Cipher encyclopedia

From Caesar to AES to post-quantum: how each cipher works, who made it, how it was broken, with a working example you can try.

Every entry follows the same plan: what the cipher is, a tool to try it, a worked example computed by the same code, who invented it and when, how it was broken (or why it wasn't), and where it stands today. Pick one from the groups below, or read down the page from the pen-and-paper systems to the post-quantum ones and watch the contest between the people who make ciphers and the people who break them play out again.

Classical ciphers

Pen-and-paper systems, from antiquity to the First World War.

The Caesar cipherShift every letter by a fixed amount. It's the oldest cipher with a name, and you can break it by hand in a minute.
ROT13ROT13 is a Caesar shift of 13, so applying it twice gets your text back. It hides spoilers, never secrets.
The Atbash cipherA for Z, B for Y. A keyless cipher from the Hebrew Bible that undoes itself.
The affine cipherA Caesar shift with a multiplication added. It has 312 keys, a neat bit of modular arithmetic, and a break that needs only two letters.
The substitution cipherScramble the alphabet and you get 26! possible keys. Counting letters still breaks it. Here's how it works, who broke it first, and how.
The Vigenère cipherA Caesar shift that changes with a keyword. People called it the "indecipherable cipher" until Babbage and Kasiski broke it.
The Beaufort cipherKey minus plaintext instead of plus. A Vigenère variant that encrypts and decrypts with the same step.
The autokey cipherA Vigenère whose key continues into the plaintext, so it never repeats. Here's how it works and the guess that breaks it.
The Playfair cipherEncrypt letters in pairs with a 5x5 keyed square. Wheatstone devised it in 1854 and armies used it for ninety years.
The two-square cipherTwo keyed squares, one pair of letters at a time. It's Delastelle's reciprocal digraph cipher, and one pair in five passes through unchanged.
The four-square cipherDelastelle's four-square cipher encrypts letter pairs with two plain squares and two keyed ones. A worked example, and how it's attacked.
The Polybius squareEach letter becomes a row number and a column number. It started as torch signals in ancient Greece and ended up as prison tap codes.
The bifid cipherSplit each letter into a row and a column, mix the halves together, then read them back in pairs. Fractionation, worked by hand.
The ADFGVX cipherThe 1918 German field cipher: a Polybius square plus a transposition. Georges Painvin broke it.
The columnar transposition cipherWrite the message in rows and read the columns in key order. The letters move but never change, and it served in two world wars.
The rail fence cipherWrite the message in a zigzag, then read off the rows. It's the simplest transposition cipher, and it has only a handful of keys.
The scytale cipherA strip wound round a rod. It's the oldest transposition cipher on record, if it was a cipher, and historians have doubts.
The pigpen cipherDraw the lines around a letter's cell and you have its symbol. The Freemasons' cipher, with a tool that draws it and decodes it.
Bacon's (Baconian) cipherFrancis Bacon's two-symbol alphabet writes each letter as five A or B symbols, and a message can hide in two typefaces.
The book cipherNumbers that point into a text you and your reader both have. How a book cipher works, a tool to try one, and the unsolved Beale ciphers.
The one-time padAdd a random key as long as the message, once. Shannon proved it perfectly secret, and almost nobody can use it.
The Hill cipherMultiply blocks of letters by a matrix mod 26. It was the first algebraic cipher, and four known letters break a 2x2 key.
The Great CipherLouis XIV's secret code used 587 numbers for syllables, and nobody could read it for two centuries until Bazeries did.
KryptosThe sculpture outside the CIA carries four messages. Here's how K1 to K3 were solved, what K4 is, and its disputed 2025 chapter.

Machine ciphers

Rotors, wheels and wartime codebreaking.

The Enigma machineThe rotor machine of the German military: how a key press travels through it, the double step, the key space, and how Poland and Bletchley Park broke it.
The Jefferson wheel cypherA stack of disks, each with its own scrambled alphabet. Jefferson had the idea, Bazeries built a cylinder, and the US Army adopted it as the M-94.
The Lorenz cipherThe German High Command's teleprinter cipher had twelve wheels and XOR. A careless depth in 1941, Tutte's deduction and Colossus did the rest.
The Purple cipher machineJapan's 1939 diplomatic machine used stepping switches and a 6/20 split. The US rebuilt it without ever seeing one, and Magic was the result.
The Typex cipher machineThe British Enigma with five rotors, several notches per rotor and a printer. How it differed, how many were built and how secure it was.
The SIGABA cipher machineFifteen rotors in three banks with irregular stepping. The American Army and Navy machine that has no known wartime break.
The M-209 cipher machineThe lunch-box machine of the US Army: six key wheels, a drum of bars, 140,000 built, and the attacks that read it.

Modern symmetric ciphers

Block and stream ciphers, from DES to AES and ChaCha20.

AES, the Advanced Encryption StandardThe reference card for AES: key sizes, rounds, standards, attacks, hardware speed, and how it compares with its rivals.
The Data Encryption Standard (DES)IBM's 56-bit Feistel cipher protected a generation of data, until a 1998 machine cracked it in 56 hours.
Triple DESDES three times over. How EDE works, why the strength is only 112 bits, and how the Sweet32 attack finished it.
The Blowfish cipherSchneier's 1993 free block cipher has fast Feistel rounds and S-boxes that depend on the key. Its descendant hashes passwords.
The Twofish cipherAn AES finalist with key-dependent S-boxes and a 16-round Feistel structure. What it does, and why AES won instead.
The Serpent cipherThe cautious AES finalist. It runs 32 rounds of small S-boxes and a linear mix, and no attack gets near the full cipher.
The ChaCha20 stream cipherA fast stream cipher built from add, rotate and XOR, with a Poly1305 authenticator. It runs under modern TLS, SSH and WireGuard.
The RC4 cipherA dozen lines of code that once secured the early web and Wi-Fi. How RC4 works, the bias you can measure, and how it fell.

Public-key cryptography

Locks anyone can close and only one person can open.

RSA encryption, step by stepTwo primes, their product, and a pair of exponents: a lock anyone can close and only one person can open. Worked through with 61 and 53.
Diffie-Hellman key exchangeHow two strangers agree on a secret in public, worked with p = 23, and the attacks (Logjam, man in the middle) that matter in practice.
ElGamal encryptionDo a Diffie-Hellman exchange with the recipient's public key and use the shared secret to hide the message. That's ElGamal, worked in full.
Elliptic-curve cryptographyAdd points on a curve instead of multiplying numbers, and you get RSA-level security from keys a twelfth the size.
The Massey-Omura cryptosystemLock it, send it, add your own lock, take yours off. The three-pass protocol with exponentiation, worked with p = 23.

Post-quantum

What replaces RSA and elliptic curves if quantum computers arrive.

Post-quantum cryptographyShor breaks RSA and elliptic curves, while Grover only halves AES keys. What quantum computers threaten, what NIST standardized, and what to do.
The ML-KEM key-encapsulation mechanismNoisy equations instead of discrete logarithms. How ML-KEM (FIPS 203, from Kyber) shares a secret in a way quantum computers can't break.
The ML-DSA signature algorithmHow ML-DSA (FIPS 204, from Dilithium) signs with lattices and retries until the signature leaks nothing, and what its sizes mean.