Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.

What Is the Hill Cipher?

The Hill cipher is a polygraphic substitution cipher that encrypts blocks of letters using matrix multiplication modulo 26. It is the standard textbook example of linear algebra in cryptography. Because each ciphertext block depends on every plaintext letter in that block, Hill diffuses information across positions in a way simpler substitution ciphers cannot.

How the Hill Cipher Works

Number the alphabet A=0, B=1, ..., Z=25. Pick a square key matrix K of size n × n (commonly 2×2 or 3×3) with entries mod 26. Group the plaintext into blocks of n letters and treat each block as a column vector:

C = K · P (mod 26)

Decryption multiplies by the matrix inverse of K modulo 26:

P = K⁻¹ · C (mod 26)

The key matrix must be invertible mod 26, which requires gcd(det(K), 26) = 1. Since 26 = 2 × 13, determinants that are even or multiples of 13 have no inverse and break the cipher.

Worked Example (2×2)

Encrypt "HELP" with key K = [[3, 3], [2, 5]].

det(K) = 3·5 − 3·2 = 9. gcd(9, 26) = 1, so K is invertible.
Blocks: "HE" = [7, 4], "LP" = [11, 15].
K · [7, 4] mod 26: row 1 = 3·7 + 3·4 = 33 mod 26 = 7 → H; row 2 = 2·7 + 5·4 = 34 mod 26 = 8 → I.
K · [11, 15] mod 26: row 1 = 3·11 + 3·15 = 78 mod 26 = 0 → A; row 2 = 2·11 + 5·15 = 97 mod 26 = 19 → T.

Ciphertext: "HIAT".

To decrypt, compute K⁻¹ mod 26. The inverse of det(K) = 9 mod 26 is 3 (since 9·3 ≡ 1). The 2×2 inverse formula yields K⁻¹ = [[15, 17], [20, 9]]. Multiplying K⁻¹ by each ciphertext block recovers HE and LP. Plaintexts whose length is not a multiple of n are padded with X.

History

Lester S. Hill, an American mathematician, invented the cipher and published it in 1929 in The American Mathematical Monthly in "Cryptography in an Algebraic Alphabet." It was the first cipher to use linear algebra and the first practical polygraphic cipher operating on more than three letters at a time. Hill also designed a mechanical device for the matrix multiplication, but it saw little operational use.

When to Use the Hill Cipher

Educational use only. It is the canonical example for teaching matrix arithmetic mod a composite number, modular matrix inverses via the adjugate method, invertibility constraints on cipher keys, and the diffusion concept central to modern block ciphers like DES and AES. It also appears in CTF challenges. Not suitable for real-world secrecy.

Security and Cryptanalysis

The Hill cipher is completely broken by a known-plaintext attack. With n plaintext-ciphertext block pairs, an attacker assembles n×n matrices P and C such that C = K · P mod 26. If P is invertible mod 26, they solve directly:

K = C · P⁻¹ (mod 26)

For 2×2 Hill, just 4 known plaintext letters often suffice to recover the entire key.

Ciphertext-only attacks are harder than for monoalphabetic ciphers since Hill flattens single-letter frequencies, but n-gram frequency analysis still applies — digraphs (2×2) or trigrams (3×3) have well-known English distributions that leak structure.
Brute force is feasible for small matrices: about 157,000 invertible 2×2 matrices mod 26 — small enough to enumerate with English-language scoring.
The cipher is linear, so it provides no security against chosen-plaintext attacks at all.

Related Ciphers

Playfair cipher — another polygraphic cipher (digraphs), using grid lookup instead of matrix multiplication.
Affine cipher — the 1×1 case of Hill, where the "matrix" is a single scalar a and the cipher reduces to E(x) = a·x + b mod 26.
Vigenère cipher — a polyalphabetic substitution closer in spirit, but using a repeating keyword rather than matrix arithmetic.

If unknown ciphertext does not yield to single-letter or digraph frequency analysis, Hill is one candidate — start with the Cipher Identifier to narrow the field.

Hill Cipher Tool