b2KIT

Encryption Playground

Interactive tool to experiment with different encryption algorithms (AES, DES, RC4, Blowfish) and compare their outputs.

Tested tool guide Tested browser tools Checked August 16, 2026

What Encryption Playground does, with a checked example

Type a message and a key, pick AES, DES, RC4, or Blowfish, and the playground returns the ciphertext, computed locally in your browser, so you can compare all four side by side. The block ciphers (AES, DES, Blowfish) encrypt fixed-size chunks and pad the final chunk, so their output is always longer than your message; RC4 is a stream cipher that XORs a keystream through the bytes and keeps the length. Users most often get caught by expecting similar-looking outputs: the same message and key produce outputs of different lengths, because the block ciphers pad and RC4 does not, and "it won't decrypt" is usually a padding or encoding mismatch, not a broken cipher.

Worked example

A concrete input and expected output from the current implementation.

Input

Message: Plaintext | Key: Key | Algorithm: RC4

Expected output

EB9F7781B734CA72A7 (hex ciphertext, 9 bytes)

RC4 stretches the key into a pseudorandom keystream and XORs it with the plaintext, so ciphertext length equals input length. For the key "Key" the keystream starts BBF316E8D940AF0AD3; XORing the nine bytes of "Plaintext" (hex 506C61696E74657874) with it gives EB9F7781B734CA72A7. This is the classic published RC4 test vector, so you can use it to check the playground against any other RC4 implementation.

How the result is produced

1

Block ciphers pad, stream ciphers do not

AES works on 16-byte blocks; DES and Blowfish on 8-byte blocks. Messages not an exact multiple of the block size are padded (usually PKCS#7, which adds at least one byte), so ciphertext length rounds up to a block boundary. RC4 instead stretches the key into a pseudorandom keystream and XORs it byte by byte, so ciphertext length always equals plaintext length. That is the main reason the four outputs differ.

2

Keys, modes of operation, and repeatability

AES accepts 128-, 192-, or 256-bit keys; DES uses 56 effective key bits; Blowfish takes 32 to 448 bits. In ECB mode each block is encrypted independently, so identical plaintext blocks yield identical ciphertext blocks; in CBC mode each block is XORed with the previous ciphertext, beginning with an initialization vector (IV). If the tool generates a fresh random IV, the same text re-encrypted produces different ciphertext that decrypts correctly.

Good uses

  • Verifying another tool or library: encrypt the same key and message here and compare hex strings. A mismatch usually means a different mode, IV, or encoding (hex versus base64), not a wrong key.
  • Demonstrating why ciphers age out: encrypt the same text under DES, RC4, and AES and compare key sizes and output lengths, making visible at a glance the small key space and fixed structure the older ciphers are stuck with.
  • Forecasting ciphertext sizes before building a protocol: pad or truncate a message and watch AES and DES outputs round up to block multiples while RC4 tracks input length exactly, the same behavior you meet in real record-based protocols.

Limits and checks

  • Length is not strength: a one-byte message becomes 16 bytes under AES (padding) but stays one byte under RC4. Longer or shorter ciphertext says nothing about how secure the result is, and the pad bytes are part of the format, not the secret.
  • Non-repeatable output: with a random IV in CBC mode, the same input gives a different hex string on every run. Both outputs are correct and decrypt to the same text; to reproduce a result byte for byte you need a fixed IV or ECB mode.
  • DES and RC4 are broken, not merely old: DES's 56-bit key space was brute-forced in 1998, and RC4's keystream biases enable practical attacks. An unreadable-looking result from this playground demonstrates mechanics, not security, so never use these two for real data.

Common questions

Why is my AES ciphertext longer than the text I typed?

AES, DES, and Blowfish are block ciphers that encrypt whole blocks only (16 bytes for AES, 8 for the others). The final partial block is padded, usually PKCS#7, so ciphertext rounds up to a block multiple and is always longer than the input. RC4, a stream cipher, returns exactly the input length. If shown as hex, the string doubles the visible length: one byte is two characters.

Can I use DES or RC4 to protect real data?

No. DES's 56-bit key space was brute-forced in 1998 (the EFF DES Cracker), and RC4 has exploitable keystream biases behind practical attacks on WEP and TLS. Blowfish is not broken but AES is standardized, faster, and hardware-accelerated. Use AES in a proper mode with a random IV (or ChaCha20), and treat this playground's output as a demonstration, not a recommendation.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools