Vigenère cipher decoder and encoder

What is the Vigenère cipher?

The Vigenère cipher shifts each letter of a message by a different amount, taken from a repeating keyword. With the keyword ORCHARD, the first letter moves by O, the second by R, the third by C, and after seven letters the keyword starts again. That one change defeats the attack that breaks a simple shift cipher: E is no longer always enciphered the same way, so counting letters in the message tells you nothing.

It was published in the sixteenth century, misattributed to Blaise de Vigenère ever since, and known for three hundred years as le chiffre indéchiffrable — the indecipherable cipher. The reputation was earned and then quietly lost. Charles Babbage worked out how to break it around 1854 and published nothing; Friedrich Kasiski printed a method in 1863 and got the name.

The thing every account leaves out is the quantity. Breaking it is not a matter of cleverness any more, it is a matter of how much ciphertext you have — and this page puts a number on that rather than repeating the story.

How to use it

1. Choose what you are doing. Encrypt and decrypt both ask for a keyword. Break it asks for nothing at all — paste the ciphertext and leave the rest alone.
2. Paste your text. Letters are enciphered and everything else passes through untouched: spaces, digits and punctuation stay where they are, and they do not advance the keyword.
3. Read the result, and in break mode the panel under it. You get the recovered keyword, its length, and how many letters the attack had for each position of that keyword — which is the number that decides whether to believe the answer.

How much text it takes, measured

The attack has two stages. First work out how long the keyword is; then split the message into that many groups, one per keyword position, and solve each group as a plain shift cipher, because within a group every letter moved by the same amount. Stage two here is the same code as our Caesar cipher page, so the two tools cannot disagree about English letter frequencies.

We measured the whole thing over twelve public-domain books — 5,346,030 letters — enciphering random passages under random keywords, 200 trials for every combination of text length and keyword length. With 500 letters of ciphertext, the tool recovers the entire keyword, with no hints, between 94% and 98% of the time for keywords of 3 to 12 letters. With 1,000 letters it recovers it every time in every case we ran.

Set that against the Caesar cipher, which our measurements put at 99% with just 30 letters. Three centuries of reputation bought a factor of roughly thirty in the amount of text an attacker needs — real, and far short of indecipherable.

Short messages are where it still holds up. At 100 letters a 12-letter keyword was never once recovered, because each of those twelve positions had only eight letters to work with. That is the honest shape of the cipher's strength: not secrecy, but a shortage of evidence.

The method everyone teaches first is the weaker one

There are two classical ways to find the keyword length, and this tool offers both. Kasiski examination looks for repeated fragments in the ciphertext and measures the distances between them, on the reasoning that a repeat usually means the same plaintext enciphered at the same keyword position — so the distance is a multiple of the keyword length. The index of coincidence instead asks how often two letters drawn from a text happen to match: about 0.067 for English, and exactly 1/26, or 0.038, for random letters. Split the message by the right keyword length and each group reads like English; split it by a wrong one and each group reads like noise.

Kasiski is the historical method and the one textbooks teach first. It is also, on our measurements, the weaker of the two by a wide margin. Across 28 combinations of keyword length and text length, the index of coincidence was never worse, was strictly better in 23 of them, and the five ties were all cases where both reached 100%. On a 300-letter message with a 3-letter keyword, the index of coincidence found the length 82% of the time and Kasiski 17%.

The reason is not subtle once you look for it. Kasiski uses only exact repeated runs and throws away every other letter in the message. A 100-letter ciphertext gives it an average of 2.2 repeated-run distances to reason from; a 5,000-letter one gives it 1,947, which is where it finally catches up. The index of coincidence uses every letter at every length. If you have plenty of ciphertext the two agree, and if you do not, the older method is the one that fails.

Both methods share a quirk worth knowing about. Every multiple of the true keyword length also splits the message into single-shift groups, so a 12 scores exactly as well as a 6 for a 6-letter keyword. Taking the best-scoring length therefore reports a multiple and quarters the evidence per group. Both methods here take the shortest length that scores near the best instead, and the threshold that does it was chosen by measurement: it is the value that maximises the worst case across keyword lengths.

What this tool will not tell you

It assumes the message is English. The letter frequencies and the 0.067 target are English figures, so a French or German ciphertext will need more text and may not break at all. Our Caesar page measured the same English table cracking Spanish, Portuguese and French ciphertext successfully with two to four times more of it, and the same is likely here, but we have not measured Vigenère across languages and will not claim it.

It only handles the 26 letters A to Z. Accented letters pass through unchanged rather than being folded, because folding é to e would silently alter the message instead of enciphering it. That is the classical definition of the cipher, and it does mean an accented plaintext leaks a little of its shape.

And it is not encryption in any modern sense. A repeating keyword is a historical cipher and a teaching tool, broken by a nineteenth-century method running in a browser tab in a fraction of a second. If you want to protect something, our text encryption page uses a passphrase and a real algorithm instead.

Why is it free?

Everything here runs in your own browser — the cipher, the attack, the frequency table and the corpus figures. Nothing you paste is uploaded, nothing is logged, and there is no account to create.

No sign-up, no limits, and no watermark on anything you copy.