Encrypt and decrypt with 2x2 or 3x3 Hill cipher key matrices. Automatic modular inverse, determinant validation and step-by-step block arithmetic.
The Hill cipher is the one classical cipher that is genuinely linear algebra. Instead of substituting one letter at a time, it treats a block of letters as a vector and multiplies it by a key matrix modulo 26. That single design choice makes it the first practical cipher to encrypt more than two letters at once, and it is why the Hill cipher defeats the letter-frequency analysis that breaks Caesar, Atbash, and simple substitution outright.
This tool encrypts and decrypts with 2×2 and 3×3 key matrices, computes the modular inverse matrix for you, validates that the matrix you entered can actually be inverted, and shows the arithmetic for every block. If you are here for a homework problem, a CTF challenge, or a cryptography course, the step-by-step view is the part worth using — it shows each vector, each matrix multiplication, and each reduction mod 26. Everything runs in your browser; no text is uploaded.
Every other cipher in our collection substitutes or rearranges characters. The Hill cipher performs arithmetic on them. Three consequences follow, and they are the reason it is worth learning separately:
Letters are numbered A=0 through Z=25. Split the plaintext into blocks of n letters, where n is the matrix dimension, and treat each block as a column vector p. Encryption is:
c = K · p (mod 26)
Decryption uses the modular inverse of the key matrix:
p = K⁻¹ · c (mod 26)
The inverse only exists when the determinant of K is invertible mod 26 — that is, when gcd(det(K), 26) = 1. Since 26 = 2 × 13, the determinant must be odd and not a multiple of 13. Reduced mod 26, the twelve values that qualify are:
1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25
If your determinant reduces to 0, 2, 13, or any even number, the matrix cannot be inverted and the ciphertext it produces is undecryptable — different plaintexts collide onto the same ciphertext. The tool checks this as you type and refuses to encrypt with an invalid key rather than letting you produce garbage you can never reverse.
Constructing the inverse takes two steps: find d⁻¹, the modular multiplicative inverse of the determinant mod 26, then multiply the adjugate matrix by it. For a 2×2 matrix the adjugate swaps the diagonal and negates the off-diagonal; for 3×3 the tool computes the cofactor matrix and transposes it. All arithmetic is reduced mod 26 at each stage, so negative intermediate values wrap into the 0–25 range.
Take the classic key K = [[3, 3], [2, 5]] and the plaintext HELP.
The determinant is (3 × 5) − (3 × 2) = 9, which is in the valid list, so the key is usable. The modular inverse of 9 mod 26 is 3, because 9 × 3 = 27 ≡ 1.
First block HE becomes the vector (7, 4):
| Row | Arithmetic | Result mod 26 | Letter |
|---|---|---|---|
| 1 | (3 × 7) + (3 × 4) = 33 | 7 | H |
| 2 | (2 × 7) + (5 × 4) = 34 | 8 | I |
Second block LP is (11, 15): row one gives (3 × 11) + (3 × 15) = 78 ≡ 0 → A; row two gives (2 × 11) + (5 × 15) = 97 ≡ 19 → T. So HELP encrypts to HIAT. Note that the first block happened to encrypt H to H — a coincidence of this key, and a reminder that fixed points are normal rather than a bug.
To decrypt, the inverse matrix is 3 × adj(K) mod 26 = [[15, 17], [20, 9]]. Applying it to (7, 8) returns (7, 4) — HE.
X.The Analysis tab shows the letter distribution of the result, which is instructive: encrypt a long English passage and the distribution flattens noticeably compared with a monoalphabetic cipher, though a 2×2 key leaves more structure than a 3×3.
The Hill cipher is not secure, and the reason is worth understanding because it recurs in modern cryptanalysis. Encryption is a linear map, so with n known plaintext blocks and their ciphertexts you can assemble two n×n matrices P and C such that C = K · P, and recover the key as K = C · P⁻¹ mod 26 — provided P is invertible. For a 2×2 key that means four known plaintext letters are enough. Guessing a probable crib such as a header or a common word often supplies them.
Ciphertext-only attacks are harder but still feasible for 2×2 keys, since the keyspace is small enough to search with digraph frequency scoring. This is why Hill’s cipher, published by Lester S. Hill in 1929 and briefly implemented in a mechanical device, never saw serious operational use. Treat it as a teaching cipher and a puzzle. If you are unsure what cipher you are even looking at, start with the cipher identifier.
Its determinant is not coprime with 26. Compute the determinant, reduce it mod 26, and check it against the list of valid values: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25. Any even determinant or any multiple of 13 makes the matrix non-invertible. Changing a single entry usually fixes it.
It is padding. The Hill cipher works on fixed-size blocks, so plaintext whose length is not a multiple of the block size is padded before encryption. The padding letters are recovered on decryption and are safe to discard.
No — and that is inherent to the cipher, not a limitation of this implementation. The arithmetic is defined mod 26 over the letters A–Z, so everything else is stripped before encryption and cannot be restored afterwards.
Against frequency analysis, yes — trigraph statistics are far sparser than digraph statistics, so ciphertext-only attacks become impractical for short messages. Against known-plaintext attacks, no: it just means the attacker needs nine matching letters instead of four.
Compute the determinant, reduce it mod 26, find its modular multiplicative inverse (the value d⁻¹ with d × d⁻¹ ≡ 1 mod 26), then multiply the adjugate matrix by that inverse and reduce every entry mod 26. The Matrix Math tab shows each of these stages for the key you entered.
No. All matrix arithmetic and encryption happens in JavaScript in your browser. Nothing is transmitted or stored.
No. It resists letter-frequency analysis, which was genuinely novel in 1929, but its linearity means a known-plaintext attack recovers the key by solving a system of equations. Use it for teaching and puzzles only.
If you want the other polygraphic classical cipher, the Playfair cipher encrypts pairs of letters using a 5×5 key square instead of matrix arithmetic. For a keyword-driven polyalphabetic approach, see the Vigènere cipher.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
The Hill cipher is a polygraphic substitution cipher that encrypts blocks of letters using matrix multiplication modulo 26. It is the standard textbook example of linear algebra in cryptography. Because each ciphertext block depends on every plaintext letter in that block, Hill diffuses information across positions in a way simpler substitution ciphers cannot.
Number the alphabet A=0, B=1, ..., Z=25. Pick a square key matrix K of size n × n (commonly 2×2 or 3×3) with entries mod 26. Group the plaintext into blocks of n letters and treat each block as a column vector:
C = K · P (mod 26)
Decryption multiplies by the matrix inverse of K modulo 26:
P = K⁻¹ · C (mod 26)
The key matrix must be invertible mod 26, which requires gcd(det(K), 26) = 1. Since 26 = 2 × 13, determinants that are even or multiples of 13 have no inverse and break the cipher.
Encrypt "HELP" with key K = [[3, 3], [2, 5]].
Ciphertext: "HIAT".
To decrypt, compute K⁻¹ mod 26. The inverse of det(K) = 9 mod 26 is 3 (since 9·3 ≡ 1). The 2×2 inverse formula yields K⁻¹ = [[15, 17], [20, 9]]. Multiplying K⁻¹ by each ciphertext block recovers HE and LP. Plaintexts whose length is not a multiple of n are padded with X.
Lester S. Hill, an American mathematician, invented the cipher and published it in 1929 in The American Mathematical Monthly in "Cryptography in an Algebraic Alphabet." It was the first cipher to use linear algebra and the first practical polygraphic cipher operating on more than three letters at a time. Hill also designed a mechanical device for the matrix multiplication, but it saw little operational use.
Educational use only. It is the canonical example for teaching matrix arithmetic mod a composite number, modular matrix inverses via the adjugate method, invertibility constraints on cipher keys, and the diffusion concept central to modern block ciphers like DES and AES. It also appears in CTF challenges. Not suitable for real-world secrecy.
The Hill cipher is completely broken by a known-plaintext attack. With n plaintext-ciphertext block pairs, an attacker assembles n×n matrices P and C such that C = K · P mod 26. If P is invertible mod 26, they solve directly:
K = C · P⁻¹ (mod 26)
For 2×2 Hill, just 4 known plaintext letters often suffice to recover the entire key.
If unknown ciphertext does not yield to single-letter or digraph frequency analysis, Hill is one candidate — start with the Cipher Identifier to narrow the field.