Vigenère Cipher Translator — encrypt, decrypt, see the alignment

The Vigenère cipher translator above encrypts and decrypts text with a repeating keyword, prints the letter-by-letter alignment of message, key and result, and measures the index of coincidence so you can see how much the cipher text still gives away. It supports both the classic repeating key and the autokey variant, and it never sends anything you type off your device.

Arb Digital publishes it as a teaching tool. Vigenère held a reputation as unbreakable for three centuries and then collapsed completely, which makes it the best short lesson available in why a cipher looking complicated is not evidence that it is strong. Everything on this page assumes you want to understand the mechanism or solve a puzzle. None of it is security.

What This Vigenère Cipher Translator Does

It applies a different Caesar shift to every letter, chosen by the corresponding letter of the keyword. Where a Caesar cipher uses one shift for the whole message, Vigenère cycles through as many shifts as the keyword has letters. That is the entire difference between them, and it is the difference between a cipher broken by trying twenty-five possibilities and one that resisted attack for three hundred years.

The alignment panel shows the three rows a solver would write out by hand: the message, the repeating key beneath it, and the result beneath that. Seeing the key wrap around is the fastest way to understand both how the cipher works and why it fails, because the wrap is the pattern that period-finding attacks detect.

The grid reports the index of coincidence of whichever text is currently displayed, plus the key length a statistical solver would infer from it. When you encrypt with a five-letter key and the tool independently guesses five, the cipher's weakness stops being an abstract claim.

How to Use It

1. Type or paste your text. Only letters are enciphered; everything else passes through unchanged.
2. Enter a keyword. Longer and less predictable is better, though the cipher is breakable regardless.
3. Choose encrypt or decrypt. Decryption with the same key returns the original exactly.
4. Try the autokey variant to see how extending the key with the message itself removes the repeating period.
5. Read the index of coincidence and the inferred key length to see how much structure survives the encryption.

The Formula and How It Is Calculated

Number the alphabet from A = 0 to Z = 25. For each letter of the message, take the corresponding key letter and add the two numbers modulo 26. Written out, C_i = (P_i + K_{i mod m}) mod 26, where m is the keyword length. Decryption subtracts instead of adding.

Take the standard example. The message ATTACKATDAWN with the keyword LEMON gives the key stream LEMONLEMONLE. A plus L is 0 + 11 = 11, which is L. T plus E is 19 + 4 = 23, which is X. T plus M is 19 + 12 = 31, which reduces modulo 26 to 5, which is F. Continuing through the message produces LXFOPVEFRNHR, and decrypting that with the same keyword returns ATTACKATDAWN.

Historically the addition was done with a tabula recta: a 26 by 26 grid whose rows are the alphabet shifted one place further each time. The key letter selects the row, the message letter selects the column, and the cell where they meet is the cipher letter. The arithmetic and the grid are the same operation, and Michigan Technological University's tutorial on the Vigenère cipher encryption and decryption works through the table method in full.

Why the Cipher Is Broken

Vigenère defeats simple frequency analysis, because the letter E does not always encrypt to the same thing. What it does not defeat is frequency analysis applied separately to each key position. If the keyword has five letters, then every fifth letter of the cipher text was shifted by the same amount, so those letters form a plain Caesar cipher, and a Caesar cipher falls to a single frequency count.

So the entire attack reduces to one question: how long is the key? Two nineteenth and early twentieth century methods answer it. Kasiski examination looks for repeated three-letter sequences in the cipher text; when the same plaintext fragment happens to line up with the same part of the key, the repeat survives into the cipher text, and the distances between such repeats tend to be multiples of the key length. The greatest common divisor of those distances is the candidate.

The second method is the one this page implements. The index of coincidence is the probability that two letters drawn at random from a text are the same. English runs at about 0.067; uniformly random letters give 1/26, about 0.0385. Cipher text from a long key sits near the random figure, but when you split it into the correct number of columns each column is monoalphabetic and its index rises back toward the English value. Trying every candidate length and looking for the jump gives the period, and Michigan Tech's page on the index of coincidence sets out the statistic in detail.

The grid on this page runs that test on your own text. On a short message it will often be wrong, because the statistic needs volume — a rule of thumb is that reliability arrives somewhere past a couple of hundred letters. That length dependence is the only real protection Vigenère has ever offered, and it protects the message only by keeping it short.

Autokey: The Variant That Was Actually Stronger

The scheme usually called Vigenère is not the one Blaise de Vigenère proposed. His version, the autokey, starts with a short keyword and then continues the key using the plaintext itself. Encrypting ATTACKATDAWN with the keyword LEMON gives the key stream LEMONATTACKA — the keyword, then the message.

That single change removes the repeating period, and with it both classical attacks. Kasiski examination has no period to find, and the index of coincidence test has no correct column count to reveal. The autokey is genuinely harder, and the tool implements it so the difference is visible: switch the variant and watch the inferred key length become meaningless.

It is still not secure. Because the key is the plaintext, guessing a likely word and sliding it along the cipher text produces readable fragments when the guess is right, which is the standard attack and is entirely practical by hand. The lesson is worth stating plainly: the version that spread through textbooks and got the name was the weaker of the two, and its reputation for being unbreakable outlived the fact by decades.

Choosing a Keyword, and Why It Barely Helps

Three properties of a keyword matter to a solver. Length sets the period, so longer is harder up to the point where the key is as long as the message. Repeated letters inside the keyword reduce the effective number of distinct shifts, so a word like BANANA offers fewer than six. And predictability matters enormously in practice, because once the period is known the solver can test dictionary words of that length before doing any statistics at all.

There is exactly one way to make this construction unbreakable, and it is to make the key truly random, at least as long as the message, and never reused. That is the one-time pad, and its security comes entirely from those three conditions rather than from anything Vigenère contributed. Break any one of them — reuse the key, shorten it, generate it from a password — and the whole thing collapses back to a solvable cipher.

For anything real, use vetted modern cryptography rather than a classical construction. Our hash generator and password generator cover the everyday tasks people often reach for a cipher tool to do, and our RSA key calculator explains public-key cryptography with the same teaching-only caveat that applies here.

Common Mistakes to Avoid

• Treating it as encryption — the cipher has been solvable by hand since the 1860s and takes a computer no measurable time.
• Assuming a long keyword fixes it — only a truly random key as long as the message and never reused is secure, and that is a one-time pad, not this.
• Enciphering spaces and punctuation — word lengths left visible hand a solver a large part of the answer before any statistics begin.
• Reading the index of coincidence on a short message — the statistic needs a few hundred letters before its verdict means anything.
• Confusing the autokey with the repeating key — they use the same table but produce completely different key streams, and decrypting with the wrong one fails after the first few letters.

Related Free Tools From Arb Digital

Shift by a single fixed amount with the Caesar cipher translator, apply the fixed thirteen-place case with ROT13, translate a symbol alphabet with the Morse code translator, decode keypad digits with the T9 to text converter, or encode binary safely with Base64 encode and decode. The full free online tools hub lists every developer tool we publish.

Frequently Asked Questions

This page explains a classical cipher for educational purposes. It provides no security and must not be used to protect confidential information.