About the XOR and RC4 Cipher
This tool applies two classic stream ciphers to text. XOR combines each byte of your message with the matching byte of a key, repeating the key as needed. RC4 builds a stream of pseudo-random bytes from the key and combines that stream with your message. Both work the same way in either direction, so the same key that encrypts will decrypt. Enter a key as text or hex, choose hex or Base64 for the encrypted bytes, and see the result at once. Everything runs in your browser. Both ciphers are old and weak, so use them for learning, puzzles and compatibility with old systems rather than for real secrets.
Updated September 2026
How to use the XOR and RC4 Cipher
- 1Choose XOR or RC4, then Encrypt or Decrypt.
- 2Enter the key, and say whether it is text or hex bytes.
- 3Pick whether encrypted bytes are shown as hex or Base64.
- 4Type or paste your text (to encrypt) or the encrypted bytes (to decrypt).
- 5Copy the result. For RC4 you can also discard the first bytes of the keystream.
How stream ciphers work
A stream cipher produces a sequence of key bytes and combines them one by one with the message bytes. With XOR the key bytes are simply the key repeated. With RC4 they come from a generator that is started by the key. Because the combining step is XOR, running the same process again removes it, which is why there is no separate decrypt algorithm.
The message is converted to bytes with UTF-8 before encryption, so an accented letter takes two or more bytes. The encrypted bytes are not readable text, so they are shown as hex or Base64.
Common uses
- Learning: see exactly what XOR and RC4 do to a message, step by step, with your own key.
- Puzzles and capture-the-flag exercises that use a repeating XOR key or RC4 with a known key.
- Checking data from an old system or file format that used RC4, by comparing your output with a sample.
- Teaching why short repeating keys are weak: encrypt a long text with a one-letter key and look at the pattern.
Getting the same result as another tool
Most mismatches come from the key or the output format. Check whether the other tool reads the key as text or as hex, whether it adds an initial discard for RC4, and whether it shows hex in upper or lower case (case makes no difference here). Also check line endings in the message: a hidden newline changes the result.
The Hash Generator and the Base64 Encoder and Decoder are useful partners when you work with encrypted bytes, because you can fingerprint or re-encode the result.
Privacy and limits
Nothing is sent to a server, and your key stays on your device. Keep in mind that these are not modern encryption methods. They do not hide the message length, they have no authentication, and RC4 has known weaknesses. The page works on phones and computers without installing anything. For fingerprints use the Hash Generator, and the Base64 Encoder & Decoder turns bytes into text. For plain text codes the Binary Translator is a gentle start, and the Password Generator makes a good key.
Features
- XOR with a repeating key of any length
- RC4 with keys from 1 to 256 bytes, verified against the standard test vectors
- Optional RC4-drop to discard the first bytes of the keystream
- Key entered as text (UTF-8) or as hex bytes
- Encrypted bytes as hex or Base64, with clear errors for bad input
- Shows hex when a decrypted result is not readable text
Frequently asked questions
What is an XOR cipher?
An XOR cipher combines every byte of the message with a byte of the key using the exclusive-or operation. Doing it twice with the same key gives the original back, which is why one operation both encrypts and decrypts. With a short repeating key it is easy to break.
What is RC4?
RC4 is a stream cipher designed in 1987. A key sets up a table of 256 numbers that is stirred to produce an endless stream of bytes, and those bytes are combined with the message using XOR. It was used in early Wi-Fi security (WEP) and in web traffic, and is now considered broken.
Is this safe for protecting passwords or private data?
No. Both ciphers are weak by modern standards and have no built-in check that a message was not changed. For real protection use a modern cipher such as AES with a strong password.
Why do I get strange characters when I decrypt?
The key, the format or the cipher is probably different from the one used to encrypt. A wrong key gives random bytes. When the result is not valid text, the tool shows it in hex so you can still see the bytes.
What does RC4-drop do?
The first bytes of RC4's output are known to be slightly biased. RC4-drop throws away the first 256, 768 or more bytes before encrypting. Enter the same number when decrypting, or the result will be wrong. Leave it at 0 for plain RC4.
Can I use hex for the key?
Yes. Choose Hex next to the key field and type bytes such as 6b 65 79, or 0x6b,0x65,0x79. Spaces, commas and colons are ignored. With Text selected, the key is converted to UTF-8 bytes.