Substitution Cipher: Encode, Decode and Generate Keys

What is a substitution cipher?

The key of a substitution cipher is a scrambled alphabet written under the normal one. Each plaintext letter is replaced by the letter beneath it:

Plain:   A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cipher:  Q W E R T Y U I O P A S D F G H J K L Z X C V B N M

This particular key is just the top row of a keyboard read left to right, then the middle row, then the bottom row, which is why puzzle books call it the QWERTY cipher or keyboard cipher. Any of the other 26! arrangements of the alphabet works the same way.

Two rules define a simple substitution cipher:

• One letter, one replacement. E becomes T every time it appears, never something else. That is why it is also called a monoalphabetic substitution cipher: the whole message uses a single cipher alphabet.
• The order of the letters does not change. Word lengths, spaces, punctuation and double letters all survive encryption.

You will see the same thing under several names: simple substitution cipher, monoalphabetic substitution cipher, replacement cipher, letter substitution cipher, and in newspapers and puzzle books, cryptogram.

How to use this substitution cipher tool

1. Pick Encrypt or Decrypt. Encrypt reads your text as plaintext and writes ciphertext; Decrypt does the reverse with the same key, so you never have to work out the inverted alphabet yourself.
2. Make a key. Choose Random, From keyword or Type all 26 letters in the key panel. The two-row table under the panel updates at once, and letters that appear in your text are highlighted in it, so you can see which part of the key the message actually uses.
3. Type or paste the text. The output updates as you type. Capital letters stay capital, lower-case letters stay lower-case, and anything that is not a letter is copied across unchanged.
4. Copy what you need. Copy the output, the 26-letter encryption key, or the decryption key. To keep a message private, send the ciphertext and the key by different routes.
5. Hand it to the solver. Try to crack it opens the substitution cipher solver with your ciphertext already filled in, which is a quick way to find out how much text a substitution cipher can stand before it gives itself away.

Encrypting a message, letter by letter

Take the sentence The treasure is under the third stone. and the QWERTY key above. Only eleven different letters appear in it, so only eleven columns of the key are needed:

Replace each letter and leave everything else alone:

The treasure is under the third stone.
Zit zktqlxkt ol xfrtk zit ziokr lzgft.

Look at what survived. The appears twice and becomes Zit both times. The full stop is still at the end. Every word still has the same length. These leftovers are exactly what a codebreaker uses, and they are why a substitution cipher is easy to break once a message is more than a sentence or two long.

Decrypting: the key read backwards

To decrypt, you look up each ciphertext letter in the bottom row and write down the letter above it. Doing that 26 times gives a second alphabet, the decryption key. For the QWERTY key it is:

Cipher:  A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Plain:   K X V M C N O P H Q R S Z Y I J A D L E G W B U F T

Ciphertext A comes from plaintext K, ciphertext B from plaintext X, and so on. The tool shows this inverted key next to the encryption key, so you can hand a friend whichever one is easier for them to use. Both describe the same cipher.

Three ways to make a key in this tool

Random key. One click shuffles the alphabet. Turn on No letter maps to itself if you want a key in which A never stays A, B never stays B, and so on. Puzzle-book cryptograms and the Science Olympiad Codebusters event both follow that rule, and a solver can use it as a clue, so it is worth matching if you are making practice puzzles.

Key from a keyword. Type a word or a phrase. The tool drops repeated letters, writes what is left at the start of the alphabet, and follows it with the unused letters in order. Codebusters uses three standard ways of lining that mixed alphabet up against the normal one, called K1, K2 and K3, and the tool can build all three. The Aristocrat cipher practice page explains the difference with worked examples. A key made this way is the same thing as a keyword cipher.

Type all 26 letters. Use this when a puzzle or a book gives you the key. The tool tells you at once if a letter is missing or used twice, because either mistake would make some letters impossible to decrypt.

Whichever way you make it, the key appears as a single 26-letter string you can copy and paste back in later.

How many keys are there?

There are 26 × 25 × 24 × … × 1 ways to scramble the alphabet:

26! = 403,291,461,126,605,635,584,000,000

That is about 4 × 10²⁶.

If no letter may map to itself, the count drops to about 1.48 × 10²⁶. That is roughly 37% of all keys, because a random shuffle leaves at least one letter in place about 63% of the time.

Trying every key is out of the question. That does not make the substitution cipher safe. Nobody breaks a substitution cipher by trying keys one by one; they read the leftovers described above. E is the most common letter in English, so the most common ciphertext letter is probably E. A three-letter word that keeps turning up is probably THE. A five-letter word with the pattern ABCCD, such as Zkqqt, has a double letter in the middle, which narrows it down to words like LOOKS or SEEMS. Each guess fills in a few columns of the key, and each filled column makes the next guess easier.

The substitution cipher solver does this automatically and shows the key it found. It even recovers the 31-letter example above, Zit zktqlxkt ol xfrtk zit ziokr lzgft., as long as its No letter decrypts to itself option is on; the QWERTY key happens to follow that rule. Switch the option off and, with so few letters to go on, the solver settles on nonsense such as Was weshopes to purse was water ownus. Short messages survive only because too many keys fit them, and one extra clue is enough to remove that protection.

Making your own cryptogram puzzle

A substitution cipher makes a good puzzle because the solver has everything they need except the key. Newspaper cryptograms have relied on that for over a century. A few choices decide whether the puzzle is fun or impossible:

• Length. Somewhere between 80 and 150 letters works well. Below about 50 letters the letter counts are too thin to guide anyone; above 200 the puzzle becomes routine.
• Choice of text. A well-known saying or a line from a book gives the solver a moment of recognition halfway through. Avoid lists of names, numbers spelled out, or rare words, which hide the patterns solvers rely on.
• Key. Generate a random key with No letter maps to itself turned on. Solvers expect that rule, and a letter left in place is a giveaway once noticed.
• Spaces. Keep the spaces for a normal cryptogram. Remove them and write the ciphertext in groups of five letters for a much harder puzzle; Codebusters calls that a Patristocrat.
• Hint. For beginners, reveal one word or two letters, for example "ZIT = THE". It removes the hardest part, the first foothold.

Before you hand the puzzle out, paste it into the substitution cipher solver. If the solver needs several attempts or lands on a wrong answer, a person will find it hard as well, and you may want a longer text or a hint.

Common mistakes with substitution ciphers

A repeated letter in a typed key. If two plaintext letters share one ciphertext letter, the message can no longer be decrypted with certainty: does Q mean A or K? The key box refuses a key until every letter appears exactly once.

Decrypting with the encryption key. Reading the key from the wrong row turns ciphertext into a second layer of gibberish rather than plaintext. Switching the tool to Decrypt and leaving the key unchanged avoids the problem.

Thinking a longer key is stronger. Every substitution cipher key, whether it comes from a seven-letter keyword or a fully random shuffle, is broken the same way, through letter frequencies and word patterns. A random key only helps in one respect: it does not leak a guessable keyword once part of it has been recovered.

Leaving names and numbers in plain sight. Digits are not encrypted, and a capitalised word at the start of a message is often a name. In a short note to a friend that hardly matters; in a puzzle it can give away much more than intended.

Famous substitution ciphers in stories

Two classic detective stories turn on breaking a substitution cipher, and both are solved with the method described above.

In Edgar Allan Poe's The Gold-Bug (1843), William Legrand finds a parchment covered in digits and printers' symbols. He reasons that the writer was English, counts the characters, and finds that the figure 8 is by far the most common, so it should stand for E. The group ;48 turns up again and again, which makes it THE. From there he works through the rest of the alphabet and reads directions to a buried treasure.

In Arthur Conan Doyle's The Adventure of the Dancing Men (1903), the ciphertext is a row of little stick figures, and a figure holding a flag marks the end of a word. Sherlock Holmes again starts from the most frequent figure as E, then uses short repeated words and a name he expects to see. At the end he writes his own message in dancing men, COME HERE AT ONCE, to bring the writer of the threats to the house.

Both stories use symbols rather than letters, but underneath each one is a simple substitution cipher: one fixed replacement for each letter. The Pigpen cipher on this site is a substitution cipher of the same kind with a geometric symbol for each letter.

The substitution cipher family

Many ciphers on this site are substitution ciphers with a limited choice of keys. A general substitution solver breaks every one of them, because each of their keys is also one of the 26! scrambled alphabets.

Other ciphers break the "one letter, one replacement" rule on purpose. The Vigenère cipher switches between several alphabets, so the same plaintext letter turns into different ciphertext letters. The homophonic cipher gives common letters several possible replacements to flatten the letter counts. The Playfair cipher replaces pairs of letters instead of single ones. Those changes are exactly what defeat simple frequency counting, and each of them needs its own method to break.

A short history

Substitution ciphers were the ordinary way to keep letters private for well over a thousand years, and their weakness was written down early. In the ninth century the Arab scholar al-Kindi described how to break them by counting letters, the method now called frequency analysis. By the sixteenth century, European courts used nomenclators: a substitution alphabet combined with code symbols for common words and names. Mary, Queen of Scots, wrote to the Babington conspirators in such a cipher in 1586. Thomas Phelippes, working for Elizabeth I's secretary Francis Walsingham, broke it, and the decrypted letters were used at her trial.

Today the simple substitution cipher survives as a puzzle. Newspaper cryptograms, escape rooms and the Science Olympiad Codebusters event all use it, precisely because a substitution cipher can be solved with patience and a pencil, and a monoalphabetic one leaves enough clues that a careful beginner gets there.