The Atbash cipher is 2,500 years old, appears in the Hebrew Bible, and is self-inverse. It has no key space and zero security. Here is why it still matters.
The Atbash cipher is 2,500 years old. It appears in the Hebrew Bible. It is self-inverse, meaning encrypting twice returns the original text. And it is still used in puzzle hunts today.
Atbash is the simplest substitution cipher: reverse the alphabet. A becomes Z, B becomes Y, C becomes X, and so on. There is no key. The mapping is fixed. Everyone who knows the cipher can decrypt. This makes it useless for security but useful for obfuscation, ritual, and puzzles.
You can encode and decode with the Atbash cipher tool to see the reversal in action.
The Atbash cipher originated in Hebrew texts. The name "Atbash" comes from the first, last, second, and second-to-last letters of the Hebrew alphabet: Aleph, Tav, Bet, Shin. In Hebrew, Aleph maps to Tav, Bet maps to Shin, Gimel maps to Resh, and so on. The pattern is the same as the English version: first letter swaps with last, second with second-to-last.
The Hebrew alphabet has 22 letters. The mapping is:
``
Aleph <-> Tav
Bet <-> Shin
Gimel <-> Resh
Dalet <-> Qof
He <-> Tzadi
Vav <-> Pe
Zayin <-> Ayin
Chet <-> Samech
Tet <-> Nun
Yod <-> Mem
Kaf <-> Lamed
``
The Jewish Encyclopedia documents several instances of Atbash in biblical and rabbinic texts. The cipher was not used for secrecy in these contexts. It was used as a literary device, a way to refer to places or names indirectly, possibly for political or religious reasons.
The English Atbash mapping reverses the 26-letter alphabet:
``
Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher: ZYXWVUTSRQPONMLKJIHGFEDCBA
``
Each letter is mapped to the letter at the opposite end of the alphabet. Mathematically, for a letter at position P (A=0, B=1, ..., Z=25):
``
C = (25 - P) mod 26
``
Or equivalently:
``
C = (-P - 1) mod 26
``
To encrypt "HELLO":
- H (position 7) -> S (position 18, since 25 - 7 = 18) - E (position 4) -> V (position 21) - L (position 11) -> O (position 14) - L -> O - O (position 14) -> L (position 11)
Ciphertext: SVOOL.
Self-inverse property: Applying Atbash to "SVOOL" returns "HELLO". S (18) -> H (7), V (21) -> E (4), O (14) -> L (11), O -> L, L (11) -> O (14). The cipher is its own inverse because (25 - (25 - P)) = P. This means encryption and decryption are the same operation. There is no separate decrypt function.
The Atbash cipher tool demonstrates this: paste ciphertext into the encoder and you get the plaintext back.
The Atbash cipher appears in the Book of Jeremiah in the Hebrew Bible. In Jeremiah 25:26 and 51:1, the word "Sheshach" is used instead of "Babel" (Babylon). In Hebrew:
``
Shin <-> Bet
Shin <-> Bet (repeated)
Kaf <-> Lamed
``
The Hebrew word for Babylon is Babel (Bet-Bet-Lamed). Applying Atbash: Bet -> Shin, Bet -> Shin, Lamed -> Kaf. The result is Sheshach (Shin-Shin-Kaf). The author of Jeremiah used Atbash to refer to Babylon without naming it directly.
Another example appears in Jeremiah 51:1, where "Leb Kamai" is an Atbash of "Kasdim" (Chaldeans/Babylonians). The Wikipedia article on Atbash documents these and other biblical occurrences.
These examples are not encryption in the security sense. They are more like literary code-switching, similar to how modern writers might use euphemisms or veiled references. The Atbash encoding adds a layer of indirection that readers familiar with the convention can decode, while others read the surface text.
Atbash appears frequently in modern puzzle hunts, escape rooms, and CTF challenges. Its simplicity makes it a common first step in multi-stage puzzles: decode the Atbash layer to reveal a clue for the next stage.
Geocaching: Many geocache puzzles use Atbash as a simple encoding for coordinates or hints. The puzzle description might contain "SVIILF XLMW IZOO" which decodes to "HEROLD COLD RAAL" (nonsense, but the solver recognizes the pattern and tries Atbash).
Escape rooms: Atbash is popular because it can be solved without any tool. A player who recognizes the reversed alphabet can decode by hand in seconds. The fixed mapping means no key is needed, just the knowledge that Atbash is being used.
CTF warmup challenges: picoCTF and similar platforms sometimes include Atbash as a beginner challenge. The cipher identifier can detect Atbash by checking whether the ciphertext's frequency distribution is the mirror image of English letter frequencies.
The Caesar cipher with a shift of 25 is almost identical to Atbash, but not quite. Caesar-25 shifts each letter by 25 positions: A -> Z, B -> A (wrapping), C -> B. Atbash reverses: A -> Z, B -> Y, C -> X. They produce the same result only for A and Z. For all other letters, the mappings differ.
Atbash has no key space. The mapping is fixed. There is exactly one way to encrypt, and everyone who knows the cipher can decrypt. This means Atbash provides zero security, only obfuscation.
The cipher is monoalphabetic, so frequency analysis applies, but it is overkill. Since there is only one possible mapping, you do not need statistics to break it. You just apply the mapping. The frequency analysis post covers the general technique for monoalphabetic ciphers, but Atbash is the trivial case.
Atbash does not handle digits, punctuation, or case. The standard mapping applies only to the 26 uppercase letters. Extending to other character sets requires defining a new reversal mapping, which is straightforward but not standardized.
The substitution cipher helper can solve Atbash ciphers as a special case of monoalphabetic substitution, but the Atbash tool does it directly without the overhead of frequency analysis or pattern matching.
The Atbash cipher is a substitution cipher that reverses the alphabet. A maps to Z, B maps to Y, C maps to X, and so on. It has no key and is self-inverse, meaning applying the cipher twice returns the original text. It is one of the oldest known ciphers, originating in Hebrew texts around 500 BCE.
No. The Atbash cipher has no key space. The mapping is fixed and publicly known. Anyone who recognizes Atbash can decrypt instantly. It provides obfuscation, not security. It is used in puzzles, escape rooms, and biblical texts, not for protecting information.
A self-inverse cipher is one where the encryption and decryption operations are identical. Applying the cipher to the ciphertext produces the plaintext. Atbash is self-inverse because reversing the alphabet twice returns the original order. The mathematical property is that (25 - (25 - P)) = P.
The Atbash cipher appears in the Book of Jeremiah. In Jeremiah 25:26 and 51:1, the word 'Sheshach' is an Atbash encoding of 'Babel' (Babylon). In Jeremiah 51:1, 'Leb Kamai' is an Atbash of 'Kasdim' (Chaldeans). These were literary devices, not security measures.
Caesar shift 25 shifts each letter forward by 25 positions (A to Z, B to A, C to B). Atbash reverses the alphabet (A to Z, B to Y, C to X). They produce the same result only for A and Z. For all other letters, the mappings differ. Atbash is a reversal, not a rotation.
Atbash Cipher
Reverses the alphabet mapping A to Z, B to Y, and so on for encoding.
Caesar Cipher
Encrypt or decrypt messages by shifting letters through the alphabet.
Substitution Cipher Helper
Tools and utilities for solving substitution cipher puzzles.
Code Identifier
Identify the cipher or encoding used in a piece of text. Paste encoded or encrypted data and the code identifier returns ranked candidates with confidence scores.
Frequency Analysis Explained: How to Break Any Substitution Cipher
Al-Kindi discovered frequency analysis in 9th-century Baghdad. The technique still breaks CTF substitution ciphers today. Here is how it works and how to apply it.
The Caesar Cipher: History, Math, and Two Ways to Break It
Julius Caesar shifted letters by 3. Suetonius documented it around 121 CE. Learn the exact math, the ROT13 self-inverse property, and how brute force and frequency analysis break it in seconds.
