Puzzles · Puzzle series
The Cipher Ladder: 15 cipher puzzles
Fifteen levels from a Caesar shift to Enigma, an unsalted hash and a real sealed cipher.ink message. Every one runs in your browser.
Cipher Ladder is fifteen short messages, each harder than the last. Level 1 is a Caesar shift you can solve with a pencil. Level 15 is a real cipher.ink message, sealed with the real code, whose passphrase you have to earn. Each level gives you a ciphertext, a story line and a box for the answer, which is always one word from the decoded message. Hints are there if you need them, and after each level you get a link to the page that explains how that cipher works and how it was broken. The answers aren't in the page, only their hashes, and nothing you type is sent anywhere.
Your progress is remembered in this browser only, if it allows it. The page works without that.
How to play
Pick a level (they're numbered along the top, and you can jump to any of them), read the story line, copy the ciphertext and work out what it says. The tools linked under each level are the same ones in the tools section: a Caesar brute-forcer, a frequency counter, a substitution solver, a Vigenère cracker, the Enigma simulator and a XOR key-length finder. The cipher pages teach the method. You never need to install anything, and you can skip a level and come back.
In most levels the answer is the last word of the decoded message ("THE WORD IS …"), and capitals or lower case don't matter. In the transposition and machine levels the spaces were taken out when the message was enciphered, so "THEWORDISZIGZAG" ends with the word ZIGZAG. If a level has you stuck, three hints take you from a nudge to the key.
The fifteen levels, without the answers
| # | Cipher | What you will use |
|---|---|---|
| 1 | Caesar | Try all 25 shifts |
| 2 | Atbash | A flipped alphabet, no key |
| 3 | Affine | Frequencies, and a little arithmetic |
| 4 | Keyword substitution | Letter frequencies, or the solver |
| 5 | Rail fence | Recognizing a transposition |
| 6 | Columnar transposition | A keyword that orders the columns |
| 7 | Vigenère, short key | The key length, then Caesar columns |
| 8 | Vigenère, long key | The cracker, and enough text |
| 9 | Playfair | A 5 by 5 grid and pairs of letters |
| 10 | ADFGVX | A square, then a transposition |
| 11 | Enigma, rotor order unknown | The simulator and six tries |
| 12 | Repeating-key XOR | Hamming distance and column-by-column solving |
| 13 | An unsalted hash | Brute force, which is the lesson |
| 14 | A PBKDF2-protected riddle | Thinking, not guessing |
| 15 | A real cipher.ink message | Five words you earned on the way |
The two levels that are really about this page
Levels 13 and 14 are the lesson of the puzzle, and they're about the page you're on. Every answer here is checked by comparing its hash with one stored in the page, which keeps the answers out of the source. The hash is SHA-256 with no salt, so anyone can try guesses against it. Level 13 shows what that means. The answer is a four-letter word, and there are only 456,976 four-letter words in lower case, so a computer finds it in well under a second (the Show me the attack button does it in your browser and times it). That's precisely why password storage uses a salt and a slow function (what a salt is, how long cracking takes).
Level 14 is checked the other way. The page runs your answer through PBKDF2-SHA256 with 600,000 rounds before comparing, the same as cipher.ink does for a passphrase (PBKDF2). Now every guess costs a measurable fraction of a second on your own machine, and the button on that level times it and works out how long all 456,976 four-letter words would take. You can't brute-force your way through in a reasonable time, so you have to solve the riddle by thinking. It's the same puzzle with the same kind of answer, and a very different attacker's bill.
Level 15 is the real thing
The last level isn't a puzzle written in a toy format. It's a message sealed by Cipher.seal, the code that seals every message on this site (client-side encryption), stored as a static file so nobody can burn or destroy it. When you enter the five-word passphrase, the page runs Cipher.open on it: AES-256-GCM with a key made by PBKDF2 (AES-GCM). A wrong passphrase just fails, because the authentication tag doesn't verify and nothing is shown. The passphrase is five words, one from each prime-numbered level up to 11, so the only way to get it is to climb, or to try guessing five words at 600,000 rounds each.
Common questions
Can I cheat?
Of course. Plain hashes guard the answers to levels 1 to 13, and a determined person could guess against them, which is level 13's point. A slow hash guards level 14, and real encryption guards level 15. Cheating tells you nothing about the ciphers, so it's a poor way to spend the afternoon.
I solved a level but the answer is rejected.
Check the spelling and the last word. In levels with no spaces, split the text yourself, since the answer is the last word of the message. Capitals and spaces don't matter.
Is my progress saved?
In your browser's local storage, on this device only, if it allows it. Clearing the site data starts you again. Nothing is sent to any server, and there's no leaderboard.
Where do I start if I've never broken a cipher?
Level 1, then read the history of cryptography for the story that connects these ciphers, and try the prime hunt if you'd rather do numbers than letters.