Skip to content

Codes & Ciphers

Encode and decode the classical ciphers taught in puzzle hunts, escape rooms and cryptography courses — from Caesar and Atbash to Playfair, Hill, ADFGVX and a working Enigma I — with the arithmetic shown for every letter, plus Morse, binary, Base32 and other codes. Free, no sign-up.

Codes & Ciphers

36 tools · free, no sign-up

Ciphers by Family

Identifying an Unknown Cipher

Faced with a message and no key, look at what the ciphertext is made of before you try anything. The Cipher Identifier does this for you: paste the text and it reports the character set, the index of coincidence, letter pairs and a likely key length, and says which family the message resembles. By hand, the table below is the same reasoning.

The ciphertext…SuspectTry
Uses only dots and dashesMorse codeMorse Code Translator
Uses only 0s and 1s in groups of eightBinary ASCIIBinary Code Translator
Is numbers from 1 to 26A1Z26A1Z26 Converter
Is pairs of digits from 1 to 5Polybius squarePolybius Square Cipher
Is only the letters A, D, F, G, V and XADFGX or ADFGVXADFGVX Cipher
Is letters with English-like frequencies, just rearrangedA transpositionRail fence, then columnar
Is letters with a shifted frequency patternCaesar or another monoalphabetic substitutionCaesar brute force, then the Substitution Cipher Solver
Is letters with a flattened frequency patternA polyalphabetic cipherVigenère with a guessed keyword
Ends in = signs or uses mixed letters and digitsBase32 or Base64-style encodingBase Encoding Converter

For Puzzles and Learning, Not Secrets

Every classical cipher on this shelf, except a correctly used one-time pad, can be broken with pencil-and-paper methods or a few seconds of computing — frequency analysis broke simple substitution over a thousand years ago, and Enigma traffic was read during the Second World War. They are excellent for teaching how encryption works, for puzzles and for escape rooms. To protect real information, use modern, audited encryption such as the encryption built into your device or messaging app.

The encoders, decoders and password tools run in your browser, so messages and passwords you type are not sent anywhere. For the number theory behind Hill, affine and modular ciphers, see the Math Calculators shelf, and for spelling a message out loud, the NATO Phonetic Alphabet Converter.

Frequently Asked Questions

How do I decode a Caesar cipher without the key?
Use the brute-force view in the Caesar Cipher tool. There are only 25 possible shifts, so it lists every one and the readable line is usually obvious at a glance. ROT13 is the shift of 13.
What is the difference between a cipher and a code?
A cipher transforms letters or symbols by a rule and a key — Caesar shifts each letter. A code replaces whole words or units with something else by a fixed table — Morse replaces each letter with dots and dashes and has no key. In everyday use the two words overlap.
Is the Vigenère cipher secure?
No. It resisted casual attack for centuries, but the repeating keyword leaves patterns that the Kasiski examination and frequency analysis exploit. A long message under a short key can be broken quickly. Autokey, which builds the key from the message itself, removes the repetition but is still breakable.
Is a one-time pad really unbreakable?
Yes, but only if the pad is truly random, at least as long as the message, kept secret, and never used twice. Reusing a pad lets an attacker combine two ciphertexts and strip the key away, which is why the One-Time Pad tool warns you. A repeating-key XOR cipher is not a one-time pad and is easy to break.
Can the Enigma simulator decrypt real wartime messages?
Yes, if you know the settings used — rotor order, ring settings, starting positions and plugboard pairs. Enigma is symmetric: with the same settings, typing the ciphertext gives back the plaintext. Without the settings, the simulator cannot find them for you.
Are the passwords from the password generator safe to use?
The Password Generator builds passwords on your device with your browser's cryptographic random number generator, and nothing is sent to a server. Use a long password and store it in a password manager.