Keyboard coordinate cipher
On a US QWERTY keyboard, hello becomes 2,6 1,3 2,9 2,9 1,9: each letter is named by its row counted from the top and its column counted from the left. Decoding those pairs gives HELLO back. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- hello
- Calculation mode
- Encode
- Result
- 2,6 1,3 2,9 2,9 1,9
- Length
- 19
- Letters mapped
- 5
- Layout
- qwerty
A keyboard coordinate cipher does not rotate letters along the alphabet and does not slide them to neighboring keys. It names each character by where it sits on a standard United States QWERTY letter layout: a one-based row number from the top letter row downward and a one-based column number from left to right within that row. The letter H lives on the home row at column six, so it encodes as the token two comma six; Q is one comma one; M is three comma seven. Encoding turns a word into a space-separated list of those tokens; decoding reads the tokens and rebuilds uppercase letters. Spaces in a phrase become slash markers so multi-word text can round-trip.
How QWERTY row and column coordinates work
The United States QWERTY letter grid is treated as three independent rows counted from the top. Row one holds qwertyuiop across ten columns. Row two holds asdfghjkl across nine columns.
Row three holds zxcvbnm across seven columns. Columns are numbered from one at the left edge of each row, so the home-row letter A is two comma one, F is two comma four, and L is two comma nine. Encoding walks the input left to right: each Latin letter is looked up in a fixed map and emitted as a compact token of the form row comma column; each space becomes a slash token so word boundaries survive; tokens are joined with single spaces to form the result string.
Decoding splits the ciphertext on whitespace, accepts tokens written as row comma column, with optional parentheses, or with a hyphen or colon separator, maps each valid pair back to the uppercase letter on that key, and turns slash tokens back into spaces. Digits, punctuation, emoji, and letters outside the basic Latin block never appear on this letter-only grid, so the engine fails immediately with an out-of-grid message rather than inventing a coordinate.
Mathematically the transform is a static table lookup with no modular wrap and no key schedule: the same letter always maps to the same pair and the same valid pair always maps back to the same letter. There is no network call, no random seed, and no wall-clock timestamp in the path. This page implements physical keyboard coordinates only—not Polybius alphabet squares, not adjacent-key shifts, and not strong encryption.
Where keyboard coordinate ciphers show up in real work
Introductory cryptography and keyboard-layout puzzles often ask students to rewrite a message as the grid address of each key instead of counting alphabet positions; a single trusted oracle that encodes and decodes with explicit row and column numbers speeds homework demos and auto-graders. Capture-the-flag warm-ups and escape-room props sometimes hide phrases as lists of coordinates on notes or images, and solvers want a fast, predictable QWERTY map rather than a general cryptanalysis suite.
Support and content teams may lightly obfuscate spoilers or quiz answers as coordinate lists and need the reverse path without installing a language-specific library. If you need adjacent-key keyboard shifts, classical Polybius digit pairs on an alphabet square, Caesar alphabet rotation, or strong authenticated encryption, treat those as separate search intents and landings rather than overloading this keyboard coordinate page.
What you can do with it
Classroom QWERTY grid demos
Encode sample words as row,column tokens so students see physical keyboard positions instead of alphabet math, then decode to check their worksheets.
Puzzle and CTF coordinate phrases
Turn challenge strings into QWERTY coordinates or reverse a printed list of pairs without writing a one-off script for every problem set.
FAQ
What is a keyboard coordinate cipher?
A mapping that replaces each letter with its row and column on a US QWERTY letter layout, instead of rotating the alphabet or sliding to an adjacent key.
How do I decode coordinates back to letters?
Set mode to decode and pass space-separated tokens such as 2,6 for H. Optional parentheses and hyphen or colon separators are accepted; slash marks a space.
What counts as out-of-grid input?
On encode, any character that is not a Latin letter A–Z/a–z or a space. On decode, malformed tokens or row,column pairs that do not land on a real QWERTY letter key.
How are rows and columns numbered?
Rows are one-based from the top letter row (qwertyuiop) downward. Columns are one-based from left to right within each row.
What does it cost?
The browser tool is free and runs locally.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/keyboard-coords \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"hello"}'const res = await fetch("https://api.kit.forhosting.com/enc/keyboard-coords", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "hello"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/keyboard-coords",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "hello"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/keyboard-coords", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"hello"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"hello"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/keyboard-coords", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "hello"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.keyboard_coords",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Any character that is not a Latin letter or space on encode, and any coordinate that does not land on a real key on decode, is reported as out-of-grid input with a clear invalid_input error.
How QWERTY row and column coordinates work
Case on encode is ignored for the map lookup because physical keys do not have separate cells for upper and lower case; the decoded alphabet is always uppercase for a stable API contract. Because every step is pure string and integer work over a fixed layout, the cipher is fully deterministic: identical text and mode always produce identical JSON.
What you send and what you get back
Send a required string field named text and an optional mode field set to encode or decode. Encode mode maps each letter to a row comma column token and each space to a slash; decode mode reads those tokens and rebuilds an uppercase letter string. Classic checks include encoding hello to the five tokens two comma six, one comma three, two comma nine, two comma nine, and one comma nine; decoding that coordinate string recovers HELLO; and confirming that hello with an exclamation mark fails because the punctuation is out of grid. When mode is omitted, encode is the default so a minimal payload still does useful work. On success the response echoes mode and the original text, returns the transformed result string, length of that result, letters_mapped as a count of alphabetic characters processed, a pairs array with per-token letter row col and token detail for debugging worksheets, plus layout rows and cipher labels for clients that assert the profile they hit. Missing text, non-string objects for text, unsupported mode values, strings longer than the documented maximum, any encode character that is not a Latin letter or space, malformed decode tokens, and coordinates that fall outside the three letter rows all fail with invalid_input and a clear English message naming the out-of-grid input when relevant. Validation failures do not consume prepaid balance. Pricing for successful API calls is the published base of $0.002 per item.
Where keyboard coordinate ciphers show up in real work
Because this capability is a pure parse engine, API pricing is the published base of $0.002 per successful item and failed validation does not consume balance.
Integration use cases
Lightweight spoiler obfuscation
Store quiz answers or labels as keyboard coordinates and decode them later with the same contract in browser or API.