RC4 Encryption & Decryption
Encrypt or decrypt legacy data with the RC4 stream cipher.
RC4 is weak by today's standards — use it to read old data; for new data use AES or ChaCha20. Go to AES
You'll need it again to decrypt. Nothing you type leaves this page.
OpenSSL's default is 10,000. Any number works: more makes the password slower to guess; decrypting needs the same number.
openssl enc -rc4 -pbkdf2 -iter 10000 -a -A -provider legacy -provider defaultOpenSSL asks for the password; paste the text into it, or add -in and -out files.
RC4, also called ARC4 or ARCFOUR, is the stream cipher once used in SSL/TLS and WEP Wi-Fi. It has no blocks, no mode and no IV: it turns the key into a stream of bytes and XORs it with the text, so the ciphertext is exactly as long as the text. This page encrypts and decrypts text with RC4 using a password in the openssl enc -pbkdf2 format or a hex key of 40 to 2048 bits (128 by default), so you can read data from old systems or produce it for them. RC4 is broken; for new data use AES or ChaCha20. Everything runs in your browser: text and keys never leave your device, and it's free with no sign-up.
How to decrypt RC4 text
- Choose Decrypt and paste the Base64 or hex text — the format is detected automatically — or choose Encrypt and type text.
- Enter the password, or switch to Key & IV (hex) and enter the key; RC4 has no IV, so there is only a key field.
- Pick the key length the data was made with: 128 bits unless you know otherwise, 40 for export-grade RC4.
- Copy or download the result, or press Swap to move it into the input and flip the direction.
Features
- RC4 with any key length from 40 to 2048 bits in 8-bit steps; 40, 128, 256 and 2048 one click away
- No IV, no padding: the ciphertext is exactly as long as the text
- Password mode in the openssl enc -pbkdf2 format, with the rc4 or rc4-40 command for OpenSSL's legacy provider
- Key & IV (hex) mode with just a key, typed or generated
- Base64 or hex in and out; results that aren't text are shown as hex
Is it private?
Yes. RC4 runs in WebAssembly inside your browser; the data you decrypt and its key or password are never uploaded or saved.
Frequently asked questions
Is RC4 secure?
No. Its key stream has statistical biases that let attackers recover data, which is why RFC 7465 banned RC4 from TLS in 2015. Use it only to read existing RC4 data, and re-encrypt anything you keep with AES or ChaCha20.
Is ARC4 the same as RC4?
Yes. RC4 was designed by Ron Rivest in 1987 and kept as a trade secret; after the algorithm leaked in 1994, others implemented it as ARC4 or ARCFOUR (“alleged RC4”) because the name RC4 is a trademark. The ciphertext is identical.
Can I decrypt it with OpenSSL?
Yes, for 128-bit and 40-bit keys: echo 'U2FsdGVkX1…' | openssl enc -d -rc4 -pbkdf2 -iter 10000 -a -A -provider legacy -provider default, or -rc4-40 for a 40-bit key. In Key & IV mode, use -K <key hex> instead of -pbkdf2 -iter, with no -iv. openssl enc has no other RC4 key lengths.
Is it safe to reuse an RC4 key?
No. The same key always gives the same key stream, so XORing two outputs made with one key cancels the stream and reveals the XOR of the two texts. In password mode this doesn't happen: the random salt gives every message its own key, and the output differs every time. In Key & IV mode, use a new key for every message.
Why do I get unreadable bytes instead of an error?
Because RC4 can't tell a wrong key from a right one: decrypting with the wrong password, iteration count or key length still produces bytes, just random ones, and the page shows them as hex. Check that every setting matches the one used to encrypt.