RC4 Encrypt & Decrypt
Encrypt or decrypt text with the RC4 (ARC4) stream cipher using a text or hex key, with base64 or hex output. Runs in your browser.
Input
Standard RC4 is 0. Drop 768 or 3072 only to match a system that uses RC4-drop.
Output
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/rc4-encrypt-decrypt \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"inputText": "Plaintext",
"direction": "encrypt",
"key": "Key",
"keyFormat": "text",
"drop": "0",
"format": "hex"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `rc4-encrypt-decrypt` tool (RC4 Encrypt & Decrypt) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/rc4-encrypt-decrypt/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="RC4 Encrypt & Decrypt — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
Encrypt or decrypt text with the RC4 (ARC4 / ARCFOUR) stream cipher entirely in your browser. Nothing you type — text or key — is uploaded.
How to use it
- Paste your text (or the ciphertext, when decrypting) into Input.
- Pick Encrypt or Decrypt.
- Enter the Key (1–256 bytes) and choose whether it is plain Text (UTF-8) or Hex.
- Choose whether ciphertext is Base64 or Hex. Output appears in Result.
RC4 XORs your data with a keystream, so encrypting and decrypting are the same operation — the Direction selector only decides how the input and output are read. Plaintext is UTF-8. Key Key with plaintext Plaintext gives bbf316e8d940af0ad3, the well-known test vector.
RC4-drop
Some systems discard the first 768 or 3072 keystream bytes to avoid RC4's early-output bias. Leave this on None unless the other side does the same.
Should I still use RC4?
No, not for new work. RC4 has known keystream biases and was prohibited in TLS by RFC 7465. It also has no integrity check, so a wrong key usually gives garbage rather than an error. This tool exists for reading and producing data for legacy systems. For anything new use AES.
Troubleshooting
- Garbled output when decrypting — the key, key format, ciphertext format or RC4-drop setting differs from the one used to encrypt.
- "not valid UTF-8 text" — the decrypted bytes are binary, which usually means a wrong key.