RC4 Encryption (Legacy)
Encrypt text with the RC4 (ARC4) stream cipher using an OpenSSL-compatible passphrase or a raw hex key. For legacy compatibility and test vectors only.
Output uses the OpenSSL "Salted__" format in Base64: an 8-byte random salt followed by the ciphertext. Key and IV are derived from the passphrase and the salt, so the same text gives a different result every time. Equivalent command:
The passphrase is turned into a 128-bit RC4 key, as OpenSSL does. CryptoJS.RC4 with a passphrase uses a 256-bit key instead, so its output cannot be decrypted here.
openssl enc -rc4 -md md5 -a -A -provider legacy -provider default -k '…'Runs entirely in your browser. Your data is never uploaded.
What is RC4 Encryption?
Encrypts data with RC4 (also called ARC4 or ARCFOUR), a stream cipher once used in WEP, early TLS and many file formats. The output has the same length as the input because RC4 XORs the data with a keystream.
How to use RC4 Encryption
- Choose Passphrase (OpenSSL-compatible) and type a passphrase, or Raw key + IV (hex) and enter a 1–256 byte key in hex (RC4 uses no IV).
- Type or paste the Plaintext.
- Click Encrypt and choose Base64 or Hex as the Output encoding.
- Copy the ciphertext.
Example
Raw key 4b6579 ("Key"), plaintext "Plaintext", Hex output bbf316e8d940af0ad3
The classic RC4 test vector.
When to use RC4 Encryption
Use it to interoperate with old software or to check RC4 test vectors (RFC 6229). Never use RC4 for new encryption; the first keystream bytes leak information about the key and there is no integrity check.
How RC4 Encryption works
RC4 builds a 256-byte permutation from the key (key-scheduling algorithm) and then generates one keystream byte per input byte, which is XORed with the plaintext. Raw mode uses your key bytes directly (1–256 bytes). Passphrase mode derives a 16-byte key from passphrase and a random salt like openssl enc -rc4 (EVP_BytesToKey MD5 or PBKDF2-SHA256) and outputs the Salted__ format. Encryption and decryption are the same operation.
Common Use Cases
- Verify RC4 test vectors such as Key/Plaintext → BBF316E8D940AF0AD3
- Produce data for a legacy application that uses ARC4
- Study why WEP and RC4 in TLS were broken
- Recreate
openssl enc -rc4output
Security Note
RC4 is broken: its keystream has strong statistical biases and RFC 7465 prohibits it in TLS. It provides no integrity protection. Use it only for legacy data.
FAQs
Why can't I decrypt CryptoJS.RC4 output made with a passphrase?
CryptoJS derives a 256-bit RC4 key from a passphrase, OpenSSL derives a 128-bit key. This tool follows OpenSSL. With a raw key both produce identical results.
Does RC4 use an IV?
No. That is why reusing the same key for two messages is catastrophic: XORing the two ciphertexts cancels the keystream. Passphrase mode avoids that by using a random salt each time.
Which OpenSSL command matches?
openssl enc -rc4 -md md5 -a -A -provider legacy -provider default -k <passphrase> (OpenSSL 3 needs the legacy provider).