Encode and decode Beaufort ciphers with one operation. C = (K - P) mod 26 is self-reciprocal. Vigenere comparison, tabula recta, and cryptanalysis tools.
The Beaufort cipher has one property that makes it worth a page of its own: encryption and decryption are the same operation. Feed it plaintext with a key and you get ciphertext. Feed that ciphertext back with the same key and the plaintext returns. There is no encode/decode switch on this tool, because there is nothing to switch. That single trait is what set it apart from the Vigènere cipher it resembles, and it is why the cipher ended up inside the Hagelin M-209 rotor machine used by the United States Army in the Second World War: a field operator with one setting and one procedure makes fewer mistakes than one who has to remember a direction.
Type a key and a message, and the output appears immediately. Everything runs in your browser; nothing is uploaded.
Number the alphabet A=0 through Z=25. Beaufort encrypts with:
C = (K − P) mod 26
Compare that to Vigènere, which encrypts with C = (P + K) mod 26 and decrypts with P = (C − K) mod 26. Vigènere adds the key going one way and subtracts it going the other, so direction matters. Beaufort subtracts the plaintext from the key. Substitute the output back into the same formula and the reason it undoes itself falls out in one line:
(K − C) mod 26 = (K − (K − P)) mod 26 = P
The key acts as a mirror rather than an offset. Each letter is reflected about the key letter’s position, and reflecting twice returns the original. This makes Beaufort self-reciprocal (also called reciprocal, or an involution) — the same category of behaviour as Atbash, ROT13, and the XOR cipher, though Beaufort achieves it polyalphabetically with a repeating key rather than through a fixed alphabet.
Encipher ATTACK with the key LEMON. The key repeats across the message, and each column computes (K − P) mod 26:
| Plaintext | P | Key | K | (K − P) mod 26 | Cipher |
|---|---|---|---|---|---|
| A | 0 | L | 11 | 11 | L |
| T | 19 | E | 4 | (4 − 19) mod 26 = 11 | L |
| T | 19 | M | 12 | (12 − 19) mod 26 = 19 | T |
| A | 0 | O | 14 | 14 | O |
| C | 2 | N | 13 | 11 | L |
| K | 10 | L | 11 | 1 | B |
So ATTACK becomes LLTOLB. Now run LLTOLB through with the same key: (11 − 11) mod 26 = 0 = A, (4 − 11) mod 26 = 19 = T, and so on back to ATTACK. The tool demonstrates this live — alongside every result it shows the output re-enciphered with the same key, so you can watch the original text reappear.
Note the modular wrap doing real work in row two: 4 − 19 is −15, and −15 mod 26 is 11. Handling negative remainders correctly is where hand implementations of Beaufort usually go wrong.
Four tabs, each addressing a different question:
(K − P) mod 26 arithmetic for every letter.Three worked examples load with one click: ATTACKATDAWN with key LEMON, a short three-letter key, and a key longer than the message.
Three ciphers get confused with each other constantly, so here they are together:
| Cipher | Encryption | Decryption | Self-reciprocal? |
|---|---|---|---|
| Vigènere | C = (P + K) mod 26 | P = (C − K) mod 26 | No |
| Beaufort | C = (K − P) mod 26 | P = (K − C) mod 26 | Yes |
| Variant Beaufort | C = (P − K) mod 26 | P = (C + K) mod 26 | No |
The Variant Beaufort (sometimes called German Beaufort) subtracts the key from the plaintext rather than the other way round, which makes it exactly Vigènere decryption used as encryption — and destroys the reciprocal property. Only the true Beaufort, with the key first in the subtraction, is self-inverse. If a puzzle answer decodes to gibberish with this tool, trying the variant on the Vigènere cipher tool in reverse is usually the fix.
Beaufort inherits Vigènere’s weakness exactly, because it is the same polyalphabetic structure with a different arithmetic sign. The attack is two stages.
Find the key length. A repeating key of length n means every n-th letter was enciphered with the same key letter. The Kasiski examination looks for repeated substrings and factors the distances between them; the index of coincidence measures how much a candidate split resembles natural language. The Cryptanalysis tab runs the statistical version across candidate lengths and ranks them.
Solve each column. Once you know n, split the ciphertext into n columns; each is a simple monoalphabetic substitution driven by one key letter, and frequency analysis recovers it. The subtraction is what makes Beaufort feel different here: because C = K − P inverts the alphabet as well as shifting it, the frequency profile of a Beaufort column is the English distribution reflected, not merely rotated. The peak that identifies E in a Vigènere column appears mirrored in a Beaufort one — a detail that trips up anyone applying a Vigènere solver unmodified.
The practical implication: a short key over a long message is broken with pencil and paper. A key as long as the message and never reused becomes a one-time pad, which is genuinely unbreakable — but the security lives entirely in the key, not in Beaufort’s arithmetic.
Because Beaufort does not need one. C = (K − P) mod 26 applied twice with the same key returns the original text, so one button does both jobs. The tool shows the round trip alongside your result to prove it.
Vigènere adds the key to the plaintext; Beaufort subtracts the plaintext from the key. That sign change makes Beaufort self-reciprocal and mirrors the letter frequencies rather than rotating them. Both use the same tabula recta and have the same key-length weakness.
No. It offers no protection against modern cryptanalysis and very little against a determined person with squared paper. Kasiski examination and index-of-coincidence testing recover the key length, then per-column frequency analysis recovers the key. Use it for puzzles, teaching, and CTF challenges — never for real data.
For puzzles, any word. For anything approaching strength, the key must be at least as long as the message, random, and never reused — at which point you have built a one-time pad. Short repeating keys over long messages are the specific case that breaks fastest.
A mechanical cipher machine used by the US Army from the Second World War into the Korean War. Its lug-and-pin mechanism implemented a Beaufort-style reciprocal substitution, which meant a field operator used one procedure for sending and receiving. It was designed for tactical traffic with a short useful lifetime, not for strategic secrets.
Yes. Punctuation, spaces, and line breaks pass through untouched by default, and case is preserved. Non-letter characters do not consume key letters, so the key advances only across the alphabetic positions.
No. Enciphering, deciphering, frequency analysis, and key-length estimation all run in your browser in JavaScript. Nothing leaves your device.
Check for the Variant Beaufort first, since it is not self-reciprocal and needs Vigènere decryption instead. If that fails, the cipher may not be polyalphabetic at all — the cipher identifier will suggest likely types, and the Caesar cipher decoder covers the simple-shift case.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
Beaufort is a polyalphabetic substitution cipher closely related to Vigenère, with one important property: it is self-reciprocal. The same operation encrypts and decrypts, so sender and receiver use identical procedures with no separate "encrypt" and "decrypt" tables. This made it practical to implement on a reversible disk or slide.
Number the alphabet A=0, B=1, ..., Z=25. With key letter K and plaintext letter P:
C = (K − P) mod 26
This is reversed from Vigenère: Vigenère adds the key (C = P + K mod 26); Beaufort subtracts the plaintext from the key. Because subtraction modulo 26 is its own inverse, applying the same operation again recovers the plaintext:
P = (K − C) mod 26
A repeating keyword is used, just like Vigenère — the key cycles through its letters across the message.
Encrypt "HELLO" with the key "FORT" (repeating: F O R T F).
Ciphertext: "YKGIR". Decrypt by applying the same operation: (5 − 24) mod 26 = 7 → H, and so on, recovering "HELLO". That symmetry is what "reciprocal" means in practice.
The cipher is named after Sir Francis Beaufort, the Royal Navy admiral who also created the Beaufort wind scale. He proposed it around 1857. The British Royal Navy used Beaufort-style ciphers on disks and slide rules through the 19th and early 20th centuries because the reciprocal property simplified manual operation and reduced training error.
Education and puzzles only. It is a good teaching example because small changes in algebraic structure (subtraction vs. addition) produce useful properties (self-inverse encryption) without improving security. It is also a favorite in CTF challenges that include it specifically because solvers try Vigenère first and fail. Do not use it for any real-world secrecy requirement.
Beaufort has the same security profile as Vigenère and is broken by the same techniques:
Modern solvers recover Beaufort keys of length 4–8 from a few hundred characters of ciphertext in under a second. Practical fingerprint: when a Vigenère key produces gibberish but reversing the direction produces sensible text, the cipher is often Beaufort.
If you have unknown ciphertext with a flat letter distribution and no readable words, it is likely polyalphabetic — start with the Cipher Identifier to rank Vigenère, Beaufort, and related candidates.