Encode, decode and brute-force the rail fence zigzag cipher with a live fence diagram. A transposition cipher - letters move, not change. Free, in-browser.
Encode and decode the rail fence cipher with a live zigzag diagram showing exactly where each letter lands, and crack unknown ciphertext by trying every plausible rail count at once. Type in one box and the result appears in the other; drag the rail slider and the fence redraws immediately.
The rail fence is the one classical cipher on this site that is not a substitution cipher. Caesar, Vigenère, Atbash, Affine, Beaufort, Playfair and Hill all work by replacing letters with different letters. Rail fence replaces nothing. Every letter of the plaintext appears in the ciphertext, in its original form, with its original frequency — only the order changes. That single structural difference determines everything about how it behaves, how it is broken, and why it is worth understanding separately.
The practical consequences of moving letters instead of replacing them:
| Substitution (Caesar, Vigenère…) | Transposition (rail fence) | |
|---|---|---|
| Letter identities | Changed | Unchanged |
| Letter frequency distribution | Shifted or flattened | Identical to the plaintext |
| Frequency analysis | The primary attack | Useless for recovering the key |
| Diagnostic giveaway | Odd letter distribution | Perfectly English-looking letter counts, unreadable text |
| Key space | 26, or 26ⁿ for a keyword | The number of rails — tiny |
That third row is how you identify a transposition cipher in the wild. If you count the letters in an unknown ciphertext and E, T, A, O, I and N come out on top in roughly their normal English proportions, yet the text is gibberish, the letters have not been substituted — they have been rearranged. A frequency chart that looks perfectly normal is itself the clue.
Write the message diagonally down and up across a fixed number of horizontal rails, then read each rail left to right and concatenate. With HELLOWORLD and 3 rails:
| Rail | Zigzag row | Letters collected |
|---|---|---|
| 1 | H . . . O . . . L . | HOL |
| 2 | . E . L . W . R . D | ELWRD |
| 3 | . . L . . . O . . . | LO |
Read the rails top to bottom and concatenate: HOL + ELWRD + LO = HOLELWRDLO. Ten letters in, ten letters out. Every letter of HELLOWORLD is still present in the same quantity — three Ls, two Os — and the H is still an H. Only the positions changed.
Decoding is the inverse and is where naive implementations get it wrong. You cannot simply chop the ciphertext into equal pieces, because the rails are not equal lengths: the top and bottom rails receive one letter per full zigzag period while the interior rails receive two. The correct algorithm walks the zigzag first to compute how many letters belong to each rail, slices the ciphertext accordingly, and then walks the zigzag a second time reading one letter from each rail in turn. That is exactly what this tool does, which is why its output round-trips cleanly.
The zigzag period for n rails is 2n − 2. With 3 rails the pattern repeats every 4 characters; with 5 rails, every 8. Note the degenerate cases: 1 rail is the identity transform (the text is unchanged), and if the number of rails equals or exceeds the message length the diagonal never turns around, so again nothing moves.
?text= parameter, so you can link straight to a pre-filled puzzle.Everything runs in your browser; nothing you type is sent anywhere.
The rail fence has essentially no security. Its key is a single small integer, so the entire key space for a message of any realistic length is a handful of possibilities — fewer than the Caesar cipher’s 26, and Caesar is itself trivially broken. There is no computational work involved in breaking it: you try each rail count, and one of them is English.
Historically it was used for exactly the situations that justify a weak cipher: US Civil War field messages that needed to resist a casual reader for a few hours, not a determined analyst. Today it appears in CTF challenges, escape rooms, geocaching puzzles and cryptography coursework, frequently layered with a substitution step — a common puzzle construction is Caesar-then-rail-fence, which defeats naive frequency analysis on the ciphertext while remaining solvable in two passes.
The rail fence is the simplest member of the transposition family. Columnar transposition generalises it by writing the text into a grid and reading the columns in a keyword-determined order, which raises the key space to the factorial of the number of columns and makes it genuinely harder. Double transposition applies that twice and was used operationally into the twentieth century. Modern block ciphers still contain a transposition idea — the permutation half of a substitution-permutation network is a direct descendant, and AES’s ShiftRows step is precisely a transposition applied to bytes.
The rail fence rearranges letters and leaves their identities alone; the Caesar cipher replaces each letter with another and leaves the order alone. A rail fence ciphertext has exactly the same letter frequencies as its plaintext; a Caesar ciphertext has the same shape of distribution, shifted along the alphabet.
Because the rails hold different numbers of letters. In a zigzag over n rails, the top and bottom rails are visited once per period of 2n − 2 characters, while each interior rail is visited twice. You must compute the per-rail lengths from the zigzag walk before slicing.
Try every rail count. The key space is bounded by the message length and in practice by about 15, so exhaustive search takes microseconds. The Brute Force mode here does it and ranks the candidates by how English they look.
Not for finding the key. The letter frequencies are unchanged from the plaintext, so a frequency chart tells you nothing about the rail count — but it does tell you the cipher is a transposition rather than a substitution, which is useful when you do not yet know what you are looking at.
Not if you want the cipher to be even mildly effective. Spaces travel through the transposition and end up scattered through the ciphertext in a pattern that leaks the structure. Traditional practice strips them, which is the default here.
It barely matters for security, since all values are searched instantly. Three is the classic choice and produces the recognisable zigzag; larger counts approach the identity transform once the rail count gets close to the message length.
No, not remotely. It offers no protection against anyone who recognises it, and recognising it takes seconds. Use it for puzzles and teaching, never for anything that needs to stay private.
Another name for the same thing, along with “zigzag cipher” and “fence cipher”. All describe writing the message in a diagonal wave across rails and reading off row by row.
Compare the transposition approach against the substitution family: the Caesar cipher for the simplest shift, the Vigenère cipher for a polyalphabetic key, the Playfair cipher for digraph substitution, and the substitution cipher solver for arbitrary alphabets. If you do not yet know which cipher you are looking at, start with the cipher identifier — unchanged English letter frequencies in unreadable text is its signature for transposition.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
Rail Fence is a classical transposition cipher: it does not substitute any letters, it only rearranges them. The plaintext is written in a zigzag pattern across a fixed number of "rails" (rows) and then read off row by row to produce the ciphertext. Because no letter is changed, the ciphertext has exactly the same letter frequencies as the plaintext — a strong fingerprint for cryptanalysis.
Pick a number of rails N (typically 2–6). Write the plaintext one character at a time, moving diagonally down the rails until you hit the bottom, then diagonally up until you hit the top, and so on — tracing a zigzag. After all letters are placed, read across each rail left-to-right and concatenate the rows.
The period of the zigzag is 2(N − 1). For 3 rails, the period is 4; for 4 rails, 6; for 5 rails, 8.
Encrypt "WEAREDISCOVEREDFLEEATONCE" with N = 3 rails:
| Rail 1 | W . . . E . . . C . . . R . . . L . . . T . . . E | | Rail 2 | . E . R . D . S . O . E . E . F . E . A . O . C . | | Rail 3 | . . A . . . I . . . V . . . D . . . E . . . N . . |
Read off each rail: WECRLTE + ERDSOEEFEAOC + AIVDEN
Ciphertext: "WECRLTEERDSOEEFEAOCAIVDEN"
To decrypt, the receiver must know N. They compute the length of each rail by simulating the zigzag with placeholders, slice the ciphertext into rail-sized chunks, and walk the zigzag reading from those chunks to reconstruct the plaintext. Some variants add a starting offset, slightly enlarging the key space.
Rail Fence is an ancient transposition technique with no single inventor. Transposition ciphers date back to the Spartan scytale (~5th century BCE), where a strip of parchment wound around a wooden rod produced a similar rearrangement. Rail Fence in its modern named form is a 19th-century pedagogical staple that became a fixture of puzzle books and introductory cryptography texts.
Educational and recreational use only. It is a standard early example in cryptography courses because it cleanly illustrates the difference between substitution and transposition: the ciphertext looks scrambled but each letter is preserved. It also appears regularly in CTF challenges as one layer in a stacked cipher, in escape rooms and puzzle hunts, and in geocaching coordinates. Do not use it for any real security purpose.
Rail Fence is among the weakest classical ciphers. The key is just a small integer (the rail count), so the entire keyspace can be brute-forced by trying every plausible N (typically 2 through ~12) and checking which result looks like English.
The Index of Coincidence is unchanged from plaintext (~0.067 for English), which is itself the diagnostic: an IoC consistent with English combined with unreadable text strongly suggests transposition.
If you have ciphertext with English-like letter frequencies but no readable words, transposition is likely — start with the Cipher Identifier to confirm.