RC4

RC4 is a stream cipher designed by Ron Rivest in 1987 — simple and fast, but with serious biases; it has been banned from TLS and other protocols.

Purpose

It provided padding-free, high-speed stream encryption and was once widely used in SSL/TLS and WEP, but was retired due to security flaws.

Mechanism

The KSA (key scheduling algorithm) permutes a 256-byte S-box with the key; the PRGA (pseudo-random generation algorithm) swaps two S-box entries per byte and emits one keystream byte, XORed with the plaintext. The first several keystream bytes show statistical biases.

Use cases

Legacy WEP/WPA Wi-Fi encryption
Old SSL/TLS (now disabled)
Historical Office/PDF encryption
Teaching example (stream-cipher flaws)

Examples

Input
```
key="Secret", data="Hi"
```
Output
```
ciphertext byte stream
```
Insecure; do not use in new systems

Common errors

Using RC4 in new systems: Use AES-GCM or ChaCha20-Poly1305

Related terms

The Advanced Encryption Standard (AES) is the symmetric block cipher NIST standardized in 2001, supporting 128/192/256-bit keys, and is the de facto standard of modern encryption.

ChaCha20 is a stream cipher designed by Daniel Bernstein, built on ARX (add-rotate-XOR) operations, and is commonly paired with Poly1305 as an AEAD — a high-performance alternative to AES-GCM.

A stream cipher encrypts byte by byte or bit by bit, XORing a keystream with the plaintext; it needs no padding and suits real-time and streaming data.

Related tools

Encrypt text with RC4 stream cipher using crypto-js. Free, private, and 100% client-side.

Decrypt RC4-encrypted data using crypto-js. Free, private, and 100% client-side.

References