphrase mode is selected.

Security warning

RC4 is obsolete and provides no authentication tag. Modified ciphertext decrypts to modified plaintext without dependable detection. Prefer a modern authenticated design such as AES encryption, and avoid processing production secrets on an untrusted device or browser.

Frequently asked questions

Why can I not decrypt the result elsewhere?

Compare the Drop value, key bytes or passphrase, KDF, hash, salt, iterations, derived-key size, plaintext encoding, and ciphertext encoding. RC4 does not use an IV, block mode, or padding.

Does encryption detect tampering?

No. RC4’s XOR operation provides confidentiality only and cannot verify the source or integrity of the ciphertext.