Classic ciphers
- 57 tools
- No watermark
- No daily limit
Eight ciphers and encodings that predate computers, or nearly. None of them protects anything, and this page says so rather than burying it: every one was broken long ago, and several are broken by eye. They are here because you still meet them, in puzzle hunts, in capture-the-flag rounds, in obfuscated strings inside a suspicious file, and in the margins of old books. Pick one and it explains itself, including where you would run into it outside a game.
None of these protects anything. Every one can be broken without the key, most of them in seconds, and the ones marked as encodings do not even try to hide. To actually protect a message, use the password encryption tool instead.
ROT13 moves every letter thirteen places. Thirteen is half of twenty-six, so doing it twice returns the original and one button does both jobs.
Where you meet it: hiding spoilers and punchlines on forums, a habit that goes back to Usenet and is still alive on Reddit. You have to deliberately reveal it rather than catch it out of the corner of your eye. It is also the standard example when teaching that scrambled is not the same as secure.
Caesar moves every letter along the alphabet by a fixed number of places.
Where you meet it: Julius Caesar really used a shift of three for military dispatches. Today it turns up in puzzle games, escape rooms, geocaching clues and the cipher wheels sold as children’s toys.
Atbash turns the alphabet back to front: A becomes Z, B becomes Y. Doing it twice returns the original.
Where you meet it: it appears in the Book of Jeremiah, where Sheshach is Babel written this way. Scholars still meet it in ancient texts, and escape rooms use it constantly because it needs no key.
Vigenère is a Caesar shift per letter, with the amount taken from a repeating keyword.
Where you meet it: it was called the indecipherable cipher for three hundred years, and the Confederate army used it in the American Civil War. It is now a standard lesson in how a repeating key leaks, and a regular round in capture-the-flag competitions.
XOR combines each byte with a repeating key. The output is hex, because the bytes it produces are not printable characters.
Where you meet it: this is the one you meet at work. XOR is a component of every modern cipher, and on its own with a short key it is what malware uses to hide strings inside a file, so security analysts undo it constantly. The same trick shows up in game saves and firmware.
Rail fence does not change any letter. It writes the text in a zigzag across several lines and reads the lines back in order.
Where you meet it: a field cipher once, because it needs nothing but paper. Today it is a puzzle-hunt staple, and it is the standard example of a transposition: count the letters and they are all still there, which is the clue that tells you which family you are looking at.
A1Z26 writes A as 1 and Z as 26. Nothing else survives.
Where you meet it: puzzle hunts, escape rooms and children’s codes, usually as a second layer on top of something else. If you find a run of numbers between 1 and 26 in a puzzle, this is what it is.
Binary is not a cipher either. It writes out the UTF-8 bytes of the text as ones and zeros, which is why Thai and emoji survive it exactly.
Where you meet it: teaching how a computer stores text, and reading raw data while taking a file apart. In a puzzle it is usually the outermost layer, there to look cryptic.
Working out which cipher you are looking at
All eight of these fall apart the moment you know which one you have. Identifying it is the entire puzzle, and the shape of the text usually gives it away before you try anything.
| What it looks like | Probably | Confirm by |
|---|---|---|
Only 0 and 1, in groups of eight or a length
divisible by eight |
Binary text | The groups start with 010 or 011 if it is
ordinary English: those are the ranges the letters live in. |
Only 0 and 1, any length, no grouping |
A number in base two, not text | Send it to the number base converter instead. This page will read it as text and hand you nonsense. |
| Numbers 1 to 26, separated | A1Z26 | Nothing above 26 appears anywhere. |
| Letters only, and letter frequencies look like normal text but the words do not | Caesar, ROT13 or Atbash | Try ROT13 first, then all 25 Caesar shifts. One of them will read. |
| Letters only, and the frequencies are flat | Vigenère | A flat distribution means several alphabets are in play. You need the keyword. |
| The right letters in the wrong order | Rail fence or another transposition | Count the letters. A transposition never changes how many
Es there are, only where they sit. |
| Hexadecimal pairs, or unprintable bytes | XOR | XOR against a guess at a likely word. If a stretch of plaintext comes out, the key is right. |
Three of the eight are not ciphers at all. Binary, A1Z26 and Morse are ways of writing text down, not ways of hiding it, and in a puzzle they are almost always the outer layer wrapped around something else. Peel them off first and look at what is underneath.
Frequently asked questions
Is my text uploaded?
No. All eight run in this tab as you type. The site’s security policy sets connect-src ‘none’, so the browser blocks network requests from these pages, meaning the text could not be sent even if the code tried.
Can I use these to protect something?
No, and it is worth being blunt about it. Every cipher on this page was broken before computers existed, and a program breaks any of them in well under a second without the key. Three of them are not even trying: Morse, binary and A1Z26 are ways of writing text down, not ways of hiding it. If you need a message that only one other person can read, use the password encryption on this site, which uses AES-256-GCM through your browser’s own cryptography.
Why does my Thai come out unchanged?
Because the alphabet ciphers move letters within A to Z and leave every other character exactly as it was. That is not a limitation of this page: it is what every implementation does, and it is the only behaviour that survives a round trip. Binary and XOR do carry Thai, because they work on the bytes rather than the letters.
Why is the XOR output hex instead of text?
Because XOR produces bytes that are not characters: control codes, a zero byte, half of a UTF-8 sequence. Writing those out as text loses them silently, and you would get back something shorter than you put in with no error to explain it. Hex is exactly reversible, which is the only thing that matters here.
Why did Morse lose my punctuation and capitals?
Morse has no notion of upper and lower case, and it has codes for only a handful of punctuation marks. Anything it has no code for is reported rather than silently dropped. A1Z26 is stricter still: it can only write letters.