Beaufort cipher
With the keyword KEY, “Hello, World!” becomes “Danzq, Cwnnh!”, and the same keyword turns it back, because the Beaufort cipher subtracts each letter from the key letter and that step undoes itself. Spaces and punctuation stay put. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Hello, World!
- Key
- KEY
- Result
- Danzq, Cwnnh!
- Key letters
- KEY
- Key length
- 3
- Length
- 13
The Beaufort cipher is a classical reciprocal polyalphabetic cipher: each Latin letter is transformed against a repeating keyword with the modular formula C equals K minus P modulo twenty-six, and because that map is its own inverse, encrypting ciphertext with the same key restores the original plaintext. You paste any text and a keyword that contains at least one Latin letter; letters A through Z and a through z move under the key while digits, spaces, punctuation, and other characters stay put so readable structure survives.
How the Beaufort cipher transforms text with a keyword
Beaufort is a polyalphabetic cousin of the Vigenère family, but its encryption rule is different and reciprocal. Map each plaintext letter and each keyword letter to indices zero through twenty-five on the Latin alphabet. For every alphabetic character in the message, take the next keyword letter (the keyword repeats for as long as there are letters to transform) and compute the ciphertext index as key index minus plaintext index, taken modulo twenty-six.
Map the result back to a character of the same case so uppercase H becomes an uppercase cipher letter and lowercase stays lowercase. Characters outside A through Z and a through z—including spaces, commas, digits, emoji, and accented letters outside the basic Latin block—are copied unchanged and do not advance the keyword pointer. That design matches textbook tables and historical naval signal practice where only the alphabetic skeleton of a sentence is scrambled.
Because subtracting a letter from a key letter is an involution on the alphabet circle, applying the same keyword a second time undoes the first transform: encrypt and decrypt are the same operation, so this tool does not need a separate mode flag. Mathematically every step is integer modular arithmetic with a fixed twenty-six-letter alphabet; there is no floating-point rounding of the key, no network call, no random seed, and no wall-clock timestamp.
Where Beaufort cipher tools show up in real work
Introductory cryptography courses introduce Beaufort after Caesar and before modern block ciphers so students practice polyalphabetic tables and see a reciprocal map that does not need a separate decrypt rule. Capture-the-flag warm-ups and puzzle hunts still hide Beaufort or Beaufort-variant messages, and solvers want a fast, predictable keyword transform rather than a general cryptanalysis suite. Support and content teams sometimes lightly obfuscate spoilers, quiz answers, or internal labels with a classical keyword cipher and need the reverse path without installing a language-specific crypto library.
If you need a fixed single-letter Caesar shift, multi-alphabet Vigenère addition instead of Beaufort subtraction, strong authenticated encryption, Base32 or Base64 encoding, or automatic frequency-analysis key recovery, treat those as separate search intents and landings rather than overloading this classical Beaufort keyword page.
What you can do with it
Classroom polyalphabetic demos
Encrypt and decrypt sample sentences with a known keyword so intro-crypto lessons show a reciprocal table without a separate decrypt mode.
Puzzle and CTF keyword ciphers
Apply or reverse a Beaufort keyword on challenge strings without writing a one-off script for every problem set.
FAQ
What is the Beaufort cipher?
A classical polyalphabetic cipher that combines each letter with a repeating keyword using C = (K − P) mod 26. It is reciprocal: the same operation encrypts and decrypts.
How do I decrypt Beaufort ciphertext?
Call the same capability again with the ciphertext as text and the original keyword. Because Beaufort is self-inverse, a second pass restores the plaintext.
What happens if the key is empty?
The keyword must contain at least one Latin letter A–Z or a–z; empty or letter-free keys are rejected and not charged.
Are spaces and punctuation encrypted?
No. Only A–Z and a–z are transformed. Spaces, digits, punctuation, and other characters pass through and do not advance the keyword.
What does it cost?
The browser tool is free and runs locally.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/beaufort \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Hello, World!","key":"KEY"}'const res = await fetch("https://api.kit.forhosting.com/enc/beaufort", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Hello, World!",
"key": "KEY"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/beaufort",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Hello, World!",
"key": "KEY"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/beaufort", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Hello, World!","key":"KEY"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Hello, World!","key":"KEY"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/beaufort", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Hello, World!",
"key": "KEY"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.beaufort",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
An empty key or a key with no alphabetic characters is rejected immediately with invalid_input, so homework checkers and scripts never silently fall back to a default keyword.
How the Beaufort cipher transforms text with a keyword
Identical text and keyword always produce identical JSON. This page implements classical Beaufort only—not a single-shift Caesar cipher, not AES, and not an automatic key-recovery cracker that tries every dictionary word for you. Those are separate tools and separate search intents with their own landings.
What you send and what you get back
Send a required string field named text and a required string field named key. Classic checks include transforming Hello, World! with keyword KEY, verifying that feeding the ciphertext and the same key returns the original phrase, and confirming that an empty key is rejected rather than treated as a no-op identity. The text may be empty if you only want a trivial identity check, but the key must not be empty after the alphabetic filter: whitespace-only strings and keys that contain only digits or symbols fail with invalid_input and a clear English message that mentions the empty key requirement. On success the response echoes the original text and key, key_letters as the uppercase A-Z stream actually used, key_length as how many alphabetic positions that stream has, the transformed result string, length of that result, letters_transformed as a count of how many alphabetic characters moved, plus alphabet, cipher labels, a reciprocal true flag, and the formula string C equals K minus P mod 26 so clients can assert the profile they hit. Missing text, missing key, non-string objects for either field, and strings longer than the documented maximum fail with invalid_input. Validation failures do not consume prepaid balance.
Where Beaufort cipher tools show up in real work
Because this capability is a pure parse engine, API pricing is the published base of $0.002 per successful item and failed validation does not consume balance.
Integration use cases
Lightweight spoiler and label obfuscation
Scramble quiz answers or internal labels with a classical keyword and restore them later with the same contract in browser or API.