Security Runs locally Ready to use Built-in examples No tracking

Vigenere Cipher and Rail Fence Cipher

The Vigenere cipher shifts each letter by a different amount taken from a repeating key, so the same letter encrypts differently at each position. This page also covers the Rail Fence cipher. Both are teaching and puzzle tools, not modern encryption.

The Vigenere cipher upgrades the Caesar shift: instead of moving every letter by a fixed amount, it takes the shift for each position from a repeating key — the key LEMON repeated gives shifts of 11, 4, 12, 14, 13, and the plaintext ATTACKATDAWN encrypts to LXFOPVEFRNHR. The Rail Fence cipher is included on the same page; it only reorders the characters rather than altering them. Both are staples of classical-cipher teaching.

One convention affects interoperability: this tool shifts letters only, leaving digits, spaces and punctuation as they are and not consuming a key position for them. Many older implementations count a space as a position, and when the two sides disagree the key drifts out of step and everything decrypts to gibberish — the usual reason two implementations of the same cipher fail to agree. Classical ciphers belong in teaching and puzzles; real data wants AES.

—
—
—
—

How to use

  1. Choose the cipher: Vigenere or Rail Fence.
  2. Enter the text and, for Vigenere, the key.
  3. Encrypt or decrypt; the key repeats along the length of the message.
  4. Treat the result as a puzzle — modern data needs AES.

How it works

The Vigenère algorithm

Vigenère: convert each key letter to a shift of 0–25 and apply a Caesar shift to the plaintext letters in turn, cycling the key. For example, the key LEMON maps to 11, 4, 12, 14, 13, and ATTACKATDAWN encrypts to LXFOPVEFRNHR; decryption reverses the shifts. This tool shifts only A–Z and a–z, preserving case; digits and punctuation pass through unchanged and consume no key position — crucial, since many implementations count spaces as positions and desynchronize the two sides' keys.

The rail fence algorithm

The rail fence cipher writes the text in a zigzag across rows, then concatenates row by row. With 3 rails: the 1st character goes to row 1, the 2nd to row 2, the 3rd to row 3, then back to row 2, row 1, and so on; joining rows 1 to 3 in order gives the ciphertext. It changes no characters, only their order. Decryption first counts how many characters each row holds, then replays the same zigzag.

Why neither cipher is secure

Both are classical ciphers with a very low breaking threshold: rail fence rails rarely exceed a dozen, so trying each exhausts them; Vigenère masks letter frequencies with rotating shifts, but with enough ciphertext the spacing of repeated fragments reveals the key length, and per-position frequency analysis then yields each shift. Their proper place is teaching, puzzles and games — never protecting real data, which calls for AES-grade modern encryption.

Code example

JavaScript Vigenère encryption and decryption 

const vigenere = (text, key, enc = true) => {
  let ki = 0;
  return text.replace(/[a-z]/gi, (ch) => {
    const base = ch <= "Z" ? 65 : 97;
    const k = key[ki++ % key.length].toLowerCase().charCodeAt(0) - 97;
    const d = enc ? k : 26 - k;
    return String.fromCharCode((ch.charCodeAt(0) - base + d) % 26 + base);
  });
};

vigenere("ATTACKATDAWN", "LEMON");         // "LXFOPVEFRNHR"
vigenere("LXFOPVEFRNHR", "LEMON", false);  // "ATTACKATDAWN"

Python Non-letters do not consume a key position 

def vigenere(text, key, dec=False):
    out, ki = [], 0
    for ch in text:
        if ch.isalpha():
            base = 65 if ch.isupper() else 97
            k = ord(key[ki % len(key)].lower()) - 97
            d = -k if dec else k
            out.append(chr((ord(ch) - base + d) % 26 + base))
            ki += 1
        else:
            out.append(ch)   # punctuation is kept as-is and does not consume a key position
    return "".join(out)

FAQ

How does Vigenère relate to the Caesar cipher?

Vigenère generalizes Caesar. Caesar moves every letter by a fixed amount (say, 3), giving just 25 possibilities — testable at a glance. Vigenère lets the key rotate the shift per position: a key of length n offers 26^n combinations, far stronger. Caesar is Vigenère with a one-letter key.

Why aren't spaces and punctuation encrypted?

Deliberate, and essential for interoperability: this tool shifts letters only, leaving digits, spaces and punctuation intact without consuming key positions. If spaces counted as positions, both sides would need to agree on exactly which characters count — otherwise the keys desynchronize and everything decodes to garbage. Preserved punctuation also keeps the ciphertext's word structure readable for proofreading.

Is a longer key more secure?

Relatively, yes: longer keys cycle less often, making key-length inference from repeated fragments harder. In theory, a key as long as the plaintext, perfectly random and never reused makes Vigenère unbreakable (the one-time pad). In practice, long hand-managed keys invite errors — so it stays a teaching device, never for real data.

Can Vigenère be broken without the key?

Yes, with enough ciphertext. Standard attack: infer the key length from the GCD of gaps between repeated fragments (Kasiski examination), split the ciphertext into groups by position — each group is a plain Caesar cipher — and solve each shift by letter-frequency analysis (e, t and a dominate English). Short ciphertexts resist this; two or three sentences are usually beyond reliable recovery.

What happens if I pick the wrong rail count?

You get plausible-looking garbage — with no error at all, since the rail fence has no validation and any rail count produces output. Decryption therefore needs human judgment: common rails are 2–6, and nonsense results warrant a retry. This is one reason it can't serve as real encryption.

The decryption came out as garbage — what's most likely wrong?

Three directions: the key or rail count is wrong; the encryption conventions differed (some tools count spaces as key positions, some only handle uppercase — mismatched rules guarantee failure); or the ciphertext was altered in transit (case changes, stray spaces, editor line-wrap truncation). A wrong Vigenère key raises no error — only whether the output reads like language reveals it.

Can Vigenère protect real data?

No. Its key is almost always far shorter than the text, only letters transform, and statistical fingerprints — letter frequencies, word-length distribution — survive. Modern tools crack it in minutes. It's teaching material that "looks like encryption", not an encryption scheme; use validated algorithms like AES or ChaCha20 with long random keys.

Can the key be Chinese or contain spaces?

You can type them, but non-letter characters are ignored: "l-e m o n" acts as LEMON. If the key contains no letters at all (like "12345"), the tool reports an invalid key — deliberately, since a result that "looks encrypted" but shifts nothing is a false security worse than an error.