Enter text or compatible Rabbit ciphertext and its passphrase. Select encryption or decryption to produce a copyable result.
Runs locally in your browserOne text box and one passphrase box: Encrypt turns plaintext into a CryptoJS Rabbit ciphertext and Decrypt reads that ciphertext back as UTF-8 text. Everything runs in the page.
The passphrase is not stored anywhere, and every run uses a fresh random salt, so the same text and passphrase produce a different ciphertext each time.
The output is the container CryptoJS writes for passphrase-based ciphers: the eight ASCII bytes Salted__ (U2FsdGVkX1 in Base64), eight random salt bytes, then the ciphertext, all Base64-encoded.
The 128-bit key and the 64-bit IV are derived from the passphrase and the salt with an MD5-based EVP_BytesToKey derivation, so the passphrase is never used as the raw key. Two runs of the same text differ because the salt is new each time - that is expected, not an error.
Rabbit is a stream cipher with no authentication tag, and the page cannot tell an edited ciphertext from a good one: flipping one Base64 character either changed the decrypted text or failed the UTF-8 decoding and showed the error line (both observed while editing single characters).
A wrong passphrase usually fails the UTF-8 decoding and shows the error line, but readable output is not proof of authenticity - compare a checksum when the plaintext matters.
Ciphertext made here is read back by CryptoJS 3.x Rabbit with the same passphrase. OpenSSL ships no Rabbit cipher, so openssl enc cannot decrypt it.
Input is pasted, not uploaded: there is no file picker or URL fetch. In testing a 200 KB input encrypted in about 0.1 s in Chrome, the page made no network request while working, and the output field keeps the result until the next run.