Vigenère cipher encoder and decoder
Encrypts “Attack at dawn” with the keyword LEMON into “Lxfopv ef rnhr” and decrypts it back with the same key. Each letter gets its own Caesar shift from the repeating keyword, case is kept, and spaces and punctuation stay where they were. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Text
- Attack at dawn
- Key
- LEMON
- Calculation mode
- encrypt
- Result
- Lxfopv ef rnhr
- Encoding
- vigenere
- Key letters
- LEMON
- Key length
- 5
This Vigenère cipher tool encrypts or decrypts text with the classic polyalphabetic substitution that uses a repeating keyword to choose a different Caesar shift for each letter. Unlike a single fixed Caesar offset, the key stream walks through the keyword so the same plaintext letter can map to different ciphertext letters depending on position, which is the historical strength of the method for classroom demos and puzzle design. Only alphabetic characters move: each A–Z letter is shifted by the matching key letter with modular arithmetic on a twenty-six letter ring, case is preserved, and spaces, digits, punctuation, and other symbols pass through without consuming a key step. A standard check is Attack at dawn with key LEMON encrypting to a known ciphertext that decrypts back under the same keyword.
What the Vigenère cipher is and what this tool returns
The Vigenère cipher is a polyalphabetic substitution over the twenty-six letter Latin alphabet. You supply a keyword whose letters each define a Caesar shift from zero for A through twenty-five for Z. Plaintext letters are transformed in order: the first letter uses the first key letter, the second uses the next, and when the keyword ends the stream wraps to the beginning again.
Encryption adds the key offset modulo twenty-six; decryption subtracts it with the same modular wrap so the two operations are exact inverses when the same keyword is used. Non-letter characters never change and never advance the key index, which keeps phrase spacing and punctuation readable around the scrambled letters. This page always uses that textbook rule with case preservation and no optional alphabet tables that could drift between locales.
Vigenère in lessons, puzzles and answer checks
Developers and educators meet the Vigenère cipher in capture-the-flag warm-ups, textbook chapters on classical cryptology, and lightweight demos that show why repeating keywords eventually leak structure under Kasiski examination. Frontend teams can scramble sample phrases for screenshots without inventing a custom alphabet, then recover them with decrypt under the same key. Backend services encode short challenge strings for puzzle APIs or teaching sandboxes where students must apply the correct keyword to unlock the next step.
Quality engineers generate deterministic encrypt and decrypt pairs for contract tests so a middleware that claims Vigenère support cannot silently switch to a single Caesar shift. Contest organizers precompute answer keys for modest English phrases without trusting opaque web toys that change spacing rules or force uppercase-only output. Product and education tools use the transform when a learner pastes ciphertext and the UI must show the recovered plaintext under the documented keyword.
Pair it with other classical encoding helpers when you are building a small lab of free, deterministic text tools, and never treat Vigenère as a substitute for modern authenticated encryption.
What you can do with it
CTF and classical cipher practice
Encrypt and decrypt keyword-based polyalphabetic phrases for puzzles, classrooms, and capture-the-flag warm-ups.
History-of-crypto lessons
Demonstrate repeating-key substitution, case-preserving transforms, and why non-letters should not advance the key stream.
FAQ
What does the Vigenère cipher tool cost?
It is free in your browser on this page.
How do I decrypt a Vigenère message?
Send the ciphertext as text, the same keyword as key, and set mode to decrypt (or dec, decode, d). Encryption is the default when mode is omitted.
What happens if the key has no letters?
The keyword must contain at least one A–Z letter; pure digits or symbols are rejected.
Which characters are shifted?
Only alphabetic letters A–Z in either case. Spaces, digits, punctuation, and other symbols pass through and do not advance the key.
Is Vigenère secure for real secrets?
No. It is a classical teaching cipher. Use modern authenticated encryption such as AES-GCM for real confidentiality.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/enc/vigenere \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Attack at dawn","key":"LEMON"}'const res = await fetch("https://api.kit.forhosting.com/enc/vigenere", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Attack at dawn",
"key": "LEMON"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/enc/vigenere",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Attack at dawn",
"key": "LEMON"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/enc/vigenere", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Attack at dawn","key":"LEMON"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Attack at dawn","key":"LEMON"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/enc/vigenere", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Attack at dawn",
"key": "LEMON"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "enc.vigenere",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Use it free in the browser for CTF warm-ups, history-of-crypto lessons, and reversible puzzle worksheets, or call the API at $0.002 per successful request when pipelines need reproducible Vigenère transforms in CI and backend services.
What the Vigenère cipher is and what this tool returns
The JSON response includes result for the transformed string, encoding fixed to vigenere, mode set to encrypt or decrypt, key_letters showing the normalized uppercase letter stream extracted from your keyword, key_length, input_length and output_length which match because the transform is length-preserving, shifted_chars counting how many letters actually moved, and a formula string that restates the modular mapping for documentation and tests. There is no streaming path and no silent fallback to ROT13 or a fixed Caesar: either you supply non-empty text and a keyword with at least one letter, or the request fails with invalid_input. If you need AES, ROT47, Base64, or Morse, use those dedicated endpoints; this landing answers only the classical Vigenère keyword contract that crypto history chapters and CTF warm-ups already describe.
How text, key, and mode are read and how results stay reproducible
The preferred payload fields are text for the message, key for the keyword, and optional mode for encrypt or decrypt. Text accepts aliases such as input, value, s, message, plaintext, and ciphertext so forms and SDK clients can reuse existing column names. Key accepts keyword, k, password, and passphrase; only alphabetic characters inside the key are kept and uppercased into key_letters, while digits and symbols in the key are ignored. If after that filter no letter remains, the engine rejects the request with invalid_input and a clear message that the keyword must contain at least one A–Z letter. Mode defaults to encrypt when omitted and also accepts short aliases such as enc, encode, e for encrypt and dec, decode, d for decrypt; any other string fails validation. Missing text, empty text, non-string types, and unknown modes all raise invalid_input so a blank form does not look like a successful no-op. Every letter is processed with the fixed modular map and the key index advances only on letters, so encrypting then decrypting with the same keyword always restores the original payload. Pair the free browser run on this page with the priced API when you need the identical mathematical result inside an automated pipeline without re-implementing the polyalphabetic stream yourself. Invalid inputs return invalid_input and are not charged, which keeps validation cheap while successful transforms remain a fixed item price.
Where Vigenère fits in lessons, puzzles, and test fixtures
On this page the work runs entirely in your browser; through the API each successful lookup costs $0.002, failed validation is not charged, and nothing is stored after the response returns. That split — free interactive exploration and a priced, identical API — matches the rest of the KIT tier-A catalog and lets you move from a classroom demo to an automated pipeline without changing the transformed result.
Integration use cases
Deterministic CI fixtures
Generate reproducible Vigenère ciphertext and plaintext pairs for unit tests, golden files, and contract checks.