Toolbox101 All tools

Cryptography

Encrypt text with the Rabbit stream cipher

Rabbit Encrypt scrambles text with the Rabbit stream cipher, keyed from a passphrase, and returns the salted Base64 format the other passphrase ciphers here share. Rabbit is an eSTREAM finalist that CryptoJS ships alongside AES and RC4: 128-bit key, 64-bit IV and no padding, so the output length follows the plaintext once the Salted__ header is removed. Use it to move data between systems that speak Rabbit or to compare it with ChaCha20.

Open Rabbit Encrypt in the app Browse all tools

How to use Rabbit Encrypt

  1. Open Rabbit Encrypt in the Toolbox101 app.
  2. Type or paste the plaintext into the Message box. The ciphertext is the same length plus a 16-byte salt header.
  3. Type the passphrase into the Passphrase box. Rabbit Decrypt needs the same one, so store it safely.
  4. Read the ciphertext in the Output box as it updates; it is salted Base64 starting with U2FsdGVkX1.
  5. Click Copy to put the ciphertext on your clipboard.

Worked example

Rabbit Encrypt gives a different result every time, so yours will differ. This is one run:

Input

Rabbit cipher round-trip

Key

rabbit-demo-key

Output

U2FsdGVkX1/ILRmnwEHAA87H+oJtyxA8lPd8JDGkHYsgpPtl+QQEUA==

Frequently asked questions

What is the Rabbit cipher and how does it work?

Rabbit is a synchronous stream cipher designed by Boesgaard and others in 2003 and selected for the eSTREAM portfolio. It uses a 128-bit key and 64-bit IV, is fast in pure software, and had no known practical attacks at its last review; CryptoJS is the implementation most JavaScript tools share.

Can other software decrypt this tool’s output?

Only software that implements Rabbit with the same keying scheme: a passphrase run through the MD5-based OpenSSL derivation with the 8-byte salt stored in the ciphertext. OpenSSL, Web Crypto, and most cloud KMS services do not implement Rabbit at all, so pairing with CryptoJS-based tools is the practical route.

How is Rabbit different from RC4?

Both are stream ciphers, but Rabbit is a later design with a documented 64-bit IV and no practical attack, where RC4’s keystream biases are exploited in the wild. Rabbit also never shipped at RC4’s scale, so you will mostly meet it in CryptoJS-based code rather than network protocols.

Why is the ciphertext different every time?

Each run draws a fresh random 8-byte salt that is stored in the output after the Salted__ marker, and the key and IV are derived from your passphrase plus that salt. Identical plaintext and passphrase therefore never encrypt to the same string, while any single output still decrypts to the original.

Use Rabbit Encrypt now

Open Rabbit Encrypt in the app

Runs in your browser. Nothing you type is uploaded.