Pigpen cipher
In Pigpen, H is the bottom cell of the plain grid and E its centre, while L and O sit in the dotted grid. Encode words into those grid and X shapes, written as readable labels, or turn labels back into letters. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- HELLO
- Calculation mode
- encode
- Result
- grid_b grid_c grid_tr_dot grid_tr_dot grid_r_dot
- Encoding
- pigpen
- Input length
- 5
- Output length
- 48
This Pigpen cipher tool encodes plain Latin letters into the classical Masonic freemason symbol table rendered as portable descriptive tokens, or decodes a token stream back into uppercase text. Each letter from A through Z has one fixed shape drawn from two tic-tac-toe grids and two sets of X-arm marks, with a dotted variant for the second half of each family, so the transform is a reversible open table rather than a secret key.
Where Pigpen fits in lessons and treasure hunts
Developers and educators meet the Pigpen cipher in capture-the-flag warm-ups, museum scavenger hunts, freemason history modules, and lightweight demos that show how a geometric monoalphabet can still carry full Latin text without a keyword. Backend services precompute challenge strings for puzzle APIs or teaching sandboxes where students must reassemble complete token sequences to unlock the next step. Quality engineers generate deterministic encode and decode pairs for contract tests so a middleware that claims Pigpen support cannot silently switch to Polybius digits or drop unknown marks.
Contest organizers precompute answer keys for modest English phrases without trusting opaque web toys that draw glyphs inconsistently or pad missing symbols. Product and education tools use the transform when a learner pastes a freemason-style token string and the UI must show the recovered letters under the documented grid and X table. Pair it with other classical encoding helpers when you are building a small lab of free, deterministic text tools, and never treat Pigpen as a substitute for modern authenticated encryption when real secrets are at stake.
What you can do with it
Classroom freemason cipher demos
Encode and decode sample words on the fixed grid-and-X Pigpen table so intro-crypto and history lessons share one ground-truth token mapping.
Puzzle hunts and CTF warm-ups
Encode challenge phrases as descriptive Pigpen tokens or reverse a token stream without writing a one-off script for every problem set.
FAQ
What is the Pigpen cipher?
A classical monoalphabetic cipher that maps each Latin letter to a geometric mark from two 3×3 grids and two X figures (with dotted variants). This tool uses portable descriptive tokens for those marks.
Why tokens instead of drawn symbols?
The mapping matches the classical freemason grid and X layout for A–Z.
Are spaces and punctuation encoded?
No. On encode, non-letters are skipped. On decode, only whitespace-separated tokens are read; any unknown token fails rather than being ignored.
What does it cost?
The browser tool is free and runs locally.
How is the Pigpen alphabet laid out?
A to I fill a plain three-by-three grid and J to R a second grid with a dot in each cell. S to V sit on the arms of a plain X, and W to Z on a dotted X, so each letter has one fixed shape.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/pigpen \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"HELLO"}'const res = await fetch("https://api.kit.forhosting.com/enc/pigpen", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "HELLO"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/pigpen",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "HELLO"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/pigpen", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"HELLO"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"HELLO"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/pigpen", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "HELLO"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.pigpen",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Encode mode walks the input, keeps alphabetic characters, and emits space-separated tokens such as grid_b for H and grid_c for E; decode mode accepts those tokens in any common letter case, ignores extra whitespace, and rebuilds the message only when every token is known. An unknown symbol, an empty payload, or a string with no letters to encode fails with invalid_input and names the problem instead of guessing. Use it free in the browser for history-of-crypto lessons, scavenger-hunt worksheets, and freemason-symbol demos, or call the API at $0.002 per successful request when pipelines need reproducible Pigpen transforms.
What the Pigpen cipher is and how tokens represent the symbols
The Pigpen cipher, also called the Masonic cipher or freemason cipher, is a classical monoalphabetic substitution that replaces each Latin letter with a geometric mark taken from a pair of three-by-three grids and a pair of X-shaped figures. In the textbook freemason layout used here, the first grid holds A through I without dots, the second grid holds J through R with a central dot in each cell, the first X figure holds S through V on its four diagonal arms without dots, and the dotted X holds W through Z. Historically those marks were drawn by hand as incomplete box walls or angled strokes; this product cannot assume a shared Unicode glyph set, so every mark is rendered as a stable descriptive token such as grid_tl for the top-left plain cell, grid_c_dot for the center dotted cell, x_ne for the north-east plain X arm, and x_sw_dot for the south-west dotted arm. That fixed twenty-six entry mapping is exactly what this endpoint applies: there is no keyword stream, no modular shift, and no optional alphabet file that could drift between locales. The JSON response always includes result for the transformed string, encoding fixed to pigpen, mode set to encode or decode, input_length and output_length for the raw strings you sent and received, letter_count and token_count for how many A–Z letters or symbols were produced or consumed, plus alphabet and formula strings that restate the grid and X rule for documentation and automated checks. There is no streaming path and no silent fallback to Polybius digits, Bacon a/b groups, or a Caesar shift: either the payload is valid for the chosen mode, or the request fails with invalid_input. If you need digit-pair squares, biliteral codes, or modern authenticated encryption, use those dedicated endpoints; this landing answers only the classical Pigpen grid-and-X contract that puzzle books and freemason history chapters already describe.
How text and mode are read and how unknown symbols are reported
In decode mode the string is split on whitespace into tokens, each token is lowercased, and every token must appear in the twenty-six symbol vocabulary. The preferred payload fields are text for the message or ciphertext and optional mode for encode or decode. Text accepts aliases such as input, value, s, message, plaintext, and ciphertext so forms and SDK clients can reuse existing column names. Mode defaults to encode when omitted and also accepts short aliases such as enc, encrypt, e for encode and dec, decrypt, d for decode; any other string fails validation. In encode mode only alphabetic letters are kept and mapped, case is ignored on the way in, and the result is lowercase tokens separated by single spaces; if no letter remains after filtering, the engine rejects the request with invalid_input so a digit-only string does not look like a successful empty cipher. When one or more tokens are not recognized, the request fails with invalid_input and the message explicitly lists the unknown Pigpen symbol or symbols rather than dropping them or inventing a letter. That report is the product requirement behind “reports unknown symbols”: solvers and graders learn which mark was wrong instead of receiving a silently truncated plaintext. Missing text, empty text, non-string types, strings longer than the documented maximum, and unknown modes likewise raise invalid_input. Pair the free browser run on this page with the priced API when you need the identical mathematical result inside an automated pipeline. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price of $0.002.
Where Pigpen fits in lessons, hunts, and test fixtures
Frontend teams can show encode and decode side by side so learners see that grid_b grid_c grid_l grid_l grid_r is exactly HELLO without inventing a custom table. On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split — free interactive exploration and a priced, identical API — matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the transformed result.
Integration use cases
Deterministic contract and golden tests
Generate stable encode and decode pairs for pipelines that must reject unknown symbols instead of silently truncating ciphertext.
Technical questions
How do I decode Pigpen tokens?
Set mode to decode and paste space-separated tokens such as grid_tl or x_ne_dot. Every token must be known; unknown symbols raise invalid_input and are listed in the error message.