Atbash cipher
Mirror every Latin letter across the alphabet, A to Z and B to Y, so Hello, World! becomes Svool, Dliow! and running it again brings the original back. Digits, spaces and punctuation stay put. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Hello, World!
- Result
- Svool, Dliow!
- Length
- 13
- Letters mirrored
- 10
Atbash is the classical Hebrew-origin substitution cipher that mirrors every Latin letter across the alphabet: A maps to Z, B to Y, C to X, and so on through Z back to A, while digits, spaces, and punctuation stay put. Because the mapping is its own inverse, applying the same transform twice restores the original text, so one deterministic operation both encodes and decodes. People use Atbash for puzzle books, biblical-cipher demos, classroom monoalphabetic examples, and light spoiler obfuscation without installing crypto libraries.
How the Atbash mirror works
Atbash is a substitution cipher of Hebrew origin that folds the alphabet in half: the first letter swaps with the last, the second with the second-to-last, and so on, so A becomes Z, B becomes Y and C becomes X. Because the mapping is its own inverse, the same operation hides and reveals a message; there is no separate decode step. Uppercase and lowercase letters are mirrored within their own alphabets, so Hello, World! comes out as Svool, Dliow! with its capitals, comma and exclamation mark in place. Ten letters change and everything else stays exactly where it was.
Where Atbash fits, and where it does not
Atbash is at home in puzzle books, biblical-cipher demonstrations and classroom lessons on simple substitution. It also works for light spoiler hiding: riddle answers, scavenger-hunt clues and Easter eggs that readers can choose to reveal by running the text through again. It is not encryption. Anyone who knows the scheme can reverse it instantly, so it should never protect passwords, secrets or personal data. If you need a shifting alphabet such as ROT13 or Caesar, or an encoding such as Base64, those are different tools with different results.
Encode, decode, validation rules, and common pitfalls
There is no separate encode or decode mode: the same request shape performs both directions. Paste plaintext puzzle answers to hide them, or paste already-mirrored text to reveal them. Mixed-case phrases preserve case because upper and lower alphabets reflect independently.
Non-ASCII letters such as accented Latin or Cyrillic are not mirrored by this classical Latin Atbash definition; they pass through so the algorithm stays faithful to the monoalphabetic mirror people search for. Do not treat the result as encryption: anyone who knows the scheme can reverse it instantly, and the product page should never market Atbash as a security control for secrets, passwords, or personal data.
Prefer this landing when the search intent is literally atbash cipher or atbash encoder; ROT13, general Caesar shift calculators, and Base64 or hex encoders answer different intents and should stay separate tools.
What you can do with it
Puzzle and riddle obfuscation
Hide riddle answers, scavenger-hunt clues, and Easter eggs in Atbash so readers can opt in, then reverse the same string with one more call.
FAQ
How do I encode text with the Atbash cipher?
The response result field holds the mirrored string; method is always atbash.
How do I decode Atbash?
Use the same request. Atbash is its own inverse: paste the mirrored text into text and the result is the original Latin-letter content.
Is the Atbash cipher tool free?
The browser tool runs free on your device.
Does Atbash encrypt my secrets safely?
No. Atbash is a trivial reversible substitution meant for puzzles and teaching, not confidentiality. Never use it for passwords or sensitive data.
Does Atbash change accented letters or Cyrillic text?
No. This tool follows the classical Latin definition, so only A to Z and a to z are mirrored. Accented letters, Cyrillic, emoji, digits and punctuation pass through unchanged, which keeps mixed text readable around the swapped letters.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/atbash \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Hello, World!"}'const res = await fetch("https://api.kit.forhosting.com/enc/atbash", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Hello, World!"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/atbash",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Hello, World!"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/atbash", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Hello, World!"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Hello, World!"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/atbash", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Hello, World!"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.atbash",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
This capability takes a non-empty text field, returns the transformed string with a count of mirrored letters, and rejects empty input with a clear invalid_input error.
How Atbash works and what the response contains
Atbash mirrors each letter by position: the first letter of the alphabet maps to the last, the second to the second-last, and so on. Uppercase letters A through Z map to Z through A; lowercase letters a through z follow the same reflection within their own alphabet so case is preserved. Characters outside those ranges—digits, punctuation, whitespace, emoji, and non-Latin scripts—pass through unchanged so messages keep their shape and spacing. Send a JSON body with the required string field text set to any non-empty message; aliases input, value, and s are accepted when clients reuse older form names. Empty strings fail immediately with invalid_input because there is nothing meaningful to transform and the product promise is a real substitution result. On success the response includes result with the transformed text, method equal to atbash so downstream code can branch without sniffing shapes, length equal to the input character count, and letters_mirrored counting how many A–Z or a–z units actually flipped. Identical inputs always produce identical JSON because the path is pure character arithmetic with no network, no random seed, and no wall clock. Use letters_mirrored when you want to assert that punctuation-heavy strings still processed correctly without inventing a second mode field.
Encode, decode, validation rules, and common pitfalls
Missing text, non-string text, or an empty string all raise invalid_input and are not charged on the prepaid API. Whitespace-only strings that still have length greater than zero are accepted; only letters mirror, so a string of spaces returns itself with letters_mirrored equal to zero.
API usage, pricing, classroom workflows, and practical limits
Call the free in-browser atbash cipher for puzzle drafting, biblical-cipher demos, lecture slides, and one-off checks without writing a one-liner in every language. A typical classroom workflow shows students that mirroring the alphabet twice returns the original message, then contrasts that involution with a true keyed monoalphabetic cipher later in the syllabus. Support playbooks can reverse lightly obfuscated ticket notes that staff intentionally wrote in Atbash. Pair with Base64 or URL-encoding tools only when a later transport step needs a different alphabet—keep Atbash on its own landing so SEO intent stays sharp. Use the prepaid KIT API when a backend, serverless function, tutoring platform, or SDK needs a stable contract under balance at $0.002 per successful item; validation failures never consume balance after the engine rejects the request. Puzzle sites can precompute answers for display and reveal them on demand with the same endpoint. Authors shipping SDKs can map the result field straight into a copy button while method and letters_mirrored make OpenAPI examples self-explanatory. Keep payloads to ordinary text sizes appropriate for a Worker isolate item call; this tool is for messages and snippets, not multi-megabyte binary blobs.
Integration use cases
Classroom monoalphabetic demos
Teachers show that alphabet mirroring is an involution: encode, decode, and compare letters_mirrored without installing a crypto library or CAS.
Pipeline and CI fixtures
Scripts and continuous-integration tests pin deterministic Atbash outputs so accidental alphabet or case-handling changes fail fast.
Technical questions
What happens if text is empty?
The request fails with invalid_input. A non-empty string is required; empty input is not charged on the prepaid API.