Skip to content
TextArray1.41.0
100% local

RC4 cipher

Encrypt and decrypt text with the RC4 stream cipher and a key — hex out, text back.

Input
Output
Related tools
XOR cipherEncoding & conversion
Vigenère cipherEncoding & conversion
Encrypt text with a passwordEncoding & conversion
Caesar cipherEncoding & conversion
Baudot code translatorEncoding & conversion
Charset detectorEncoding & conversion
RC4 cipher
RC4 is a classic stream cipher: a short key-scheduling step seeds a 256-byte state from your key, then a keystream is generated one byte at a time and combined with the data. The same key that encrypts also decrypts, so this tool does both — encrypt turns your text into lowercase hex, and decrypt reads that hex back into text. The key is always taken as UTF-8 bytes, so any word or passphrase works directly.
Everything is byte-level UTF-8, which means accented text and emoji round-trip losslessly: encrypt a message, hand the hex to someone with the same key, and decrypt restores it exactly. The tally reports how many bytes were processed. Hex input for the decrypt direction tolerates spaces and an 0x prefix, and anything that isn't valid hex produces a calm error rather than a wrong result.
Worth saying plainly: RC4 is cryptographically broken. Its keystream has well-known biases, and practical attacks retire it from any serious use — modern TLS and browsers dropped it years ago. Do not protect anything real with it. What it is still good for is interoperability with old systems that only speak RC4, CTF and cryptography exercises, de-obfuscating strings pulled from legacy binaries or malware configs, and learning how a stream cipher works. For actually protecting a message, use the AES-based encrypt text tool instead.
Everything runs locally in your browser — plaintexts, hex and keys never leave your device, and the key field is masked and never stored.
FAQ
How do I decrypt something I encrypted here?
Paste the hex output, switch the mode to decrypt, and enter the same key. RC4 is symmetric, so the identical keystream that encrypted the text also restores it — spaces and an 0x prefix in the hex are fine.
Is RC4 encryption secure?
No. RC4 is cryptographically broken — its keystream is biased and practical attacks have retired it from TLS and every serious use. Treat it as obfuscation, interop with old systems, or a learning and CTF tool. For real secrecy use the encrypt text tool, which does AES-256 with a key derived from your password.
What does the key format expect?
Whatever you type is read as UTF-8 bytes — a plain word, a passphrase, or accented characters all work. Both sides must use the exact same key, byte for byte, or decryption returns garbage.
Why is my decrypted text full of odd characters?
Almost always a wrong key. RC4 never fails loudly on a bad key — it just produces different bytes, and most byte sequences are not valid text. Double-check the key matches the one used to encrypt.
Is my text or key uploaded anywhere?
No. RC4 runs entirely in your browser, the key field is masked, never persisted, and nothing ever leaves your device.