Columnar transposition cipher
Under the keyword ZEBRAS, WEAREDISCOVEREDFLEEATONCE becomes EVLNACDTESEAROFODEECWIREE: the text is written in rows six columns wide and read column by column in the key's alphabetical order. The same keyword decrypts it. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- WEAREDISCOVEREDFLEEATONCE
- Key
- ZEBRAS
- Calculation mode
- encrypt
- Result
- EVLNACDTESEAROFODEECWIREE
- Encoding
- columnar
- Key length
- 6
- Column order
- 4, 2, 1, 3, 5, 0
This columnar transposition cipher tool encrypts or decrypts text by rearranging characters under a keyword instead of substituting letters. You enter a message, a non-empty key, and an optional mode; the engine builds a grid whose width equals the key length, writes the text left to right and top to bottom, then reads each column top to bottom in the order obtained by sorting the key characters. Decrypting reverses that layout so the same keyword restores the original string bit for bit. A classic check is WEAREDISCOVEREDFLEEATONCE under key ZEBRAS encrypting to a well-known ciphertext that decrypts back under the same keyword.
What columnar transposition is and what this tool returns
Columnar transposition is a classical rearrangement cipher: the secret is the order of columns, not a letter substitution table. The keyword sets both how many columns the grid has and the sequence in which those columns are read when encrypting. Characters of the plaintext are written into the grid row by row; when the last row is incomplete, left-hand columns simply hold one more character than right-hand ones, matching the usual length-preserving textbook rule without forced padding characters unless you put them in the input yourself.
Encryption concatenates columns in keyword-sorted order; decryption writes the ciphertext back into those columns using the same heights derived from total length and key width, then reads the grid row by row to recover the original. Tie-breaking is stable: if two key characters are equal, the left column is taken first so repeated letters do not invent an ambiguous order. This page always applies that fixed rule and never silently switches to route transposition, rail fence, or a substitution cipher.
Where columnar transposition shows up in lessons and puzzles
Developers and educators meet columnar transposition in capture-the-flag warm-ups, textbook chapters on classical cryptology, and demos that show why rearrangement alone is not enough against known-plaintext and anagram attacks once message length grows. Frontend teams can scramble sample phrases for screenshots without inventing a custom alphabet, then recover them with decrypt under the same key. Backend services encode short challenge strings for puzzle APIs or teaching sandboxes where students must rebuild the grid to unlock the next step.
Quality engineers generate deterministic encrypt and decrypt pairs for contract tests so a middleware that claims columnar support cannot silently switch to a rail-fence pattern or drop spaces. Contest organizers precompute answer keys for modest English phrases without trusting opaque web toys that force uppercase-only output or insert padding X characters you never asked for. Product and education tools use the transform when a learner pastes ciphertext and the UI must show the recovered plaintext under the documented keyword.
Pair it with other classical encoding helpers when you are building a small lab of free, deterministic text tools, and never treat columnar transposition as a substitute for modern authenticated encryption.
What you can do with it
CTF and classical cipher practice
Encrypt and decrypt keyword-ordered columnar phrases for puzzles, classrooms, and capture-the-flag warm-ups.
History-of-crypto lessons
Demonstrate row-write column-read rearrangement, stable repeated-key letters, and length-preserving grids without forced padding.
FAQ
What does the columnar transposition tool cost?
It is free in your browser on this page.
How do I decrypt a columnar ciphertext?
Send the ciphertext as text, the same keyword as key, and set mode to decrypt (or dec, decode, d). Encryption is the default when mode is omitted.
What happens if the key is empty?
The keyword must be a non-empty string so the engine can order at least one column.
Are spaces and punctuation kept?
Yes. Every character of the input is rearranged; nothing is stripped or case-folded. Spaces and symbols move with the letters.
Is columnar transposition secure for real secrets?
No. It is a classical teaching cipher. Use modern authenticated encryption such as AES-GCM for real confidentiality.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/columnar \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"WEAREDISCOVEREDFLEEATONCE","key":"ZEBRAS"}'const res = await fetch("https://api.kit.forhosting.com/enc/columnar", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "WEAREDISCOVEREDFLEEATONCE",
"key": "ZEBRAS"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/columnar",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "WEAREDISCOVEREDFLEEATONCE",
"key": "ZEBRAS"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/columnar", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"WEAREDISCOVEREDFLEEATONCE","key":"ZEBRAS"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"WEAREDISCOVEREDFLEEATONCE","key":"ZEBRAS"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/columnar", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "WEAREDISCOVEREDFLEEATONCE",
"key": "ZEBRAS"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.columnar",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
All characters move together—spaces, digits, and punctuation keep their places in the sequence and are never stripped—so phrases and CTF payloads stay faithful to textbook worksheets. Use it free in the browser for history-of-crypto lessons, puzzle design, and reversible lab demos, or call the API at $0.002 per successful request when pipelines need reproducible columnar transforms.
What columnar transposition is and what this tool returns
The JSON response includes result for the rearranged string, encoding fixed to columnar, mode set to encrypt or decrypt, key echoing the keyword you supplied, key_length, column_order as the zero-based original indices in read order, input_length and output_length which always match because the transform only permutes, and a formula string that restates the row-write column-read contract for documentation and tests. There is no streaming path and no silent fallback to Vigenère or Base64: either you supply non-empty text and a non-empty key, or the request fails with invalid_input. If you need polyalphabetic shifts, Morse, or modern encryption, use those dedicated endpoints; this landing answers only the classical columnar keyword contract that crypto history chapters and CTF warm-ups already describe.
How text, key, and mode are read and how results stay reproducible
Key accepts keyword, k, password, and passphrase; the entire non-empty string defines the columns, including digits and symbols if you include them, because ordering uses Unicode character comparison rather than stripping to A–Z only. The preferred payload fields are text for the message, key for the keyword, and optional mode for encrypt or decrypt. Text accepts aliases such as input, value, s, message, plaintext, and ciphertext so forms and SDK clients can reuse existing column names without renaming every call site. An empty key or a missing key is rejected with invalid_input and a clear message that a non-empty keyword is required to order the columns. Mode defaults to encrypt when omitted and also accepts short aliases such as enc, encode, e for encrypt and dec, decode, d for decrypt; any other string fails validation. Missing text, empty text, non-string types, and unknown modes all raise invalid_input so a blank form does not look like a successful no-op. Column order is computed once from the key, then the same heights formula is used on encrypt and decrypt so a round trip always restores the original payload for any non-empty string under that keyword. Pair the free browser run on this page with the priced API when you need the identical permutation inside an automated pipeline without re-implementing grid packing yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price.
Where columnar transposition fits in lessons, puzzles, and test fixtures
On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split — free interactive exploration and a priced, identical API — matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the rearranged result.
Integration use cases
Deterministic CI fixtures
Generate reproducible columnar ciphertext and plaintext pairs for unit tests, golden files, and contract checks.