Micro Tools
Advertisement

RC4 encrypt and decrypt

Encrypt and decrypt text with RC4 in your browser. RC4 is historically important but broken; use this for learning and legacy data only.

Input

RC4 with an OpenSSL-style key derivation. Broken cipher: learning and legacy use only.

The crypto library loads from a CDN on first use, then everything runs locally. Nothing you type is uploaded.
RC4

The result appears below. Keep the full ciphertext string to decrypt.

-
Advertisement

A famous broken cipher

RC4, designed by Ron Rivest in 1987, was the most widely deployed stream cipher in history: it protected WEP Wi-Fi, early TLS and countless protocols with a beautifully simple design of a shuffling 256-byte state. Starting in 2001, biases in its keystream were exploited to break WEP, and by 2015 RFC 7465 prohibited RC4 in TLS entirely.

Why keep an RC4 tool

RC4 remains useful for education, CTF challenges and decrypting legacy captures. Its failure is instructive: small statistical biases, irrelevant in theory, became practical plaintext-recovery attacks at scale. Never protect real data with RC4 today.

Related tools

JSON formatterFormat and validate JSON, privately. Regex testerTest regex live with highlighting. Base64 encoderBase64 encode and decode, plus URL encoder and JWT decoder.

RC4 Cipher FAQs

Is RC4 secure?
No. Practical attacks recover plaintext from RC4-encrypted sessions (notably the 2013 attack on TLS). It is prohibited in modern TLS and Wi-Fi.
What broke RC4?
Statistical biases in the keystream: early keystream bytes leak key information, and long-run biases let attackers recover repeated plaintext like cookies byte by byte.
What replaced RC4?
ChaCha20 and AES-CTR/GCM for stream-like encryption. TLS 1.3 dropped RC4 and all unauthenticated stream ciphers.
Can I decrypt old WEP captures?
This tool handles the raw cipher; WEP adds its own IV and CRC framing, so real captures need WEP-aware tooling like Aircrack-ng.
Private?
Yes, everything runs locally in your browser.
Advertisement