What the Vigenère Cipher Tool Does
The Vigenère Cipher Tool encrypts and decrypts text with a repeating keyword, in the browser. Type or paste your message into the input panel, set a Key in the options bar — KEY until you change it — and choose Encrypt or Decrypt. The output panel shows the result, and a copy button puts it on your clipboard.
The transformation is deliberately faithful to how the historical cipher behaves on plain text. Only the letters a–z and A–Z change. Every digit, space, and punctuation mark passes through untouched, and capitalisation is preserved letter by letter — Hello never comes back as hello. The key advances by one position only when a letter of the message is processed, which means punctuation and spacing in the plaintext do not disturb the keyword alignment.
How the Vigenère Cipher Works
The Vigenère cipher is a polyalphabetic substitution: instead of shifting every letter by the same amount — the Caesar cipher's single rotation — it shifts each letter by an amount taken from the keyword. Write the key letter's alphabet position as a number (A = 0 through Z = 25). Encryption is then a single sum per letter:
C = (P + K) mod 26
and decryption runs the inverse: P = (C − K + 26) mod 26. When the keyword is shorter than the message, it repeats: the first letter of the message is shifted by the first key letter, the second by the second, and once the key runs out it wraps to its own beginning. A one-letter key degenerates exactly into the Caesar cipher, which is why the Vigenère cipher is sometimes described as several Caesar ciphers interleaved.
The property that made the cipher famous is that identical plaintext letters rarely encrypt to identical ciphertext letters. In a Caesar cipher every e becomes the same character, and simple frequency analysis breaks it in minutes. Under a five-letter key, an e can become five different characters depending on its position, which flattened the frequency signature enough that the cipher was called le chiffre indéchiffrable — the indecipherable cipher — for roughly three centuries.
The reputation did not survive Charles Babbage and Friedrich Kasiski, who showed that repeated ciphertext segments reveal the key length; split the ciphertext into that many slices and each is a plain Caesar cipher again.
Using the Vigenère Cipher Tool
- Step 1 — Enter the message. Paste or type your text into the input textarea. Mixed case, digits, and punctuation are all accepted; the letters will be transformed and everything else copied through verbatim.
- Step 2 — Set the key. In the options bar, replace the default
KEY in the Key field with your keyword. Only the alphabetic characters of what you type are used: a key like lemon-2024! behaves as LEMON, because digits and punctuation are stripped before the cipher runs. - Step 3 — Choose the direction. The mode selector offers
Encrypt and Decrypt. Decryption applies the same key positions as subtraction instead of addition; to recover a message you must use exactly the key that produced it. - Step 4 — Read or copy the output. The result appears in the output panel as you run the transform. Use the copy button above the panel to take the ciphertext into whatever you need it for — a puzzle answer sheet, a test fixture, a forum post about classical cryptography.
- Step 5 — Verify round-trip if the result looks wrong. Encrypt a sample, then decrypt it with the same key. If that round trip does not reproduce your input, the key was not what you assumed — almost always a stripped character or a typo in one key letter, which desynchronises every letter after it.
Common Use Cases
Capture-the-flag puzzles. Vigenère ciphertext is a staple of beginner CTF crypto rounds precisely because the key-recovery path is so teachable.
Checking hand-worked homework. Cryptography courses assign table-and-pencil Vigenère exercises before they assign the attacks on it. Working one letter by hand and then running the full message here isolates whether you misunderstand the method or merely slipped a row on the tabula recta.
Generating test vectors. If you are implementing the cipher yourself — a common early-project exercise — you need known-good input/output pairs to test against.
Demonstrating why classical ciphers fail. Encrypt the same paragraph under keys of length 1, 3, and 8 and compare the letter-frequency profiles of the outputs.
Worked Example
The classical demonstration pair for this cipher uses the key LEMON and the plaintext ATTACKATDAWN. Enter the plaintext, set the key to LEMON, leave the mode on Encrypt, and run the transform:
Plaintext: ATTACKATDAWN
Key: LEMONLEMONLE
Ciphertext: LXFOPVEFRNHR
The first letter shows the whole mechanism. A is position 0 and L is position 11, so the output is (0 + 11) mod 26 = 11, which is L. The second: T is 19 and E is 4, so (19 + 4) mod 26 = 23, which is X. Working through the pair (T, M) gives 31 mod 26 = 5 = F, and so on down the message. Note how the repeated Ts of ATTACK become X, then F, then V — the polyalphabetic property in one glance.
Spaces do not disturb the alignment. Encrypt ATTACK AT DAWN with the same key and you get LXFOPV EF RNHR: the spaces pass through untouched and the key does not advance on them, so the letters still pair with LEMONLEMONLE exactly as before. Decrypting LXFOPVEFRNHR with key LEMON in Decrypt mode returns ATTACKATDAWN, completing the round trip.
One deliberately broken example is worth running: decrypt the same ciphertext with the key LEMONS. The output is ATSYCZQEPVAX — recognisably structured gibberish, with no error raised. The cipher has no way to know a key is wrong; only a human reads the output and notices it is not English.
Tips and Common Mistakes
- A key with no letters produces empty output. The implementation strips every non-alphabetic character from the key before running; a key like
1234 leaves nothing to shift with and the transform returns an empty string. If your output panel is blank, look at the key first. - Key case does not matter — plaintext case does.
lemon, LEMON, and LeMoN are the same key; each is folded to uppercase before use. The message's capitalisation, by contrast, is preserved: encrypting Attack yields Lxfopv, not LXFOPV. - A one-letter key is a Caesar cipher. With key
C, every letter shifts by exactly 2 and nothing about the output hides letter frequencies. - Spaces and punctuation leak information. Because non-letters pass through untouched, word boundaries and sentence structure survive into the ciphertext.
- Decrypting with a near-miss key fails silently.
LEMON versus LEMONS desynchronises the whole message after the first letter, and the tool cannot warn you — the wrong output looks exactly like right output until you read it. Keep keys short, memorable, and written down somewhere honest. - Never use this for anything you actually need secret. The Vigenère cipher has been broken for 150+ years and automated tools recover keys from a few dozen characters of ciphertext. This page is for study, puzzles, and demonstrations — real data needs modern authenticated encryption such as AES-GCM, which the domain's AES Encryption/Decryption Tool provides.
Frequently Asked Questions
Is the Vigenère cipher secure?
No — not by any modern standard. It was considered practically unbreakable for roughly 300 years, until Babbage and Kasiski independently showed that repeated ciphertext segments reveal the key length via the distances between them; once the key length is known, the message separates into independent Caesar ciphers that frequency analysis solves individually. Automated attacks today need only a modest sample of ciphertext. Treat the cipher as a historical and educational artefact, and use modern authenticated encryption for anything real.Why did some characters in my text not change?
By design, only a–z and A–Z participate in the cipher. Digits, spaces, punctuation, and any non-Latin characters are copied through exactly as they were, and the key does not advance while passing them. This matches how the cipher is taught and how most reference implementations — and most CTF puzzle authors — expect it to behave.Why is my output empty?
Almost certainly the key. Everything non-alphabetic is stripped from the key before use, so a key of 1234 or !!! leaves no letters to shift with and the tool returns an empty string rather than guessing. Set a key containing at least one letter — the default KEY works — and re-run the transform.Does capitalisation of the key matter?
No. The key is folded to a single case before the cipher runs, so lemon and LEMON are identical keys. Mixed-case input like LeMoN is also fine. Capitalisation in the message is a different matter: it is preserved in the output, letter for letter, so Attack at dawn encrypts with its capitals in place.How is this different from the Caesar cipher?
A Caesar cipher shifts every letter by one fixed amount — it is exactly the Vigenère cipher with a one-letter key. That single shift is why Caesar output keeps the plaintext's letter-frequency profile and falls to trivial analysis, while a multi-letter Vigenère key flattens the profile across key positions. The two tools in this domain share behaviour deliberately:
Caesar Cipher Tool with shift
k produces the same output as this tool with key
K.
Related Tools
Caesar Cipher Tool is the single-shift special case of this cipher — useful for demonstrating what a one-letter key does to frequency analysis.
Rail Fence Cipher Tool implements the other classical family, transposition, where letters rearrange instead of substituting; combining the two was common historical practice.
XOR Cipher Tool shows the same repeating-key idea operating on bytes rather than letters.
ROT13 Encoder/Decoder covers the self-inverse Caesar variant beloved of spoiler-hiding, and
Hash Generator is where to go when you need to verify data integrity rather than conceal it.