Toolbox101 All tools

Cryptography

Decrypt Rabbit ciphertext with a passphrase

Rabbit Decrypt recovers plaintext from Rabbit ciphertext when you give it the passphrase it was encrypted with. It accepts the salted Base64 output of Rabbit Encrypt here and of other CryptoJS-based tools, which helps when you inherit Rabbit-encrypted blobs from an old service and the original encryptor is gone. Rabbit never gained wide standardisation, so ciphertext from unrelated libraries decrypts here only when they derive the key from the passphrase the same way.

Open Rabbit Decrypt in the app Browse all tools

How to use Rabbit Decrypt

  1. Open Rabbit Decrypt in the Toolbox101 app.
  2. Paste the complete ciphertext into the Ciphertext (Base64) box, keeping its U2FsdGVkX1 prefix.
  3. Type the passphrase that produced the ciphertext into the Passphrase box, exactly as it was entered at encryption time.
  4. Read the plaintext in the Output box. An error means the passphrase or the ciphertext is wrong.
  5. Click Copy to save the recovered plaintext.

Worked example

Rabbit Decrypt returns the output below for this combination.

Input

U2FsdGVkX1/ILRmnwEHAA87H+oJtyxA8lPd8JDGkHYsgpPtl+QQEUA==

Key

rabbit-demo-key

Output

Rabbit cipher round-trip

Check it yourself: open Rabbit Decrypt and enter the same input and key.

Frequently asked questions

What happens with the wrong Rabbit passphrase?

The keystream comes out wrong and the result is random bytes that usually are not valid UTF-8, so the tool shows "Could not decrypt". There is no padding check to flag the mistake, so now and then the noise happens to be valid text. Either outcome is the signal to retype the passphrase carefully.

Where does Rabbit ciphertext come from?

Mostly from CryptoJS-based code written when Rabbit was offered alongside AES and RC4 by browser hashing tools, plus niche stream-cipher experiments and old backup payloads. Those tools derive the key from a passphrase with a salted OpenSSL-style scheme, which is exactly the format this page reads.

Is Rabbit safe to keep decrypting into the future?

Rabbit has no known practical break and remains in the eSTREAM portfolio, so stored Rabbit ciphertext is generally still readable by its intended owner. Its smaller cryptanalytic history and lack of formal standards are reasons to prefer AES for new data, not reasons to discard Rabbit payloads you must recover.

How is Rabbit decryption different from RC4 decryption here?

Mechanically identical: both regenerate a keystream from the passphrase-derived key and XOR it with the ciphertext after stripping the salt header. Practically, Rabbit applies a 64-bit IV in its key setup while RC4 does not, so Rabbit ciphertext decrypts only with Rabbit, and the passphrase must match the one used to encrypt.

Use Rabbit Decrypt now

Open Rabbit Decrypt in the app

Runs in your browser. Nothing you type is uploaded.