RC4 / ARCFOUR Encrypt & Decrypt Online
The classic (broken) stream cipher, for education and interop.
About this tool
RC4 (also called ARCFOUR) was the internet's most widely used stream cipher for two decades, protecting early SSL/TLS and WEP Wi-Fi. It is beautifully simple — a 256-byte permutation shuffled by the key, then used to generate a keystream — which is why it is a staple of CTF challenges and cryptography courses.
RC4 is also thoroughly broken: biases in its keystream allowed practical attacks, and TLS deprecated it in 2015. Use this tool for interoperating with legacy systems, decoding CTF challenges, and understanding how stream ciphers work — never to protect real secrets. Encryption and decryption are the same XOR operation.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Frequently asked questions about RC4 Stream Cipher
Why is RC4 considered insecure?+
RC4's keystream has statistical biases — some byte values appear slightly more often than random. Given enough ciphertexts of the same plaintext (as in HTTPS cookies), attackers can recover the plaintext. These attacks led all major browsers and TLS to drop RC4 in 2015.
Why is encryption the same as decryption in RC4?+
RC4 generates a keystream and XORs it with the data. XOR is its own inverse, so applying the same keystream again recovers the original. That's why this tool has a single operation rather than separate encrypt/decrypt modes.
Can I use RC4 with a hex key?+
Yes — choose the hex key format to enter binary key material as hexadecimal, or use text mode for a passphrase-style key. The key can be any length from 1 to 256 bytes.
Related tools
AES Encryption
Encrypt text with AES-256 in GCM, CBC, or CTR mode
XOR · BRUTEFORCEXOR Cipher
Bitwise XOR with a repeating key, plus single-byte bruteforce
CHACHA20 · AEADChaCha20-Poly1305
Modern authenticated stream cipher, password-based
SALSA20 · STREAMSalsa20
The stream cipher that ChaCha20 was built from