Vigenère Cipher Encoder and Decoder

Common questions

How does the Vigenère cipher work?

Each letter of the key shifts one letter of the message. A shifts by nothing, B shifts by one, and so on, so the key LEMON shifts successive letters by 11, 4, 12, 14 and 13 places, then starts again at L. ATTACKATDAWN under LEMON becomes LXFOPVEFRNHR. Decoding is the same walk in reverse. Because the shift changes from letter to letter, the same plaintext letter comes out differently in different places, which is what defeated simple frequency analysis for three hundred years.

Why do spaces and punctuation not move the key along?

Because the cipher is defined over a 26-letter alphabet, and a space is not in it. The classical rule is that anything that is not a letter passes through unchanged and does not consume a key letter, so attack at dawn under LEMON is lxfopv ef rnhr: exactly the letters of attackatdawn to lxfopvefrnhr with the spaces put back. Spending a key letter on the space instead produces something that looks just as convincing and matches no textbook. This one keeps the classical rule, and the same goes for digits, accented letters such as é, other alphabets and emoji: all of them pass through and leave the key where it was.

What is the autokey variant?

Instead of repeating the keyword forever, the message itself continues the key once the keyword runs out. With the key QUEENLY, ATTACKATDAWN encodes to QNXEPVYTWTWP: the first seven letters use the keyword and the rest use the plaintext. It matters because the repeat is what gives the ordinary cipher away. Find the period and the message splits into that many simple shifts, each one easy. Autokey has no period to find. The switch is beside the key field, and decoding works because each recovered letter becomes the key letter for the one further along.

Can I decode a Caesar cipher without knowing the shift?

Yes, and that is what the Crack mode does. There are only 25 possible shifts, so it tries all of them and scores each result against the letter frequencies of English with a chi-squared statistic, lowest score first. The top five are listed with roughly the first sixty characters of each, runs of spaces and line breaks collapsed so each line stays readable, and one click decodes the whole text at that shift. It is a ranked guess rather than an answer: on a sentence the top row is almost always right, and on a handful of letters the count is close to meaningless, so the tool says how many letters it had to work with.

Is the Vigenère cipher secure?

No. Treat it as a puzzle, not as protection. Repeated fragments in the ciphertext reveal the length of the key, and once that is known the message splits into as many simple shift ciphers as there are key letters, each of which falls to the same frequency count this page runs on Caesar. That attack was published in 1863 and works by hand. These ciphers are wonderful for puzzles, escape rooms, geocaching and homework. Anything that genuinely has to stay private needs modern encryption.

What are Atbash and ROT13?

Both are fixed substitutions with no key. Atbash reverses the alphabet, so A becomes Z, B becomes Y, and applying it a second time gives the original text back. ROT13 is a Caesar shift of 13, and since 13 is half of 26 it is also its own inverse: the same operation hides the text and reveals it, which is why it is used to cover spoilers and punchlines rather than secrets.

Is any of this sent to a server?

No. The ciphers, the cracker and the tabula recta all run in your own browser, so nothing you type is uploaded and no length limit is imposed. Your text, key and settings are kept in this browser so the tool comes back as you left it. Emptying the box clears the stored text on its own, but the key, the cipher and the settings stay until you change them. The Clear button, next to Copy and Swap, is the one that removes everything: it empties the box, puts the key and settings back to their defaults, and deletes the saved record from this browser.