The Playfair cipher

The Playfair cipher encrypts letters two at a time, using a 5×5 square built from a keyword. Because it works on pairs, not single letters, it hides the letter frequencies that give away a simple substitution. Charles Wheatstone invented it in 1854, a friend's title gave it its name, and armies used it from the Boer War to the Second World War. A computer breaks it now, though not as easily as you might think.

Try it

Nothing you type here leaves your browser.

The square under the result is built from your key. I and J share a cell, and the message is cut into pairs, with an X inserted between a repeated pair and at the end if the length is odd.

How it works

Write the keyword into a 5×5 grid, skipping repeated letters, and fill the rest of the grid with the remaining letters of the alphabet in order. With the key PLAYFAIR EXAMPLE the square is:

Split the message into pairs of letters. HIDE THE GOLD IN THE TREE STUMP becomes HI DE TH EG OL DI NT HE TR EX ES TU MP. The second E in "TREE" would have been paired with the first, so an X went between them, which is the rule for a pair of identical letters. Each pair is then replaced under one of three rules.

1. Different row and different column (the rectangle): each letter is replaced by the letter in its own row and the other letter's column. HI becomes BM.
2. Same column: each letter is replaced by the letter below it, wrapping from the bottom to the top. DE becomes OD.
3. Same row: each letter is replaced by the letter on its right, wrapping from the end to the start. EX becomes XM.

The full message becomes BMODZBXDNABEKUDMUIXMMOUVIF. To decrypt, use the same rules in the opposite direction (left, up), then remove the filler Xs by eye.

Notice what Playfair does to a repeated letter. TREE was encrypted as the pairs TR and EX, not EE, so no ciphertext pair ever has two identical letters. That's a tell-tale, and a useful one for a codebreaker.

Wheatstone, Playfair and the army

Charles Wheatstone, an English scientist who worked on the telegraph, described the cipher on 26 March 1854. Its name comes from his friend Lyon Playfair, Baron Playfair, who promoted it to the British government, so it's sometimes called the Wheatstone–Playfair cipher.

British forces used it in the Second Boer War, in the First World War and again in the Second World War. It suited field use, with nothing but a keyword to remember, a pencil, and no machinery. New Zealand used it for messages to coastwatchers in the Pacific, and Royal Australian Navy coastwatchers used it as well. It's also the cipher you meet in many puzzle books.

Playfair's weakness was found early. Lieutenant Joseph Mauborgne of the US Army published a pamphlet in 1914 giving the first public solution. Bletchley Park later broke a stronger German version called Double Playfair, which used two squares (two-square cipher).

Why it's harder than substitution, and why it still falls

A simple substitution has 26 letters whose frequencies you can count. Playfair has 600 possible pairs (25 × 24, since a letter never pairs with itself in the ciphertext), and a good message uses each only a few times. Counting pairs, called digraph analysis, needs several times as much text as counting letters. The number of squares, 25!, is 15,511,210,043,330,985,984,000,000, about 1.55 × 10²⁵. That's large, though many squares are equivalent: rotating all the rows or columns together gives a different square that encrypts identically.

Several things help a cryptanalyst. Common pairs such as TH and HE survive as common ciphertext pairs, and reversing a plaintext pair reverses its ciphertext pair: if AB becomes XY then BA becomes YX. Pairs of that kind show up when the same word appears forwards and backwards. Known phrases in a message ("report", "regards") give an attacker a foothold to test.

Modern computers take a more direct approach. Start with a random square, decrypt the ciphertext, and score how English the result looks using four-letter statistics (the same scoring as the substitution solver). Make a small change to the square, such as swapping two letters or two rows, and keep it if the score improves. Plain hill climbing gets stuck, so the program accepts some worse moves early on and fewer later, a technique called simulated annealing. The script scripts/examples/playfair-break.mjs in this project does exactly that. On a 480-letter ciphertext made with the key MONARCHY SECRET it found a square that decrypts the whole message, after 16 runs of 60,000 steps each and about 27 seconds on an ordinary laptop. The square it found was the true one with every row and column shifted by one place, which encrypts identically. Most runs fail, and one success is enough.

With only 100 letters or fewer there isn't enough text for any method to be sure, which is the sense in which Playfair is stronger than a substitution cipher.

The code

The tool above runs the library function below. The core is the three rules, and building the square and cutting the message into pairs takes a few more lines.

// Playfair, one pair at a time. `sq` is the 25-letter square as a string, row by row (I and J share a cell).
// step = 1 encrypts (right, down); step = 4 decrypts (left, up).
function playfairPair(sq, a, b, step) {
  var ia = sq.indexOf(a), ib = sq.indexOf(b);
  var ra = Math.floor(ia / 5), ca = ia % 5, rb = Math.floor(ib / 5), cb = ib % 5;
  if (ra === rb) return sq[ra * 5 + (ca + step) % 5] + sq[rb * 5 + (cb + step) % 5];      // same row
  if (ca === cb) return sq[((ra + step) % 5) * 5 + ca] + sq[((rb + step) % 5) * 5 + cb];  // same column
  return sq[ra * 5 + cb] + sq[rb * 5 + ca];                                                // rectangle
}

// The square from a keyword: its distinct letters (J counted as I), then the rest of the alphabet.
function playfairSquare(keyword) {
  var seen = {}, out = '';
  (keyword.toUpperCase().replace(/[^A-Z]/g, '').replace(/J/g, 'I') + 'ABCDEFGHIKLMNOPQRSTUVWXYZ').split('').forEach(function (c) {
    if (!seen[c]) { seen[c] = true; out += c; }
  });
  return out;
}

Relatives

Delastelle's two-square and four-square ciphers use two or more squares and avoid Playfair's tell-tale of no repeated letters. The bifid cipher keeps the square but spreads each letter over two ciphertext letters.