Cipher Decoder & Encoder

The eight options in the dropdown, and what each one does

Everything here translates live. There is no submit button: change the cipher, drag the shift slider, or type another letter and the right hand box updates immediately.

Caesar shift

Every letter moves a fixed number of places along the alphabet, wrapping round from Z back to A. The slider runs from -25 to 25 and starts at 3, which is the shift most often quoted in textbooks. With a shift of 3, Attack at dawn encodes to Dwwdfn dw gdzq. Decoding simply applies the shift in the opposite direction.

ROT13

A Caesar shift locked to 13. Because 13 is exactly half of 26, applying it twice returns the original text, which means encode and decode are the same operation. That property is why ROT13 became the internet's standard way of hiding a spoiler or a punchline in plain sight. Select Decode and a note appears on the page confirming this.

Atbash

The alphabet is reversed onto itself: A becomes Z, B becomes Y, M becomes N. Like ROT13 it is its own inverse, so cab becomes xzy and xzy becomes cab. There is nothing to configure.

A1Z26

Letters become their position in the alphabet, joined by hyphens. HELLO becomes 8-5-12-12-15. Going the other way, the decoder accepts numbers separated by hyphens, commas or spaces, and spaces between groups are read as word breaks. Anything outside 1 to 26 is passed through untouched rather than guessed at.

Vigenere

Instead of one fixed shift, each letter is shifted by the corresponding letter of a repeating keyword. The keyword box defaults to LEMON. Encode ATTACK with that keyword and you get LXFOPV: A shifted by L, T shifted by E, T shifted by M, and so on, with the keyword restarting once it runs out. The keyword advances only on letters, so spaces and punctuation in your message do not push it out of step. Non-letters in the keyword itself are ignored, and an empty keyword leaves the text unchanged and shows a prompt.

Rail Fence

A transposition cipher: the letters keep their identity but change position. Text is written diagonally down and up across a set number of rails, then read off row by row. With 3 rails, HELLO is written H on rail 1, E on rail 2, L on rail 3, L back on rail 2, O back on rail 1, so reading the rails in order gives HOELL. The rails box accepts 2 to 20. Unlike the letter ciphers, this one moves spaces and punctuation around with everything else, which is a large part of why the result looks so scrambled.

Base64 and Reverse

Base64 here is the same standard encoding used everywhere on the web, applied to the UTF-8 bytes of your text. Reverse flips the character order. Both are included because puzzle setters use them constantly, not because they hide anything. For files or data URIs, the dedicated Base64 Encode & Decode page is the better fit.

How your punctuation and capitals are treated

Caesar, ROT13, Atbash and Vigenere only touch the 26 letters. Digits, spaces and punctuation pass straight through, and the case of each letter is preserved. That makes the output easy to proofread, but it also leaks structure: word lengths, sentence breaks and the shape of proper nouns all survive, which is exactly what a solver looks at first. For the harder version, strip the spaces from your plaintext before encoding.

Cracking a Caesar you do not have the key for

Choose Caesar, switch Direction to Decode, and a table appears under the boxes listing the result of every shift from 1 to 25. Scan the column for the row that reads as language. On a message of more than a few words there is usually exactly one, and the whole attack takes a few seconds. That is the honest measure of how strong a Caesar cipher is: a person can break it by eye, without a computer, in the time it takes to read a paragraph.

Atbash and ROT13 have no key at all. Rail Fence has at most 19 options here, so the same exhaustive approach works. Vigenere is the only one on this page that resists casual brute force, and even it falls to well-known techniques that look for repeated sequences to recover the keyword length.

None of this is security

These are historical ciphers and puzzle tools. Every one of them was broken long before computers existed, and none should ever be used to protect anything you genuinely care about. Use them for escape room props, geocache clues, treasure hunts, classroom exercises and spoiler tags. Use proper encryption, provided by software built for it, for anything else.

Building and solving puzzles faster

The Swap input/output button moves the result back into the left box and flips the direction, which is how you chain layers: encode with Vigenere, swap, then encode the result with Rail Fence. Solvers then have to peel the layers off in reverse order. Keep a note of the order and the keys, because there is no undo. For a layer that is not a letter substitution, Morse Code can be delivered as sound or light, and Binary Translator turns a short phrase into a wall of ones and zeros.

Questions from puzzle setters

Why does the Caesar brute force table show 25 rows rather than 26?

A shift of zero returns the message unchanged, so it is not listed. Shifts 1 to 25 cover every other possibility, and shift 26 is the same as shift 0.

My Vigenere message will not decode. What went wrong?

Nine times out of ten the keyword differs. It is case-insensitive and non-letters in it are stripped, so Lemon and LEMON behave identically, but LEMONS does not. Check also that you have not accidentally left the direction on Encode.

Does Rail Fence keep my spaces?

It keeps them as characters but scatters them through the output, because spaces are shuffled along with letters. Decoding with the same rail count puts them back exactly where they were.

Can I encode text that is not English?

The letter-based ciphers only shift A to Z, so accented and non-Latin characters pass through unchanged and remain readable. Base64 and Reverse handle any text, including emoji.

Is my message sent anywhere?

No. Every cipher runs as plain JavaScript inside the page, so your text stays on your device and the tool keeps working with the network disconnected.