How the Vigenere Cipher Works, and Why It Was Called Unbreakable

The 16th-century diplomat Blaise de Vigenere did not actually invent the cipher that bears his name. Giovan Battista Bellaso described it in 1553 in La cifra del Sig. Giovan Battista Bellaso (Wikipedia). What Vigenere invented in 1586 was a self-keying autokey variant, a meaningfully stronger system that uses the plaintext itself as part of the key. The misattribution persisted for three centuries, in part because Vigenere's name attached to the simpler repeating-key version in popular usage, and in part because 19th-century writers rarely checked primary sources.

That confusion matters technically. Bellaso's system (the one called "Vigenere" today) uses a fixed repeating keyword. Vigenere's actual autokey variant uses the plaintext as the key after an initial primer. They look identical to a casual observer but have completely different resistance to cryptanalysis. The repeating-key version falls to the Kasiski examination. The autokey version does not, because its key never repeats. Use the Vigenere cipher tool to encrypt and decrypt as you follow this guide.

A monoalphabetic substitution cipher, like the Caesar cipher, maps every letter to exactly one other letter. A becomes D, B becomes E, always. That consistency is its weakness. Once an attacker learns a single mapping, they learn it for the entire message.

In natural English text, the letter E appears approximately 12.7% of the time, followed by T at 9.1%, A at 8.2%, and so on. The full distribution is uneven and predictable. In a monoalphabetically encrypted ciphertext, one ciphertext letter will still appear approximately 12.7% of the time, because the mapping is one-to-one. An attacker counts letter frequencies in the ciphertext, finds the most common one, and assumes it maps to E. The shift is revealed in one step. The letter frequency analyzer does this counting directly and renders the distribution as a bar chart.

A Caesar shift has only 25 possible keys, so brute force is trivial. A general monoalphabetic substitution has 26 factorial possible keys, which is enormous, but frequency analysis sidesteps the key space entirely. The attacker never searches the key space. They match ciphertext frequencies to known language frequencies and recover the mapping column by column.

The polyalphabetic idea emerged to solve this: instead of a single fixed substitution, use several different substitutions, cycling through them based on a key. If the key is LEMON (five letters), position 1 uses one Caesar shift, position 2 uses another, position 3 uses a third, and so on. After five characters, the cycle repeats. The effect is that E in position 1 encrypts to a different letter than E in position 3. The one-to-one frequency signature is scattered across multiple ciphertext letters, so simple frequency counting no longer works.

For roughly three centuries after Bellaso's 1553 description, this was considered mathematically unbreakable. The name that stuck on it, "le chiffre indechiffrable" (the indecipherable cipher), came from this belief. It was wrong, but the break did not arrive until the 1860s.

The tabula recta

The tabula recta is a 26x26 grid where each row is a Caesar-shifted alphabet. Row A is the normal alphabet, row B starts at B (B, C, D, and so on through Z, A), row C starts at C, and so on. To encrypt with the Vigenere cipher, you align the key letter with the plaintext letter in this grid and read the ciphertext letter at the intersection.

`` A B C D E F G H I J K L M N O P Q R S T U V W X Y Z A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C ... L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K ... Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y ``

You do not need the grid in practice. The formula does the same work.

The encryption formula

For each position i:

`` C_i = (P_i + K_i) mod 26 ``

Where P_i is the numerical value of the plaintext letter (A=0, B=1, through Z=25), K_i is the numerical value of the corresponding key letter (cycling through the keyword), and C_i is the resulting ciphertext letter. The key repeats to match the plaintext length, so K_i is the key letter at position (i mod keyLength).

Worked example: ATTACKATDAWN with key LEMON

The plaintext is 12 letters, the key is 5 letters, so the key repeats to fill 12 positions: L E M O N L E M O N L E.

Walk through the first few columns to see the arithmetic:

- Position 1: A (0) + L (11) = 11, which is L. - Position 2: T (19) + E (4) = 23, which is X. - Position 3: T (19) + M (12) = 31, and 31 mod 26 = 5, which is F. - Position 4: A (0) + O (14) = 14, which is O. - Position 5: C (2) + N (13) = 15, which is P. - Position 6: K (10) + L (11) = 21, which is V.

The pattern holds for every column. The final ciphertext is LXFOPVEFRNHR.

Notice what happened to the two T's in positions 2 and 3. They encrypted to X and F, different letters, because they aligned with different key letters (E and M). This is the polyalphabetic property that defeats simple frequency analysis.

Decryption reverses the operation:

`` P_i = (C_i - K_i + 26) mod 26 ``

The +26 before the mod keeps the result positive when C_i is smaller than K_i. For example, decrypting position 3: F (5) - M (12) + 26 = 19, and 19 mod 26 = 19, which is T. The key must be known. Without it, you are back to cryptanalysis.

Finding the key length with the Kasiski examination

In 1863, Friedrich Kasiski published Die Geheimschriften und die Dechiffrirkunst (Wikipedia), describing a method that Charles Babbage had independently discovered (and not published) around 1854 (Wikipedia). Babbage was provoked into the work by a challenge, and he solved it, but he never published his method. Kasiski published his, and the technique bears his name. The Kasiski examination exploits the repeating key.

When the same plaintext sequence happens to align with the same position in the key cycle, it produces the same ciphertext sequence. A cryptanalyst scans the ciphertext for repeated trigrams or longer sequences and records the distances between them. Those distances will be multiples of the key length. The greatest common divisor (GCD) of several such distances gives a strong candidate for the key length. Our Kasiski examination tool automates this process.

Worked example: if the trigram "XQV" appears at positions 12, 60, and 132, the distances are 48 (60 minus 12) and 72 (132 minus 60). The GCD of 48 and 72 is 24. The key length is likely 24, or a divisor of 24 (such as 12, 8, 6, 4, 3, or 2). You then test each candidate with the Index of Coincidence.

Confirming with the Index of Coincidence

William F. Friedman introduced the Index of Coincidence (IC) in his 1922 paper The Index of Coincidence and Its Applications in Cryptography, published by the Riverbank Laboratories (Wikipedia). The IC measures how likely two randomly chosen letters from a text are to be the same. The formula is:

`` IC = sum(n_i (n_i - 1)) / (N (N - 1)) ``

Where n_i is the count of letter i and N is the total letter count. The IC is a property of the text, not the key.

For natural English, IC is approximately 0.065. For a randomly distributed string, IC is approximately 0.038. A Vigenere-encrypted text with a 6-letter key will have an overall IC between these values, because each key position forms its own monoalphabetic stream blended together. Once you have a key length candidate from Kasiski, you split the ciphertext into groups (every nth letter for key length n) and check each group's IC. If the groups score near 0.065, your key length guess is correct. If they score near 0.038, the guess is wrong and you try another divisor. Each correctly split group is now a monoalphabetic substitution cipher, solvable with frequency analysis. The Index of Coincidence calculator handles this measurement directly.

The security ceiling

A Vigenere cipher with a 6-letter key has a theoretical key space of 26^6 = 308,915,776. That sounds large. For comparison, AES-128 has a key space of 2^128, roughly 3.4 x 10^38. The Vigenere cipher is broken by analysis, not brute force. The key space is irrelevant once Kasiski reveals the key length, because each key position is then attacked independently as a single Caesar shift with only 26 possibilities. A 6-letter key reduces to six independent 26-key problems, which is trivial.

CTF competitions: Vigenere challenges appear regularly on platforms like CryptoHack and picoCTF. The typical setup is a ciphertext without a stated key length. The expected approach is Kasiski, then IC confirmation, then per-position frequency analysis. Some challenges add noise: a short key, a long plaintext, or a key that is itself a word (which lets you check candidate keys against a dictionary). Our Vigenere cracker tool automates all three steps and reports the recovered key alongside the plaintext.

Historical use: The Vigenere cipher (Bellaso's version) was used by the Confederate Army during the American Civil War. The standard keys were phrases like "Manchester Bluff" and "Complete Victory." Union cryptanalysts broke it routinely. The South kept using it because the cipher had a reputation for security that was already three centuries out of date. By the time Kasiski's method appeared in print, the war was nearly over, but the Union had already been breaking Confederate messages for years using the same techniques Babbage had worked out privately.

Classroom teaching: The cipher is the standard second step in any introductory cryptography sequence, taught immediately after the Caesar cipher to illustrate why monoalphabetic systems fail and what polyalphabetic systems add. The Kasiski examination then shows why periodicity in the key is the next attack surface. It is a clean teaching tool because every stage of the attack is hand-traceable on paper. A student can perform Kasiski by hand on a 200-character ciphertext, split it into groups, and recover the key with a frequency table in under an hour.

The Vigenere cipher is broken by any competent cryptanalyst given a ciphertext of 50 characters or more, using only the Kasiski examination and frequency analysis. Both attacks are documented in public literature since 1863. There is no scenario where a repeating-key Vigenere cipher protects modern data. The 50-character threshold is conservative: with a short key and a long ciphertext, 50 characters is plenty for repeated trigrams to appear and for frequency analysis to land on each group.

A Vigenere cipher with a key as long as the plaintext and used only once is a different system. It becomes a Vernam cipher (one-time pad), which is information-theoretically secure. The proof, due to Shannon, is straightforward: if the key is truly random, as long as the message, and never reused, every plaintext of the same length is equally likely, so the ciphertext leaks zero information about the plaintext. But that system requires key distribution of the same length as the message, which is the fundamental problem it introduces. The one-time pad is secure in theory and impractical in most real settings because of that key distribution burden.

Do not use the Vigenere cipher for any purpose that requires actual confidentiality. It is appropriate for CTF challenges, historical study, and classroom demonstrations. For real encryption, use an authenticated cipher like AES-GCM or ChaCha20-Poly1305.

Ready to break one yourself? Paste a ciphertext into the Vigenere cracker tool and watch the Kasiski examination, IC test, and frequency analysis run end to end.