Playfair cipher
With the keyword MONARCHY, INSTRUMENTS encrypts to GATLMZCLRQXA: the letters are split into pairs, an X fills the odd end, and each pair is swapped inside a five-by-five keyword square. Decrypt with the same keyword to get the letters back. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- INSTRUMENTS
- Key
- MONARCHY
- Calculation mode
- Encrypt
- Result
- GATLMZCLRQXA
- Input
- INSTRUMENTS
- Key used
- MONARCHY
- Normalized
- INSTRUMENTS
The Playfair cipher is a classical digraph substitution system invented for field use long before modern cryptography: instead of mapping one letter at a time, it works on pairs of letters drawn from a five-by-five square that you build from a secret keyword. Enter any non-empty keyword, the text you want to protect or recover, and a mode of encrypt or decrypt; the tool normalizes letters, merges J into I to fit the twenty-five-cell grid, inserts the traditional X filler between repeated letters and at the end of odd-length messages, then applies the three Playfair rules—shift within a row, shift within a column, or take the other two corners of the rectangle those two letters form.
How the keyword square and digraph rules work
Playfair begins by turning your keyword into a five-by-five matrix over the Latin alphabet with I and J sharing one cell, which leaves twenty-five distinct symbols. Letters from the keyword are written left to right, top to bottom, skipping duplicates and treating every J as I; the remaining unused letters of the alphabet fill the rest of the grid in order.
Plaintext is reduced to uppercase letters only, then packed into digraphs: if a would-be pair contains the same letter twice, an X is inserted after the first occurrence so the pair is broken, and if the final stream has odd length a trailing X is appended.
Encryption walks each pair: when both letters sit on the same row, each moves one cell to the right with wrap-around; when both sit in the same column, each moves one cell down with wrap-around; otherwise the two letters define a rectangle and each is replaced by the letter at the same row but the other letter's column. Decryption reverses the row and column shifts—one cell left or up—while the rectangle rule is its own inverse.
Practical tips, limits, and related searches
Choose a keyword with several distinct letters so the square is not nearly alphabetical; short memorable words still work for demos, but long phrases with unique letters shuffle the matrix more. Remember that spaces, punctuation, and digits are stripped before encryption, so phone numbers or mixed labels lose their separators in the letter stream—pre-segment or encode those separately if you need them later. For decryption, feed the letter-only ciphertext (even length after normalization); if you still have spaces from a printed worksheet, the solver ignores them.
Round-trip checks are the best sanity test: encrypt a phrase, decrypt the result with the same key, and compare against the normalized plaintext with fillers. Prefer this capability when you need transparent classical digraph cryptography for education or puzzles; if you need real secrecy, use a modern authenticated cipher instead.
What you can do with it
CTF and puzzle write-ups
Challenge authors verify Playfair encrypt and decrypt steps for a published keyword without maintaining a separate offline script.
Historical crypto demos
Museums and blog demos show how digraph ciphers differ from monoalphabetic substitution by live-encrypting visitor phrases with a shared keyword.
FAQ
What is the Playfair cipher?
A classical digraph cipher: letters are encrypted in pairs using a 5×5 square built from a keyword. Rules cover same-row, same-column, and rectangle cases.
Why are I and J the same?
A 5×5 grid has twenty-five cells for twenty-six letters. Classical Playfair merges I and J into one cell so every Latin letter still maps.
What happens if the key is empty?
A keyword with at least one A–Z letter is required to build the square.
How do double letters and odd length work?
On encrypt, an X is inserted between two identical letters that would form a pair, and a trailing X pads an odd-length letter stream so every unit is a digraph.
Is the Playfair cipher free?
The browser tool is free and runs locally.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/playfair \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"HIDE THE GOLD","key":"MONARCHY"}'const res = await fetch("https://api.kit.forhosting.com/enc/playfair", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "HIDE THE GOLD",
"key": "MONARCHY"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/playfair",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "HIDE THE GOLD",
"key": "MONARCHY"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/playfair", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"HIDE THE GOLD","key":"MONARCHY"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"HIDE THE GOLD","key":"MONARCHY"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/playfair", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "HIDE THE GOLD",
"key": "MONARCHY"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.playfair",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_chars | 100000 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Empty keywords are rejected with a clear invalid_input error so a blank form field never silently produces a meaningless identity transform.
How to call the API and what comes back
Text must likewise yield at least one letter after non-letters are stripped. Send a JSON body with two required string fields, text and key, plus an optional mode that defaults to encrypt when omitted. Accepted aliases for text include input, value, data, message, plaintext, and ciphertext; key also accepts keyword, passphrase, secret, and k; mode accepts operation, op, direction, and action, and recognizes common synonyms such as encode or decode. The key must be non-empty and must contain at least one A–Z letter after normalization; a blank string or a key made only of digits and punctuation is invalid_input and is never charged. On success the response echoes the original text and key, reports key_used as the distinct keyword letters in square order, mode as encrypt or decrypt, normalized as the letter-only stream, digraphs as the array of two-letter units actually processed, result and text as the ciphertext or recovered letters, square as the five rows of five letters, pairs as the digraph count, length as the output character count, formula as a short rule mnemonic, and message as a one-line English summary. Pricing is a flat $0.002 per successful request with unit item and zero marginal unit price.
Practical tips, limits, and related searches
Keep payloads under the published maximum of one hundred thousand characters so Worker memory stays bounded. When teaching, pair examples: a classic keyword such as MONARCHY with a short phrase shows rectangle and row moves; a double-letter word demonstrates the X filler; and an empty key demonstrates the hard invalid_input path. This landing targets people searching for a Playfair cipher, digraph encryptor, or keyword square tool online; it is not AES, not a modern password vault, not ROT13, and not a Polybius tap-code translator. Failed tasks that return invalid_input do not consume prepaid balance, which keeps exploratory scripts cheap when clients probe blank keywords.
Integration use cases
Classroom classical-cipher labs
Students build a keyword square by hand, encrypt a short sentence, then compare digraphs and the final stream against the deterministic API result.