Hill Cipher

Only the letters A–Z are enciphered: spaces, digits and punctuation are dropped, and the result is in capitals.

How to Use the Hill Cipher

1. 1. Choose the size and the key. A 2 × 2 key enciphers letters in pairs, a 3 × 3 key in threes. Type the numbers (A = 0 … Z = 25; any whole number works and is taken mod 26), or a keyword whose first 4 or 9 letters fill the matrix row by row.
2. 2. Check the key. The working shows the determinant mod 26 and whether it has an inverse. If it does not, the tool explains why and suggests one entry to change.
3. 3. Match your source's convention. Most sources, Wikipedia included, multiply the key by column vectors (C = K · P); some textbooks, such as Stinson's Cryptography: Theory and Practice, use row vectors (C = P · K). The same key gives different cipher text, so choose the one your course uses.
4. 4. Type the message. Only letters count. When encoding, a padding letter completes the last block; when decoding, every step of the inverse and every block product is shown.

How the Hill Cipher Works

The Hill cipher treats letters as numbers — A = 0, B = 1 … Z = 25 — and a block of n letters as a vector. Enciphering multiplies the vector by an n × n key matrix K and reduces each entry modulo 26; deciphering multiplies by the inverse matrix K⁻¹. Every letter of a block depends on every letter of the block, so one change in the plain text changes the whole cipher block.

With the key below — the tool's default and the 2 × 2 example in Wikipedia's article — HELP splits into the pairs HE = (7, 4) and LP = (11, 15):

K = | 3  3 |
    | 2  5 |

K · (7, 4)   = (3·7 + 3·4,   2·7 + 5·4)   = (33, 34) ≡ (7, 8)   → H I
K · (11, 15) = (3·11 + 3·15, 2·11 + 5·15) = (78, 97) ≡ (0, 19)  → A T

So HELP enciphers to HIAT. A message whose length is not a multiple of the block size gets a padding letter, X by default, at the end.

Which Keys Work: The Determinant Mod 26

A key can be undone only if the matrix has an inverse modulo 26, and that happens exactly when its determinant has one: when the determinant is odd and not a multiple of 13, since 26 = 2 × 13. Here det K = 3 × 5 − 3 × 2 = 9, and 9 × 3 = 27 ≡ 1 (mod 26), so det⁻¹ = 3. The key with rows 2 3 and 4 5 fails: its determinant is −2 ≡ 24, an even number, so two different blocks would encipher to the same letters and no one could read the message back. Of the 26⁴ = 456,976 possible 2 × 2 matrices, 157,248 are invertible — about a third; of the 3 × 3 matrices, 1,634,038,189,056 are.

The inverse key by the adjugate method

The inverse is K⁻¹ = det⁻¹ × adj(K) mod 26, where the adjugate adj(K) is the transposed matrix of cofactors. For a 2 × 2 matrix that means swapping the two diagonal entries and negating the other two; for a 3 × 3 matrix, each entry is a 2 × 2 determinant with alternating signs. For the key above:

adj(K) = |  5  −3 |  ≡ |  5  23 |
         | −2   3 |    | 24   3 |

K⁻¹ = 3 × | 5  23 | = | 15  69 | ≡ | 15  17 |
          | 24  3 |   | 72   9 |   | 20   9 |

K⁻¹ · (7, 8)  = (241, 212) ≡ (7, 4)   → H E
K⁻¹ · (0, 19) = (323, 171) ≡ (11, 15) → L P

The 3 × 3 example from the same article works the same way: the keyword GYBNQKURP gives the key (6 24 1 / 13 16 10 / 20 17 15) — rows separated by slashes — whose determinant is 441 ≡ 25; ACT enciphers to POH, and the inverse key (8 5 10 / 21 8 21 / 21 12 8) turns POH back into ACT. Choose A keyword and 3 × 3 to check every step.

History

Lester S. Hill, an American mathematician, published the cipher in 1929 in The American Mathematical Monthly as "Cryptography in an Algebraic Alphabet", with a follow-up in 1931. It was the first polygraphic cipher in which it was practical — if only just — to work on more than three letters at once. Hill and a partner patented a machine of gears and chains that multiplied by a fixed 6 × 6 matrix; because the key was built into the gearing, Hill proposed combining the machine with other, secret steps.

Is the Hill Cipher Secure?

Not against an informed attacker. It hides single-letter frequencies better than a simple substitution, but it is entirely linear: anyone who knows a few blocks of matching plain and cipher text — about n² letters, 4 for a 2 × 2 key and 9 for a 3 × 3 — can set up linear equations and solve them for the key in moments. This is a known-plaintext attack, and it leaves the cipher useless for real secrets. The idea lives on, though: multiplying by a matrix over a finite field is the diffusion step of modern ciphers, such as the MixColumns step of AES.

Frequently Asked Questions

What is the Hill cipher?

A polygraphic substitution cipher invented by Lester S. Hill in 1929. It turns blocks of letters into vectors of numbers, multiplies them by a secret key matrix and reduces the result modulo 26. Decoding multiplies by the inverse of the key matrix.

How do you find the inverse of a matrix mod 26?

Find the determinant and reduce it mod 26, then find its inverse mod 26 — the number that multiplies it to 1 (for 9 it is 3, because 27 ≡ 1). Next form the adjugate: the transposed matrix of cofactors. Multiply the adjugate by the inverse of the determinant and reduce every entry mod 26. If the determinant has no inverse, the matrix has none either.

Why is my Hill cipher key not invertible?

Its determinant shares a factor with 26: it is even, a multiple of 13, or 0 mod 26. Such a key sends different blocks to the same cipher text, so decoding is impossible. Change one entry — the tool suggests which and to what — or pick another keyword.

How do you encrypt with a 3 × 3 Hill cipher?

Split the message into blocks of three letters, padding the last block if needed, and multiply each block by the 3 × 3 key, reducing mod 26. With the keyword GYBNQKURP, the key is (6 24 1 / 13 16 10 / 20 17 15) and ACT = (0, 2, 19) becomes (67, 222, 319) ≡ (15, 14, 7), which is POH.

Do you multiply by row vectors or column vectors?

Either, as long as both sides agree. Wikipedia and most courses write C = K · P with column vectors; Stinson's textbook writes C = P · K with row vectors, where JULY enciphers to DELW under the key (11 8 / 3 7). The two conventions give different cipher text from the same key — one equals the other with the matrix transposed.

What happens if the message length is not a multiple of the block size?

The last block is padded with a filler letter, usually X. After decoding, the filler is still there at the end of the message, and the reader removes it.