The Vigenère cipher explained: keyword encryption and how it was broken

The Vigenère cipher encrypts text with a keyword: each letter of the keyword gives a different Caesar shift, and the keyword repeats along the message. Because the same plaintext letter can become different ciphertext letters, simple letter counting no longer works, which is why it was called the indecipherable cipher. It was eventually broken in the nineteenth century by finding the keyword's length and then attacking each shift separately. The Vigenère cipher tool encrypts and decrypts with any keyword, and this guide shows how both the cipher and the attack work.

The idea: many Caesar shifts

Number the letters A=0, B=1 and so on to Z=25. Each keyword letter is a shift: with the keyword LEMON, the shifts are 11, 4, 12, 14 and 13. Write the keyword repeatedly under the message, then shift each message letter by the keyword letter beneath it, wrapping from Z back to A. To decrypt, subtract the shifts instead. In effect it is five Caesar ciphers taking turns, which is why The Caesar cipher explained: how it works and how to break it is the best starting point if the single-shift version is new to you.

Encrypting ATTACK AT DAWN

The textbook example uses the plaintext ATTACKATDAWN and the keyword LEMON, repeated as LEMONLEMONLE:

• A shifted by L (11) gives L.
• T shifted by E (4) gives X.
• T shifted by M (12) gives F, wrapping past Z.
• A shifted by O (14) gives O, and C shifted by N (13) gives P.

Continuing, the whole message becomes LXFOPVEFRNHR. The four A's of the plaintext became L, O, E and N, while the ciphertext R stands for D in one place and N in another. Letter counts no longer line up with plaintext letters, which is exactly what defeats simple frequency analysis. The tool keeps capitals, spaces and punctuation, and only advances the keyword on letters, so ATTACK AT DAWN becomes LXFOPV EF RNHR.

Three centuries unbroken

The cipher is named after the French diplomat Blaise de Vigenère, but it was first described by the Italian cryptographer Giovan Battista Bellaso in 1553. Vigenère's own 1586 book described a stronger variant, and the credit was later misattributed. For about three hundred years the method resisted the frequency analysis that broke simple substitution ciphers, earning it the French nickname le chiffre indéchiffrable, the indecipherable cipher. Charles Babbage broke a version of it around 1854 but did not publish, and the Prussian officer Friedrich Kasiski published a general method in 1863.

Kasiski examination: finding the key length

The weakness is that the keyword repeats. If the same plaintext fragment happens to line up with the same part of the keyword twice, it produces the same ciphertext twice. Encrypt THE SUN AND THE MOON with the keyword KEY and you get DLC CYL KRB DLC WSMX. Both THE's became DLC because they are 9 letters apart, and 9 is a multiple of the key length, 3. A codebreaker who sees DLC repeated 9 letters apart knows the key length probably divides 9. Collect the distances between several repeated fragments, find the factors they share, and the key length emerges. A statistical alternative, the Friedman test, uses the index of coincidence (how likely two random letters from the text are to match) to estimate the key length without relying on repeats.

Finishing the attack

Once the key length is known, say 3, split the ciphertext into three columns: letters 1, 4, 7 and so on; then 2, 5, 8; then 3, 6, 9. Every letter in a column was shifted by the same keyword letter, so each column is a plain Caesar cipher, and frequency analysis solves each one. You can paste a column into the Caesar cipher tool, whose cracking panel ranks all 25 shifts by how English the letter counts look; the best shift for each column spells out the keyword. Short messages with long keywords leave too little text per column, which is why longer keys helped. Taken to the limit, a truly random key as long as the message and never reused becomes a one-time pad, which cannot be broken by this or any other analysis.

Why it is not secure today

A computer runs the whole Kasiski and frequency attack in a fraction of a second, and if an attacker knows any part of the plaintext, subtracting it from the ciphertext reveals the key directly. Treat the Vigenère cipher as history and puzzles. For real protection, use modern encryption such as the AES-based message encryption tool with a strong passphrase from the password generator; Hashing, encryption and encoding explains how modern methods differ.