Encode and decode affine ciphers with E(x) = (ax + b) mod 26, or brute-force all 312 keys ranked by English letter frequency. Free, runs in your browser.
The affine cipher encrypts each letter with a small piece of arithmetic rather than a simple slide along the alphabet. Enter your text, set the two key numbers a and b, and this tool encodes or decodes instantly in your browser. If you do not know the key, the brute-force mode tries every one of the 312 valid keys, scores each result against English letter frequencies, and ranks the candidates so the readable plaintext usually appears near the top.
This matters because the affine cipher is the step where classical cryptography stops being intuitive. A Caesar shift can be solved by eye; an affine cipher cannot, because multiplication scrambles the alphabet into an order that no longer looks like a rotation. That is exactly why it shows up in cryptography coursework, CTF challenge sets, and puzzle hunts — it forces you to reason about modular arithmetic instead of counting letters on your fingers.
Number the alphabet A=0 through Z=25. Encryption applies:
E(x) = (a × x + b) mod 26
Decryption reverses it using the modular multiplicative inverse of a:
D(y) = a-1 × (y − b) mod 26
The key is the pair (a, b). The b value behaves exactly like a Caesar shift — it slides the whole alphabet along. The a value is what makes the affine cipher distinct: it multiplies the letter’s position before the shift is applied, stretching the alphabet across itself.
a Must Be Coprime with 26This is the single rule that trips people up, and it is not an arbitrary restriction — it is the condition that makes decryption possible at all. Multiplication modulo 26 is only reversible when a and 26 share no common factor other than 1. Since 26 factors as 2 × 13, any a that is even, or that is a multiple of 13, destroys information.
Consider a = 2. Then A (0) maps to 0, and N (13) maps to (2 × 13) mod 26 = 26 mod 26 = 0 as well. Both A and N encrypt to A. Two different plaintext letters collapse onto the same ciphertext letter, and no decoding procedure can tell them apart afterwards. The map is no longer a bijection, and the message is permanently damaged — not encrypted, but corrupted.
There are exactly twelve legal multipliers: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25. This tool enforces that set and flags an invalid a with a warning rather than silently producing garbage. Each valid multiplier has a modular inverse used during decryption:
| a | 1 | 3 | 5 | 7 | 9 | 11 | 15 | 17 | 19 | 21 | 23 | 25 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| a-1 mod 26 | 1 | 9 | 21 | 15 | 3 | 19 | 7 | 23 | 11 | 5 | 17 | 25 |
Read that table as: to decrypt a message encoded with a = 5, you multiply by 21. Note that 25 is its own inverse, as is 1 — those pairs are self-inverse.
Encrypting the word HELLO:
| Letter | x | 5x + 8 | mod 26 | Ciphertext |
|---|---|---|---|---|
| H | 7 | 43 | 17 | R |
| E | 4 | 28 | 2 | C |
| L | 11 | 63 | 11 | L |
| L | 11 | 63 | 11 | L |
| O | 14 | 78 | 0 | A |
So HELLO becomes RCLLA. Notice that L encrypts to itself here — a fixed point, which happens whenever (a − 1)x + b is a multiple of 26. To reverse it, take R (17), subtract b: 17 − 8 = 9, then multiply by the inverse of 5, which is 21: 9 × 21 = 189, and 189 mod 26 = 7, which is H.
a and the shift b. If a is not coprime with 26 the tool warns you instead of producing an undecryptable result.Everything runs locally in your browser. No text is uploaded, logged, or stored.
The affine keyspace is tiny: twelve choices for a multiplied by twenty-six choices for b gives 312 keys. A computer exhausts that in microseconds, so the real problem is not generating the candidates but recognising which one is English.
This tool scores each decryption by comparing its observed letter frequencies against standard English frequencies (E at 12.7%, T at 9.1%, A at 8.2%, and so on down to Z at 0.07%). The score is the negative sum of squared differences, so a candidate whose letter distribution closely tracks English scores near zero, while a nonsense candidate scores strongly negative. Sorting best-first puts the real plaintext at or near the top.
The approach depends on having enough text. A ciphertext of five or six letters carries almost no frequency signal, and several candidates will score similarly — you will have to read them and judge. A paragraph is usually decided on the first result.
The affine cipher is a generalisation that contains several familiar ciphers as special cases:
b acts.Going the other direction, every affine cipher is itself a special case of a general monoalphabetic substitution cipher — one where the substitution alphabet happens to be generated arithmetically rather than chosen freely. That is precisely why it is weak: a free substitution has 26! possible alphabets, roughly 4 × 1026, while the affine constraint cuts that to 312. If you want a cipher that resists frequency analysis, the next step up is a polyalphabetic scheme like the Vigenère cipher, or the matrix-based Hill cipher, which is the natural linear-algebra extension of the same idea the affine cipher expresses with a single multiplier.
It is a letter-substitution cipher where each letter’s alphabet position is multiplied by one number and then shifted by another, with the result wrapped around the 26-letter alphabet. The two numbers together form the key.
Because they share a factor with 26, so multiple plaintext letters map to the same ciphertext letter and the message cannot be recovered. Only 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, and 25 are valid multipliers.
312 — twelve valid multipliers times twenty-six shifts. One of those, a = 1, b = 0, leaves the text unchanged, so 311 keys actually alter the message.
Yes, easily. Use the Brute Force mode here, which tries all 312 keys and ranks them by English-likeness. By hand, you can also solve it algebraically: guess that the two most common ciphertext letters correspond to E and T, and solve the resulting pair of modular equations for a and b.
No. It offers no meaningful protection against anyone with a computer, and it should never be used to protect real data. Its value is educational — it teaches modular arithmetic, multiplicative inverses, and frequency analysis in a form you can work through on paper.
Yes. With Preserve Non-Alphabetic enabled, spaces, digits, and punctuation pass through untouched, so the shape of the message is preserved. Disable it and everything except letters is stripped, which matches how ciphertext is usually presented in textbooks.
Fixed points are normal. A letter maps to itself whenever (a − 1)x + b is divisible by 26. Depending on the key, an affine cipher can have zero, one, two, or (when a = 1, b = 0) all twenty-six fixed points.
No. All encoding, decoding, and brute-forcing happens in JavaScript in your own browser. Nothing is transmitted to a server.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
The Affine cipher is a monoalphabetic substitution cipher that encrypts each letter using a linear function modulo 26. It generalizes the Caesar cipher (which is the special case where the multiplier equals 1) by adding a multiplicative component, expanding the key space from 25 to 311 distinct keys.
Number the alphabet A=0, B=1, ..., Z=25. The encryption function is:
E(x) = (a · x + b) mod 26
where a and b are the two halves of the key. Decryption is:
D(y) = a⁻¹ · (y − b) mod 26
where a⁻¹ is the modular multiplicative inverse of a modulo 26.
For decryption to work, a must be coprime to 26 — that is, gcd(a, 26) = 1. Since 26 = 2 × 13, any a that is even or a multiple of 13 has no inverse mod 26 and breaks decryption. The 12 valid values of a are:
1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25
The shift b can be any integer from 0 to 25, giving 12 × 26 = 312 key pairs. Subtracting the trivial identity (a=1, b=0) leaves 311 useful keys.
Encrypt "HELLO" with a=5, b=8.
Ciphertext: "RCLLA". To decrypt, compute a⁻¹: 5 · 21 = 105 = 4·26 + 1, so 5⁻¹ ≡ 21 (mod 26). Then D(y) = 21 · (y − 8) mod 26 recovers each plaintext letter.
The Affine cipher does not have a single inventor or famous historical use — it is best understood as the natural algebraic generalization of the Caesar cipher. It became a standard textbook example in 20th-century cryptography courses because it cleanly illustrates modular arithmetic, multiplicative inverses, and why key constraints matter. The requirement that gcd(a, 26) = 1 is the first place most students encounter the concept of a unit in a modular ring.
For classroom and self-study use only. The Affine cipher is excellent for teaching:
It also shows up in CTF challenges, puzzle hunts, and recreational cryptography, often as the second or third layer in a stacked cipher.
The Affine cipher offers essentially no real-world security. Two independent attacks defeat it:
A known-plaintext attack with just two correct letter pairs gives a linear system that pinpoints (a, b) in one step.
If you have ciphertext and suspect Affine but aren't sure, the Cipher Identifier can flag the monoalphabetic fingerprint and rank Affine against Caesar, ROT13, and general substitution.