Cipher Encoder / Decoder

A classical cipher rearranges or substitutes the letters of a message according to a rule simple enough to work with pencil and paper. They are the ciphers of puzzle hunts, escape rooms, capture-the-flag warm-up challenges and homework, and every one of them was broken long before computers existed. This tool runs all five entirely in your browser — nothing you type is sent anywhere.

Each cipher also has a page of its own, opening the tool in that mode with a worked example and a fuller account of how it is broken: ROT13, Caesar, Atbash, Vigenère and XOR.

ROT13 replaces each letter with the one thirteen places later in the alphabet, wrapping round from Z back to A. Because thirteen is exactly half of twenty-six, applying it twice returns the original text, which is why there is no separate decode step. It has never been about secrecy: Usenet used it to hide spoilers and punchlines from people reading casually, and that remains its honest use.

Caesar is the same idea with the shift left open — any value from 1 to 25, with ROT13 being the special case of 13. Since there are only 25 possibilities, the way to read a Caesar message you have no key for is simply to try all of them, which is what the "try all 25 shifts" switch does. One of the 25 lines will be English; the rest are noise. That takes a fraction of a second here and took a codebreaker a few minutes with a pencil, which is the whole reason the cipher stopped being used.

Atbash maps the alphabet onto itself reversed — A becomes Z, B becomes Y, M becomes N — and, like ROT13, is its own inverse. It originates in Hebrew scribal practice and has no key at all, so it protects nothing: recognising that a message is Atbash is the same thing as reading it.

Vigenère was the first of these to resist casual attack. Instead of one fixed shift it uses a keyword, shifting each letter by the next letter of the key and starting over at the end — so the same plaintext letter becomes different ciphertext letters depending on where it falls. That defeats the letter-frequency counting that breaks Caesar, and for roughly three centuries it was known as le chiffre indéchiffrable. It is not: once you know the key length, a Vigenère message is just several interleaved Caesar ciphers, each solvable on its own, and the key length can be recovered from repeated sequences in the ciphertext. Charles Babbage did exactly this in the 1850s.

XOR is the odd one out. Rather than working on letters it works on the bytes underneath, combining each byte of your text with a byte of the key using exclusive or, and repeating the key as often as needed. It is an operation real cryptography is built on — but only with a key as long as the message and never reused. With a short repeating key it is among the easiest ciphers there is to break, and it can be broken from the ciphertext alone. Because its output is arbitrary bytes rather than letters, this tool renders it as hexadecimal or Base64; that encoding is a way of writing bytes down, not part of the cipher, and it is not a second layer of anything.

What the options do. The alphabetic ciphers change letters A–Z only. Case is preserved, and spaces, punctuation, digits, accented letters, emoji and non-Latin scripts all pass through exactly as you typed them — so a message with them in comes back character-for-character identical after a round trip. The "five-letter groups" switch formats the output the way ciphers were sent by telegraph: uppercase, letters only, in blocks of five. That deliberately throws away the word boundaries, which are a strong clue to anyone attacking the message, and it means grouped output cannot be turned back into the original spacing.

Nothing here provides confidentiality. These ciphers are puzzles and history, and the tool is worded throughout as encode and decode rather than encrypt and decrypt because the difference is real. If you need a message to stay private, use a tool designed for that — age for files and GnuPG for anything needing keys you can publish are both free, open source and installable without an account.

For chaining several steps together — decode Base64, then XOR, then decompress — use CyberChef. It builds operations into a recipe, runs locally in your browser, and is free and open source with no account.