Vigenère Cipher Encoder & Decoder

About the Vigenère Cipher Encoder & Decoder

The Vigenère cipher encrypts a message with a keyword instead of a single shift. Each letter moves along the alphabet by the matching letter of the key: with the key LEMON, the first letter moves by L (11 places), the second by E (4), and so on, and after N the key starts over. One plain letter can therefore come out as several different cipher letters, which flattens the letter counts that give away a simple substitution, and the cipher was long considered unbreakable.

This page encrypts and decrypts with the Vigenère cipher, with its reciprocal cousin the Beaufort cipher, with variant Beaufort, and with an autokey that continues the key with the message itself. Use the normal A–Z alphabet, A–Z with digits, or your own alphabet, including a keyed one as on the Kryptos sculpture. If you have a ciphertext but no key, Find the key takes it apart the way Kasiski and Friedman did: repeated groups of letters and the index of coincidence suggest the key length, and letter counts in each column give away the key letters, step by step.

Common uses

• Solving puzzles, escape-room clues, geocaches, alternate-reality games and capture-the-flag challenges that use a keyword cipher, including the passages of the Kryptos sculpture.
• Teaching and learning how a polyalphabetic cipher hides letter frequencies and how Kasiski and Friedman defeat it, with every step visible.
• Checking homework on modular arithmetic, the Vigenère square and classical cryptanalysis.
• Writing secret notes and clues for treasure hunts and games, with any alphabet you like.

How the cipher works

Number the letters from 0: A = 0, B = 1 … Z = 25. To encrypt, add the number of the key letter to the number of the plain letter and wrap round after Z: C = (P + K) mod 26. With the key LEMON under ATTACKATDAWN, A (0) + L (11) = 11 = L, T (19) + E (4) = 23 = X, and T (19) + M (12) = 31, which wraps round to 5 = F. To decrypt, subtract: P = (C − K) mod 26. The key is repeated as often as needed and moves on only at letters, so spaces and punctuation do not use up key letters.

The same sum can be read off a square of 26 alphabets, each shifted one place further than the one above (the tabula recta): the plain letter picks the column, the key letter picks the row, and the cell holds the cipher letter. Open The square of alphabets under the result to see where each step lands.

• Vigenère: C = P + K.
• Beaufort: C = K − P. The step is its own inverse, so the same operation encrypts and decrypts.
• Variant Beaufort: C = P − K, the Vigenère cipher run backwards. For the same message the two need mirrored keys: each letter k of a Vigenère key becomes 26 − k in the variant Beaufort key (A stays A), so the Vigenère key BABBAGE matches the variant Beaufort key ZAZZAUW.
• Autokey: the key is used once and the message itself then continues it. With the key QUEENLY, ATTACKATDAWN is enciphered with the key letters QUEENLYATTAC. Decrypting recovers the plain letters one at a time and uses them as the next key letters.

The formulas follow the American Cryptogram Association’s descriptions of the Vigenère, Beaufort, Variant and Autokey ciphers.

How Find the key works

1. How long is the key? Three signs are compared for every length from 1 to 30.

• Repeats (Kasiski’s examination). If the same word meets the same part of the key twice, it is enciphered the same way twice, so a group of three or more letters that repeats in the ciphertext is usually a multiple of the key length apart. The tool lists the repeats, the distances between them and the lengths that divide those distances, and compares each length with chance: a length L divides about 1 in L of random distances, so only a count well above that points to it.
• The index of coincidence. This is the chance that two letters picked from a text are the same, Σ f(f − 1) ÷ N(N − 1). English gives about 0.067 and uniformly random letters 1/26 ≈ 0.0385. Write the ciphertext in L columns: when L is the key length, or a multiple of it, every column is an ordinary English text with its letters shifted, so its index rises to about 0.067; for other lengths it stays near the flat value. Friedman’s formula (0.0667 − 0.0385) ÷ (IC − 0.0385) also turns the index of the whole text into a rough key length. It is a guide, not a result, and unreliable for short texts.
• The fit of the best key. For every length the tool finds the best key (see step 2) and counts the bits needed to write the whole decryption with English letter frequencies. A longer key always fits a little better, simply by fitting chance, so every key letter is charged log₂ 26 ≈ 4.7 bits and the length with the lowest total wins.

A length is marked clear only when the gap to the next different key is wide, the columns look like English, the fit is far better than for random letters with the same number of key letters, and it passes the shuffle test. The shuffle test renames the 26 letters of the ciphertext at random (every A becomes some other letter, and so on): the counts stay as uneven as before, but any pattern of shifted alphabets is gone. A real Vigenère ciphertext fits many standard deviations better than its renamed copies; a simple substitution cipher, whose counts look like English without being a shift, looks the same renamed and scores about 0: in our trials of 2,500 such texts none was marked clear and only 2 were marked likely. Likely and unsure are the weaker cases. In our own trials on English prose, with random keys of 2 to 15 letters and texts of 50 to 2,500 letters, results marked clear had the right key length in at least 99 of 100 cases and the exact key in at least 94 of 100. When the ciphertext is Beaufort rather than Vigenère, the fit is poor for every length and, if there is enough text, the page says that Beaufort fits better.

2. What is each key letter? With the length known, each column is a Caesar cipher, so counting letters solves it. For each of the 26 possible key letters the tool decrypts the column and asks how many bits it would take to write the result with the letter frequencies of English (Robert Lewand, Cryptological Mathematics): common letters cost few bits and rare ones many. The key letter with the fewest bits wins, and the gap to the runner-up tells you how sure it is: 8 bits or more is odds of 256 to 1.

A short history

The scheme was first described in 1553 by Giovan Battista Bellaso, who added a repeating keyword to Johannes Trithemius’s square of alphabets. In the 19th century it was wrongly credited to Blaise de Vigenère, whose own cipher of 1586 was an autokey. It was long considered unbreakable and was known as le chiffre indéchiffrable, the indecipherable cipher. Charles Babbage is known to have broken a variant of it as early as 1854 without publishing his work; in 1863 Friedrich Kasiski was the first to publish a general method, in his book Die Geheimschriften und die Dechiffrir-Kunst; and William Friedman’s index of coincidence, published in 1922 as The Index of Coincidence and Its Applications in Cryptography, put the attack on a statistical footing.

Sources: Vigenère cipher, Kasiski examination, index of coincidence, autokey cipher and Kryptos.

Keyed alphabets and Kryptos

A keyed alphabet puts a word first and the remaining letters after it: KRYPTOS gives KRYPTOSABCDEFGHIJLMNQUVWXZ. The Kryptos sculpture at the headquarters of the CIA has a Vigenère table built on that alphabet, and its first two passages (K1 and K2) are Vigenère ciphers with the keys PALIMPSEST and ABSCISSA. Choose Keyed A–Z, from a word… and type KRYPTOS: the plain letters, the key letters and the cipher letters are all taken in that alphabet, which reproduces K1 and the opening of K2. The alphabet can also be any list of characters you type, such as A–Z followed by 0–9 or the letters of another script, each character once.

Why it is not secure, and what to use instead

With enough text the Vigenère cipher falls to the steps above in a fraction of a second, which is what Find the key shows. A key that is as long as the message, random and never reused (a one-time pad) cannot be solved by counting letters, but it only moves the problem to sharing a key as long as the message. For anything that matters, use modern encryption such as AES.

Limitations

• Only characters of the chosen alphabet are enciphered; spaces, punctuation and everything else are copied unchanged, and the key moves on only at enciphered characters. A puzzle that also moves the key on at spaces will not match.
• Find the key works on the letters A–Z of English text with a repeating key of up to 30 letters. It needs roughly 30 letters of ciphertext per key letter to be reliable (about 150 for a 5-letter key): with less, it shows the most likely key and the alternatives for every letter, and the decryption may be partly wrong. Other languages written with A–Z often work too, because their common letters are similar: in our trials, ciphertexts of 300 to 1,500 letters with keys of 3 to 10 letters in German, Spanish, French, Italian, Dutch, Portuguese, Swedish, Danish and Norwegian (accents left out) nearly always came out clear with the right key length, while Croatian, whose letter frequencies are further from English, mostly came out unsure. The frequencies it compares with are English.
• An autokey has no repeating key, so Kasiski’s examination and the index of coincidence do not apply, and Find the key cannot solve an autokey ciphertext. It decrypts one when you know the key.
• A general substitution cipher, the kind in newspaper cryptograms where each letter stands for another fixed letter in no particular order, is not a shift and not a repeating key, and Find the key does not solve it. It tells you when the letter counts look like one alphabet, so that you do not go on looking for a key.
• Find the key ignores a chosen alphabet: it reads only the letters A–Z of the text. Ciphertexts made with a keyed alphabet, digits or another script are not solved by it.
• A text of more than 20,000 letters is analysed on its first 20,000 letters; the whole text is still decrypted with the key found.
• Some sources define Beaufort with a reversed table, as C = 51 − K − P on Wikipedia’s Beaufort cipher page. That is this Beaufort cipher with every key letter mirrored (A ↔ Z, B ↔ Y … M ↔ N); the tool follows the American Cryptogram Association’s C = K − P.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.