Hill Cipher Decoder

Decrypt Hill cipher with known key or perform known-plaintext attack to recover the key matrix.

Ciphertext
0 letters
Plaintext
Matrix Size
Key Matrix (K)
det = 9 (mod 26)
Inverse (K⁻¹)
Click calculate to show

Matrix values: 0-25 (A=0, Z=25)

Determinant must be coprime with 26

How Hill Cipher Decryption Works

Decrypting the Hill cipher requires computing the inverse of the key matrix modulo 26, then multiplying each ciphertext block by that inverse. The formula is:

P = (K^-1 x C) mod 26

This tool supports two modes: standard decryption with a known key, and a known-plaintext attack that recovers an unknown key from matched plaintext-ciphertext pairs.

Computing the Inverse Matrix

2x2 Example

For key matrix K = [[3, 3], [2, 5]]:

Step 1 -- Determinant: det(K) = (3 x 5) - (3 x 2) = 15 - 6 = 9

Step 2 -- Modular inverse of determinant: Find x where 9x = 1 (mod 26). Testing: 9 x 3 = 27 = 26 + 1, so det^-1 = 3

Step 3 -- Adjugate matrix: For [[a,b],[c,d]], the adjugate is [[d, -b], [-c, a]]: adj(K) = [[5, -3], [-2, 3]] = [[5, 23], [24, 3]] (mod 26)

Step 4 -- Multiply: K^-1 = 3 x [[5, 23], [24, 3]] = [[15, 69], [72, 9]] = [[15, 17], [20, 9]] (mod 26)

3x3 Matrices

Computing a 3x3 inverse involves cofactor expansion, nine cofactor calculations, and the adjugate transpose -- significantly more complex than 2x2. This decoder automates the entire process. For manual practice, master 2x2 inverses first.

Decryption Walkthrough

Decrypting "HIAT" with key K = [[3, 3], [2, 5]]:

Using the inverse K^-1 = [[15, 17], [20, 9]] computed above:

Block 1: Ciphertext H(7), I(8)

[[15,17],[20,9]] x [7,8] = [15x7+17x8, 20x7+9x8] = [241, 212]

Mod 26: [241 mod 26, 212 mod 26] = [7, 4] = HE

Block 2: Ciphertext A(0), T(19)

[[15,17],[20,9]] x [0,19] = [15x0+17x19, 20x0+9x19] = [323, 171]

Mod 26: [323 mod 26, 171 mod 26] = [11, 15] = LP

Result: HIAT decrypts to HELP

Known-Plaintext Attack

The Hill cipher's purely linear structure makes it vulnerable to cryptanalysis when an attacker possesses matching plaintext-ciphertext pairs.

How It Works

Since C = K x P (mod 26), an attacker who knows both P and C can solve for K:

K = C x P^-1 (mod 26)

Matrix sizeCharacters neededEquations
2x24 (2 blocks)4 equations, 4 unknowns
3x39 (3 blocks)9 equations, 9 unknowns

The attack is deterministic -- given correct pairs, it recovers the exact key with 100% accuracy. This is not a probabilistic guess; it is a mathematical certainty arising from the cipher's linearity.

Using the Attack Tool

Switch to "Known Plaintext Attack" mode in the decoder above:

  1. Enter the full ciphertext you want to decrypt
  2. Provide matching plaintext-ciphertext pairs (at least 4 characters for 2x2, 9 for 3x3)
  3. Click "Find Key" to recover the encryption matrix
  4. The tool then decrypts the entire message automatically

This attack demonstrates why the Hill cipher, despite its mathematical elegance, cannot provide security against an adversary with even modest amounts of known plaintext.

Frequently Asked Questions

How do you decrypt the Hill cipher without the key?

Use a known-plaintext attack. If you have at least n-squared matching plaintext-ciphertext characters (4 for 2x2, 9 for 3x3), you can recover the complete key matrix by solving a system of linear equations. Switch to "Known Plaintext Attack" mode in the decoder above to try this automatically.

What if the key matrix is not invertible mod 26?

If the determinant shares factors with 26 (divisible by 2 or 13), no modular inverse exists and decryption is impossible with that key. Valid determinants mod 26 are: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25. Choose a different key matrix with a coprime determinant.

Can I decode a 3x3 Hill cipher online?

Yes. Select "3x3" as the matrix size, enter your key matrix and ciphertext, and click Decrypt. The tool computes the 3x3 inverse matrix automatically using cofactor expansion and the adjugate method, then applies it to each 3-character block.

What is the Hill cipher decryption formula?

P = (K^-1 x C) mod 26, where K^-1 = det(K)^-1 x adj(K) mod 26. The inverse matrix reverses the encryption transformation by "undoing" the original matrix multiplication. See our examples page for detailed calculations.