Vigenère Decoder: Break the Cipher Without the Key

What Does It Mean to Decode a Vigenère Cipher?

The Vigenère cipher shifts each letter of a message by an amount taken from a repeating keyword. With the keyword in hand, decoding is simple arithmetic: shift every letter back by the same amount. Without it, you are facing the problem that earned the cipher its old nickname, le chiffre indéchiffrable, the indecipherable cipher.

It turns out not to be indecipherable at all. The repeating keyword is the weakness. Because the same key letter comes round again every few characters, the ciphertext is really several simple Caesar ciphers interleaved, and each one can be attacked on its own with plain letter counting. The only hard part is working out how many there are, which is exactly what the key length analysis on this page does.

How to Use the Decoder

How the Solver Breaks the Cipher

The attack runs in three stages, and every stage is shown on the page while it works.

Step 1: Guess the key length with the index of coincidence

The index of coincidence is the probability that two letters picked at random from a text turn out to be the same. Ordinary English lands around 0.066 because a few letters do most of the work, while a uniformly random string of letters sits at 1/26 = 0.0385. Enciphering with a repeating key flattens the distribution and pulls the value down towards random.

Here is the trick. Split the ciphertext into columns by taking every third letter, then every fourth, then every fifth, and so on. When the spacing matches the key length, every column was enciphered by a single Caesar shift, which rearranges the letter frequencies but does not flatten them. The index of coincidence for those columns jumps back towards English. The chart on this page shows that jump, and the peaks are the key lengths worth trying. Note that multiples of the real key length peak as well, which is why a second test is needed.

The measure was introduced by William F. Friedman in 1922, in a monograph titled The Index of Coincidence and Its Applications in Cryptography.

Step 2: Confirm it with a Kasiski examination

Common words repeat in any real message. When a repeated word happens to line up with the same part of the key both times, it produces the same ciphertext both times. That means the gap between two identical ciphertext sequences is usually a multiple of the key length.

So the tool collects every three letter sequence that appears more than once, measures the gaps, factors them, and counts which factors keep coming up. A factor that dominates the tally is a strong hint at the key length. Friedrich Kasiski published this method in 1863 in Die Geheimschriften und die Dechiffrir-Kunst. Charles Babbage appears to have worked out the same idea around 1846 but never published it.

Step 3: Read off each key letter with frequency analysis

Once the key length is fixed, each column is a plain Caesar cipher. The solver tries all 26 shifts for a column and scores each one with the chi-squared statistic, which measures how far the resulting letter counts sit from the frequencies of ordinary English. The lowest score wins, and that shift is the key letter for that position. The per position table on this page lists the winning letter, its score, and the runner up, so you can see how decisive each choice was.

Finally, because chi-squared cannot tell a key length apart from its own multiples, every candidate decryption is scored again as a whole using English bigram statistics, that is, how likely its consecutive letter pairs are in real English. That last pass is what picks the winner among all the lengths and all three cipher variants.

When It Works, and When It Does Not

Every step above is statistical, so the amount of ciphertext matters more than anything else. A useful rule of thumb: the solver needs roughly 20 or more letters for each key position. A six letter key therefore wants at least 120 letters of ciphertext, and comfortably more than that to be reliable.

The last case is worth spelling out. A Vigenère cipher whose key is truly random, as long as the message and never reused, is a one-time pad. Claude Shannon proved in 1949 that such a cipher is unbreakable in principle, not merely hard: every possible plaintext of the right length is equally consistent with the ciphertext, so there is nothing for statistics to grip. What makes ordinary Vigenère breakable is the repetition, not the tabula recta.

A Worked Example

Take the message ATTACK AT DAWN encrypted with the key SKY. The key repeats across the letters of the plaintext:

Plaintext   A  T  T  A  C  K  A  T  D  A  W  N
Key         S  K  Y  S  K  Y  S  K  Y  S  K  Y
Shift      +18 +10 +24 +18 +10 +24 +18 +10 +24 +18 +10 +24
Ciphertext  S  D  R  S  M  I  S  D  B  S  G  L

Notice what happened to the first three letters. Plaintext A became S in three different places, and the repeated SD at positions 1 and 7 sits exactly six letters apart, a multiple of the key length. That is the Kasiski signal in miniature. On a real message, dozens of such repeats appear and their shared factors give the key length away.

Then the ciphertext splits into three columns by position: S S S S, D M D G and R I B L. Each column is a single Caesar shift, and comparing its letter counts against English frequencies recovers S, K and Y. Twelve letters is far too few for that to actually work, which is precisely why the tool reports low confidence on short inputs instead of pretending.

Vigenère, Beaufort and Variant Beaufort

Three ciphers share the same tabula recta and differ only in which direction the shift runs. A ciphertext that resists one often yields immediately to another, so the decoder tries all three unless you tell it otherwise. Writing P for the plaintext letter, K for the key letter and C for the ciphertext letter, all arithmetic modulo 26:

Decrypting When You Already Have the Key

Switch to Yes, decrypt and type the keyword. Only letters count, so spaces, digits and punctuation in the key are dropped, and case does not matter. Watch the index of coincidence tile as you type: a value near 0.066 means the decrypted text behaves like English and the key is almost certainly right, while a value near 0.038 means it is not.

To go the other way and encrypt a message, use the Vigenère cipher encoder, which also draws the tabula recta and shows how the keyword lines up against your text.

If the Result Looks Wrong

Related Tools

Technical Implementation

The key length search compares the average index of coincidence of the columns produced at every candidate period. For a text of N letters with counts n_i per letter, the index is:

IC = Σ nᵢ (nᵢ − 1) / (N (N − 1))

English prose  ≈ 0.066
Random letters ≈ 0.038  (1 / 26)

Each column is then scored against English letter frequencies with chi-squared. Rather than deciphering the column 26 times, the solver counts its letters once and reads each trial key letter off as a permutation of those counts:

for (let keyIndex = 0; keyIndex < 26; keyIndex++) {
    let chiSquared = 0;

    for (let cipherIndex = 0; cipherIndex < 26; cipherIndex++) {
        const plainIndex = decryptIndex(cipherIndex, keyIndex, variant);
        const expected = ENGLISH_LETTER_FREQ[plainIndex] * column.length;
        const difference = counts[cipherIndex] - expected;

        chiSquared += (difference * difference) / expected;
    }

    scores.push({ letter: ALPHABET[keyIndex], chiSquared });
}

Every resulting candidate is finally ranked by its average bigram log probability, which is what separates the true key length from its multiples and picks between the three cipher variants. The English letter and bigram tables were counted from roughly 2.7 million letters of public domain prose from Project Gutenberg, and ship with the page as a small data file rather than being fetched at runtime.