Micro Tools
Advertisement

Rabbit cipher encrypt and decrypt

Encrypt and decrypt text with Rabbit, a fast stream cipher from the eSTREAM portfolio, running entirely in your browser.

Input

Rabbit stream cipher with an OpenSSL-style key derivation from your passphrase.

The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
Rabbit

The result appears below. Keep the full ciphertext string to decrypt.

-
Advertisement

eSTREAM portfolio cipher

Rabbit was designed by Martin Boesgaard and colleagues and selected for the eSTREAM software portfolio in 2008. It keeps eight 32-bit state variables plus counters, updating them with coupled nonlinear functions to produce a keystream that is XORed with the plaintext. It was built for speed: a few cycles per byte on typical CPUs.

Stream cipher notes

As a stream cipher, Rabbit must never reuse a key-IV pair: keystream reuse leaks the XOR of the plaintexts. This tool derives its key setup from your passphrase with an OpenSSL-style key derivation; always use a fresh passphrase per message in real protocols.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

Rabbit Cipher FAQs

What is Rabbit used for?
It was standardized in the eSTREAM portfolio for fast software encryption and appears in some TLS-adjacent and media-streaming contexts, though AES-CTR and ChaCha20 dominate today.
Rabbit vs RC4?
Both are stream ciphers, but Rabbit has no known practical attacks while RC4 is thoroughly broken. Neither matches modern AEAD ciphers like AES-GCM or ChaCha20-Poly1305.
Why must keys not be reused?
Reusing a keystream means ciphertext1 XOR ciphertext2 equals plaintext1 XOR plaintext2, which leaks both messages. Always use a unique key or IV per encryption.
How is the key derived here?
CryptoJS applies its OpenSSL-compatible EVP_BytesToKey derivation to your passphrase with a random salt, shown in the Base64 output header.
Local computation?
Yes. Rabbit runs in JavaScript from a CDN library; nothing is uploaded.
Advertisement