Vigenère Cipher

The cipher that held for three hundred years

A Caesar cipher uses one shift for the whole message, which is exactly what makes frequency analysis work. Vigenère uses a different shift for each position, taken from a repeating keyword.

With the keyword LEMON, the first letter shifts by L (11 places), the second by E (4), the third by M (12), and after five letters the keyword repeats. The alignment is shown above as you type.

The effect is that the same plaintext letter encrypts differently depending on where it sits. E might become P in one place and S in another, which flattens the letter distribution and defeats the technique that breaks every simple substitution cipher.

It is not actually by Vigenère

Giovan Battista Bellaso published it in 1553. Blaise de Vigenère described a stronger autokey version in 1586, and in the nineteenth century the misattribution stuck to the wrong man. It is one of the more durable naming errors in the field.

It was called le chiffre indéchiffrable — the indecipherable cipher — and the reputation was earned. It resisted serious attack for roughly three centuries.

How it was finally broken

Charles Babbage broke it around 1854 and did not publish; Friedrich Kasiski published a method in 1863, and it carries his name.

The weakness is the repetition. Find repeated sequences in the ciphertext and measure the gaps between them: those gaps tend to be multiples of the keyword length, because the same plaintext met the same part of the keyword. Once you know the keyword is, say, five letters long, you split the message into five groups — and each group is a plain Caesar cipher, which frequency analysis handles easily.

So the cipher's strength is entirely its keyword length relative to the message. A five-letter keyword on a long message is quickly broken.

The version that genuinely cannot be broken

Make the keyword as long as the message, truly random, and never reuse it, and Vigenère becomes the one-time pad — which is provably unbreakable. Every possible plaintext of that length is equally consistent with the ciphertext, so there is no information to attack.

The catch is that you must securely share a key as long as everything you will ever send, and use each one exactly once. Reusing a pad breaks it completely, which is how the Venona project read Soviet traffic for decades.

Common uses

• Puzzle hunts, where a keyword is usually hidden elsewhere in the puzzle.
• Teaching why polyalphabetic ciphers were an advance.
• Historical texts and recreational cryptography.

Questions people ask

How does the Vigenère cipher work?

Each letter is shifted by a different amount, taken from a repeating keyword. With LEMON, the shifts are 11, 4, 12, 14, 13 and then repeat.

Why is it harder to break than a Caesar cipher?

Because the same plaintext letter encrypts differently depending on position, which flattens the letter distribution and defeats simple frequency analysis.

How was it broken?

By the Kasiski examination. Repeated sequences in the ciphertext reveal the keyword length, after which the message splits into several Caesar ciphers.

Did Vigenère invent it?

No. Bellaso published it in 1553. The misattribution stuck in the nineteenth century.

What makes a one-time pad unbreakable?

A key as long as the message, truly random, used only once. Every possible plaintext becomes equally consistent with the ciphertext.

None of this is security

The ciphers on this site are historical. Every one of them was broken centuries ago, and a modern computer breaks them in microseconds — the Caesar page shows the break happening rather than just describing it.

They are worth knowing for puzzles, for teaching, for reading old texts and for understanding where cryptography came from. They are not worth using to protect anything. If you need something kept secret, you need modern encryption with a properly managed key, and you should not be building it yourself.

The encodings — Morse, binary, hex, NATO — make no secrecy claim at all. They exist to move information over a channel, and anyone can read them.

Your text stays in the page

Everything runs in your browser. Nothing you type is transmitted, logged or stored, and this site has no server that could receive it. The about page lists every request the site makes.