Encode and decode Vigenere ciphertext, or break it without the key using Kasiski examination, index of coincidence and automatic key recovery.
This tool encodes and decodes Vigenère ciphertext with a keyword, and — more usefully — breaks it when you do not have the keyword. Four tabs cover the whole workflow: Encode/Decode for the cipher itself, Tabula Recta for the interactive 26×26 table with cell highlighting, Key Length for index of coincidence and Kasiski analysis, and Key Recovery for recovering the keyword column by column once a length is chosen. A one-click Auto-Solve runs the whole chain: estimate the key length, recover the key, decrypt. Everything is computed in your browser.
Almost every classical cipher on this site is monoalphabetic: one plaintext letter always maps to the same ciphertext letter. Caesar shifts every letter by the same amount, Atbash reverses the alphabet, a substitution cipher permutes it once. That single fixed mapping is what makes them fall instantly to frequency analysis — the letter distribution of the ciphertext has exactly the same lopsided shape as English, just relabelled, so the most common ciphertext letter is almost certainly E.
Vigenère is polyalphabetic. The key is a repeating word, and each letter of the key selects a different Caesar shift for the letter beneath it. With the key KEY, plaintext position 1 is shifted by K (10), position 2 by E (4), position 3 by Y (24), position 4 by K again, and so on. Since the same plaintext letter now encrypts to different ciphertext letters depending on where it falls, the frequency distribution flattens out. For three centuries this was enough to earn it the name le chiffre indéchiffrable.
The arithmetic is a per-position Caesar. With plaintext letter Pᵢ, key letter Kᵢ, all numbered A=0 to Z=25:
Encrypt: Cᵢ = (Pᵢ + Kᵢ) mod 26
Decrypt: Pᵢ = (Cᵢ - Kᵢ) mod 26Worked, encrypting ATTACKATDAWN with LEMON:
| Plaintext | A | T | T | A | C | K | A | T |
|---|---|---|---|---|---|---|---|---|
| Key | L | E | M | O | N | L | E | M |
| Shift | 11 | 4 | 12 | 14 | 13 | 11 | 4 | 12 |
| Ciphertext | L | X | F | O | P | V | E | F |
Notice the two Ts in positions 2 and 3 becoming X and F, and the two As becoming L and O. That is the polyalphabetic property doing its work.
Before computers, the cipher was worked by hand using the tabula recta — a 26×26 square whose first row is the plain alphabet and whose each subsequent row is that alphabet rotated one place further left. To encrypt, find the row for your key letter and the column for your plaintext letter; the cell where they meet is the ciphertext. To decrypt, find the row for the key letter, scan along it for the ciphertext letter, and read off the column heading.
The Tabula Recta tab renders that square interactively, highlighting the row, column, and intersection as you hover. It is worth five minutes even if you never intend to encrypt by hand, because it makes the structure concrete: the table is nothing more than all 26 Caesar shifts stacked, and the key is an instruction for which one to use at each position.
Vigenère’s security rests entirely on the key not repeating. A key as long as the message and never reused is a one-time pad, which is genuinely unbreakable. A short repeating key is not, because the repetition slices the ciphertext into n interleaved Caesar ciphers — and Caesar ciphers are trivial. Everything in the Key Length and Key Recovery tabs is aimed at finding that n.
Kasiski examination, published by Friedrich Kasiski in 1863, is the classical attack. Look for repeated substrings of three or more letters in the ciphertext. When the same plaintext fragment happens to align with the same part of the key, it encrypts identically — so the distance between two such repetitions is very likely a multiple of the key length. Collect the distances, factor them, and the factor that keeps recurring is your key length. If repeated trigrams appear at distances of 16, 24, and 40, the common factor 8 is the obvious candidate. Some repetitions are coincidence, which is why you need several before drawing a conclusion.
Index of coincidence is the statistical companion, and it is what the tool leans on hardest. The IC is the probability that two letters drawn at random from a text are the same:
IC = Σ nᵢ(nᵢ - 1) / N(N - 1)English prose has an IC of roughly 0.067, because its letter distribution is far from flat. Uniform random text sits near 0.038. Vigenère ciphertext as a whole lands somewhere between the two — the more shifts in play, the flatter it looks. The trick is to test candidate key lengths: for a candidate n, take every n-th letter to form n columns. If n is the true key length, each column was encrypted with a single Caesar shift and therefore retains English’s statistics, so the average column IC jumps back toward 0.067. If n is wrong, the columns stay mixed and the IC stays near random. The Key Length tab computes this for every plausible length and ranks candidates by combined IC and Kasiski confidence.
Once the length is settled, key recovery is mechanical. Each column is a Caesar cipher; the tool runs a chi-squared comparison of each column’s letter frequencies against English for all 26 shifts and takes the best fit, and the recovered shifts spell out the keyword. Where a column is short or the statistics are ambiguous, you can override an individual column’s shift by hand and watch the plaintext update — usually the fastest way to fix a single wrong letter in an otherwise readable key.
The practical limit is text length. Both techniques are statistical, so they need material to work with: a long key on a short message leaves each column with too few letters to say anything reliable. That is why short ciphertexts are genuinely hard even though the cipher is broken in principle.
The Beaufort cipher is Vigenère’s closest relative and the one most worth understanding alongside it. It uses the same tabula recta but computes Cᵢ = (Kᵢ - Pᵢ) mod 26, subtracting the plaintext from the key rather than adding. The consequence is that Beaufort is reciprocal: encryption and decryption are the same operation, so running Beaufort twice with the same key returns the original text. It is also why Beaufort ciphertext responds to exactly the same Kasiski and IC analysis — the key-length weakness is structural to any repeating-key polyalphabetic cipher, whatever the per-letter arithmetic.
At the simpler end, the Caesar cipher is the single-letter-key special case of Vigenère; the substitution cipher permutes the alphabet once rather than rotating it. If you are not sure which cipher you are looking at, start with the cipher identifier — a ciphertext whose overall IC sits well below 0.067 but whose column ICs spike at a particular period is a Vigenère signature.
Paste the ciphertext into the Key Length tab and use Auto-Solve. It estimates the key length from index of coincidence and Kasiski hits, recovers the key column by column with chi-squared frequency matching, and decrypts. Longer ciphertext gives far more reliable results.
The 26×26 table of all 26 rotated alphabets used to work the cipher by hand. The key letter selects the row, the plaintext letter selects the column, and the intersection is the ciphertext. The Tabula Recta tab shows it with live highlighting.
Finding repeated three-or-more-letter sequences in the ciphertext and factoring the distances between them. Those distances are usually multiples of the key length, so the recurring common factor reveals it.
The probability that two randomly chosen letters of a text match. English prose sits near 0.067 because its letter distribution is uneven; uniform random text sits near 0.038. Splitting ciphertext by a candidate key length and seeing the column IC rise toward 0.067 confirms that length.
Most often it is too short for the statistics to work, the key is unusually long relative to the message, or the plaintext is not English. Try the Key Length tab manually, pick the second or third candidate rather than the top one, and override individual column shifts in Key Recovery.
No. It resisted attack for three centuries but has been comprehensively broken since the nineteenth century, and a computer breaks a reasonable amount of ciphertext in milliseconds. Treat it as a puzzle, a teaching tool, and a CTF staple — never as protection for anything real.
Beaufort subtracts the plaintext from the key instead of adding the key to the plaintext, which makes it reciprocal — the same operation encrypts and decrypts. The key-length weakness is identical, so the same cryptanalysis applies to both.
No. Encoding, decoding, Kasiski examination, IC calculation, and key recovery all run locally in JavaScript. The optional share link is the only thing that puts your text in a URL, and only when you choose to copy it.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
The Vigenere cipher is a polyalphabetic substitution cipher that uses a keyword to encrypt text with multiple different Caesar cipher shifts. Invented by Giovan Battista Bellaso in 1553 and later misattributed to Blaise de Vigenere, it was considered unbreakable for over 300 years — earning it the nickname "le chiffre indechiffrable" (the indecipherable cipher).
The Vigenere cipher represents a critical evolution in cryptographic history. By using multiple substitution alphabets instead of one, it defeats simple frequency analysis — the technique that trivially breaks Caesar and monoalphabetic substitution ciphers. Understanding the Vigenere cipher and how it was eventually broken teaches essential concepts about polyalphabetic encryption, key length analysis, and the ongoing arms race between codemakers and codebreakers.
Encryption uses a keyword that is repeated to match the length of the plaintext. Each keyword letter determines the Caesar shift for the corresponding plaintext letter:
Example with keyword "KEY":
| Position | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
|---|---|---|---|---|---|---|---|---|---|
| Plaintext | A | T | T | A | C | K | A | T | D |
| Keyword | K | E | Y | K | E | Y | K | E | Y |
| Shift | 10 | 4 | 24 | 10 | 4 | 24 | 10 | 4 | 24 |
| Ciphertext | K | X | R | K | G | I | K | X | B |
Each letter is encrypted with a different shift, so the same plaintext letter (A) can encrypt to different ciphertext letters (K, K, K in this case because the keyword position happens to align — but with longer keywords, repetition decreases).
The Vigenere cipher was broken in the 19th century using two techniques:
Friedrich Kasiski observed that repeated sequences in ciphertext reveal the key length. If "THE" is encrypted at positions that align with the same keyword letters, the same ciphertext trigram appears. The distances between repetitions are multiples of the key length.
William Friedman developed a statistical method that measures the probability that two randomly chosen letters from the ciphertext are the same. Natural language has a higher index of coincidence (~0.067 for English) than random text (~0.038). By testing different key lengths and measuring the IC of resulting groups, the correct key length produces groups with language-like IC values.
The Vigenere cipher provides no security for modern use. Its vulnerabilities include:
The Vigenère cipher is a polyalphabetic substitution cipher that uses a keyword to shift letters. Unlike the Caesar cipher which uses a single shift, each letter in the keyword determines a different shift for the corresponding plaintext letter. This makes it much harder to break than simple substitution ciphers.
Kasiski examination is a method to determine the key length of a Vigenère cipher. It works by finding repeated sequences in the ciphertext (like XYZ appearing multiple times). The distances between these repetitions are likely multiples of the key length. Finding the GCD of these distances reveals probable key lengths.
The Index of Coincidence (IC) measures how likely it is that two randomly selected letters from a text are the same. English text has an IC around 0.067, while random text is around 0.038. By calculating the IC for different assumed key lengths, we can determine the actual key length - the correct length will have IC values closer to English.
First, determine the key length using Kasiski examination or IC analysis. Then, split the ciphertext into groups by key position. Each group is effectively a Caesar cipher that can be solved with frequency analysis. Finally, combine the individual key letters to reveal the full keyword.