The scytale cipher

The scytale (also spelled skytale) is a rod. According to ancient writers, the Spartans wrapped a strip of leather or parchment around one, wrote along its length, and unwound the strip. What was left was a jumble of letters that made sense only when wound round a rod of the same thickness. It's the oldest transposition cipher with a name, the way the Caesar cipher is the oldest substitution cipher with one. Historians still argue over whether it was really a cipher at all.

Try it

Nothing you type here leaves your browser.

The letters round the rod setting is the rod's width. To decrypt, use the same width.

How it works

Picture a rod with five letters fitting round its circumference. Write the message along the rod so it fills the surface row by row. With HELP ME I AM UNDER ATTACK the first row is HELPM, then EIAMU, NDERA, TTACK. The strip winds in a spiral while the writing runs along the rod's length, so the letters that end up on the strip are the ones down the columns of that table: H E N T from the first column, then E I D T, L A E A, and so on.

What gets sent is HENTEIDTLAEAPMRCMUAK. Someone with a rod of the same width winds the strip on and reads along it. Someone without the rod has to guess the width. In arithmetic terms it's a columnar transposition with a key of just 1, 2, 3, …: write in rows, read the columns.

What the ancient sources say

The earliest mention, an indirect one, comes from the poet Archilochus in the seventh century BC. Apollonius of Rhodes, in the middle of the third century BC, gives the first clear hint that it carried secret messages. The first description of how it worked is Plutarch's, written around 100 AD. In his Life of Lysander (chapter 19) he says the Spartan ephors and their commander each kept one of two matching rods, the same length and thickness. A message was written on a strip wound round the rod, and only the strip was sent. He adds that the strip is called a scytale after the rod, the way the thing measured takes its name from the measure.

That's a late, second-hand source for a practice supposedly centuries older, and doubts have been raised. In 1998 Thomas Kelly argued in Cryptologia (in "The Myth of the Skytale") that Plutarch's account is hard to square with the earlier references, that the device is cryptographically very weak, and that the scytale may have carried plain messages, perhaps as a badge of authority. Frank Russel proposed in 1999 that it authenticated messages and didn't conceal them: a forged strip wouldn't read properly when wound on the real rod. The question is open. The idea itself is real, and everyone who's met it since has recognized a transposition.

Breaking it

The rod's width is the key, and only a few widths are plausible. Take the strip above and try every width from 2 to 10. Width 2 gives HEEANPTMERICDMTULAAK, 3 gives HTRELCNAMTEUEAAIPKDM, 4 gives HIECEDAMNTPUTLMAEARK, and 5 gives HELPMEIAMUNDERATTACK. Only one reads. The same exercise shows why the ancient scholars worried: a method that falls to a few seconds' work can hardly have kept secrets from a literate enemy. An enemy who learned the trick could also forge messages, which would matter if the scytale was used for authentication.

As with other transpositions, such as the rail fence cipher, the ciphertext has the plaintext's letter counts, and the frequency analysis tool shows that at a glance.

The code

// Scytale: `rod` letters fit round the rod, so the text lies in rows of that length and the strip carries the columns.
function scytale(text, rod) {
  var rows = Math.ceil(text.length / rod), out = '';
  for (var c = 0; c < rod; c++)
    for (var r = 0; r < rows; r++)
      if (r * rod + c < text.length) out += text[r * rod + c];
  return out;
}

// Winding the strip back onto a rod of the same size puts the letters where they were.
function scytaleDecrypt(text, rod) {
  var rows = Math.ceil(text.length / rod), out = [], k = 0;
  for (var c = 0; c < rod; c++)
    for (var r = 0; r < rows; r++)
      if (r * rod + c < text.length) out[r * rod + c] = text[k++];
  return out.join('');
}

Common questions