RC4 Decryption (Legacy)
Decrypt RC4 (ARC4) ciphertext with a raw hex key or an OpenSSL-compatible passphrase (Salted__ format). Base64 or hex input, text or hex output, all local.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
The passphrase is turned into a 128-bit RC4 key, as OpenSSL does. CryptoJS.RC4 with a passphrase uses a 256-bit key instead, so its output cannot be decrypted here.
openssl enc -rc4 -d -md md5 -a -A -provider legacy -provider default -k '…'Runs entirely in your browser. Your data is never uploaded.
What is RC4 Decryption?
Decrypts data encrypted with the RC4 stream cipher, either raw ciphertext with a hex key or the OpenSSL Salted__ Base64 format with a passphrase. Because RC4 is symmetric, decryption regenerates the same keystream and XORs it again.
How to use RC4 Decryption
- Choose the Key source used for encryption and enter the passphrase or hex key.
- Paste the Ciphertext in Base64 or Hex.
- Click Decrypt and read the plaintext (switch to Hex output for binary data).
Example
U2FsdGVkX18CT09IGrybf6B10S7HfLfYRy4mwTI= (passphrase "secret")
Hello, World!
Produced by openssl enc -rc4 -md md5 -a -k secret.
When to use RC4 Decryption
Use it to read legacy RC4 data or check test vectors. A wrong key silently gives random bytes, so verify the result makes sense.
How RC4 Decryption works
The key (raw, or derived from passphrase and salt with EVP_BytesToKey MD5 / PBKDF2-SHA256 into 16 bytes as OpenSSL does) initialises the RC4 state, and the generated keystream is XORed with the ciphertext. RC4 has no padding, so a wrong key cannot be detected directly; the tool reports output that is not valid UTF-8 and lets you view it as hex.
Common Use Cases
- Decrypt values from legacy software that used ARC4
- Check RFC 6229 keystream test vectors
- Read data produced by
openssl enc -rc4 - Teach the XOR property of stream ciphers
Security Note
RC4 is broken: its keystream has strong statistical biases and RFC 7465 prohibits it in TLS. It provides no integrity protection. Use it only for legacy data.
FAQs
Why is the output not readable text?
Either the key is wrong (RC4 cannot tell) or the plaintext is binary. Switch the output encoding to Hex to inspect the bytes.
Is RC4 decryption different from encryption?
No, it is the same XOR operation; this page simply labels the fields for decryption and accepts Base64 or hex input.
Does it support RC4-drop?
No, only plain RC4 as used by OpenSSL, CryptoJS (raw key) and most libraries.