ABC Tools

Substitution, Atbash and Affine Ciphers, Explained

After reading this you will be able to encrypt and decrypt with any monoalphabetic substitution, build valid Atbash and Affine keys by hand, and explain exactly why every one of these ciphers falls to a page of frequency analysis.

What a monoalphabetic substitution is

A monoalphabetic substitution replaces each plaintext letter with one fixed ciphertext letter, and it uses the same replacement everywhere in the message. The key is a permutation of the alphabet: a one-to-one rearrangement of the 26 letters, so that decryption is just the reverse lookup.

Here is the hook. Take the key that maps the plain alphabet ABCDEFGHIJKLMNOPQRSTUVWXYZ to the cipher alphabet QWERTYUIOPASDFGHJKLZXCVBNM (the top two rows of a QWERTY keyboard). Encrypting HELLO gives OTSSG: H maps to O, E to T, both L to S, and O to G. Notice that the two Ls became two Ss. That repetition is the whole weakness of the scheme, and the rest of this article explains why.

Atbash and Affine are not different families. They are two specific, compact recipes for choosing the permutation.

Atbash: the self-inverse mirror

Atbash reverses the alphabet. A becomes Z, B becomes Y, and in general the letter at position i (counting from 0) maps to position 25 - i.

E(x) = 25 - x \pmod{26}

Here x is the letter index (A = 0, Z = 25). Because 25 - (25 - x) = x, applying Atbash twice returns the original letter. The cipher is its own inverse, so encryption and decryption are the same operation. There is no key to choose and no key to guess, which means Atbash offers no secrecy at all. It is a fixed relabeling, useful only as a puzzle or an obfuscation.

Worked check: HELLO has indices 7 4 11 11 14. Applying 25 - x gives 18 21 14 14 11, which is SVOOL. Run Atbash on SVOOL and you get HELLO back.

The Affine cipher and its formula

The Affine cipher builds the permutation with arithmetic. Each letter index x is multiplied by a constant a, shifted by a constant b, and reduced modulo 26.

E(x) = (a \cdot x + b) \bmod 26

The symbols are: x the plaintext letter index in 0..25, a the multiplier, b the additive shift, and the result the ciphertext index. Setting a = 1 reduces the Affine cipher to a plain Caesar shift by b. Setting a = 25 and b = 25 reproduces Atbash, since 25x + 25 \equiv -x - 1 \equiv 25 - x. So both other modes are special cases of Affine.

Decryption inverts the multiply-and-shift:

D(y) = a^{-1} (y - b) \bmod 26

Here a^{-1} is the modular inverse of a, the number that satisfies a \cdot a^{-1} \equiv 1 \pmod{26}.

The multiplier a must be coprime with 26, meaning \gcd(a, 26) = 1. Only then does a modular inverse exist and the mapping stay one-to-one. The 12 valid values are 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25. If you pick a = 2, then both x = 0 and x = 13 map to the same ciphertext letter, and decryption becomes impossible.

Why coprimality is not optional

Multiplication modulo 26 is a permutation only when the multiplier shares no factor with 26. The number 26 factors as 2 \times 13, so any even a or a = 13 collapses the alphabet.

Try a = 4. The products 4x \bmod 26 for x = 0..25 only ever land on even residues, and each even residue appears twice. For example 4 \cdot 0 = 0 and 4 \cdot 13 = 52 \equiv 0. Two different letters share one ciphertext, so no inverse function exists. That is why the tool validates a before it will encrypt.

Counting the valid multipliers gives the key space. There are 12 allowed values of a and 26 values of b, so 12 \times 26 = 312 Affine keys. One of those (a = 1, b = 0) is the identity that leaves text unchanged, leaving 311 useful keys. A general substitution has 26! \approx 4.03 \times 10^{26} keys, so Affine is a tiny corner of the substitution space.

Worked Affine encryption with the demo defaults

The demo uses a = 5, b = 8, and the plaintext AFFINE.

  1. Convert letters to indices: A F F I N E becomes 0 5 5 8 13 4.
  2. Apply 5x + 8 to each: 8, 33, 33, 48, 73, 28.
  3. Reduce modulo 26: 8, 7, 7, 22, 21, 2.
  4. Convert back to letters: I H H W V C.

So AFFINE encrypts to IHHWVC. To decrypt, you need 5^{-1} \bmod 26. Testing shows 5 \times 21 = 105 = 4 \times 26 + 1, so 5^{-1} = 21. Decrypting the first letter: 21 \times (8 - 8) = 0, which is A. The second: 21 \times (7 - 8) = 21 \times (-1) \equiv 21 \times 25 = 525 \equiv 5 \pmod{26}, which is F. The round trip holds.

Reading the substitution mapping

Whatever mode you choose, the tool shows the full 26-letter mapping. Read it as two aligned rows: the plain alphabet on top and the cipher alphabet below. For the demo Affine key the rows are:

Affine mapping for a = 5, b = 8, first eight letters
PlainABCDE
Index x01234
5x + 8 mod 2681318232
CipherINSXC

Two checks tell you the key is valid. First, the cipher row must contain all 26 letters with no repeats: that is what "permutation" means. Second, for Affine the spacing between consecutive cipher letters is constant. Each step of x adds a (here 5) modulo 26, so the cipher row climbs I, N, S, X, C, ... in jumps of 5. A plain custom key has no such regularity.

When to use these ciphers, and when not

Use substitution ciphers for teaching, puzzles, escape rooms and light obfuscation where the reader is not an adversary. They are excellent for building intuition about permutations, modular arithmetic and frequency analysis.

Do not use them to protect anything. All monoalphabetic ciphers preserve the frequency profile of the language, because a given plaintext letter always maps to the same ciphertext letter. In English, E appears about 12.7% of the time, T about 9.1%, and Z about 0.07%. Those percentages survive encryption unchanged, just relabeled. Count letters in the ciphertext, match the tallest bar to E, the next to T, and the message unravels.

The relative heights are what an attacker recovers from ciphertext. A substitution only renames the bars, it does not reshape them.

How much text does an attack need? A few hundred letters is usually enough for a person, and a few dozen for a computer using digraph statistics. That is why even a scrambled 26-letter key with 4 \times 10^{26} possibilities is broken in seconds: the attacker never brute-forces the key, they read the frequencies.

With the demo key a = 5, b = 8, the letters A through E map to I, N, S, X, C. Change a and every cipher letter moves in steps of the new a; change b and the whole cipher row shifts left or right as a block.

Common mistakes

Choosing an invalid Affine multiplier
Picking an even a or a = 13 gives a mapping you cannot decrypt. Stick to the 12 coprime values.
Confusing the two shift directions
Decryption is a^{-1}(y - b), not a^{-1} y - b. Subtract b first, then multiply by the inverse.
Assuming a longer key means more security
A full 26-letter key looks strong but leaks the same frequencies as Atbash. Complexity of the key does not defeat frequency analysis.
Forgetting that spaces and punctuation give away word boundaries
These ciphers only transform letters. A one-letter word in the ciphertext is almost always A or I, which hands the attacker two mappings for free.

Related tools on this site

If you set a = 1, the Affine cipher becomes a pure shift, which is exactly the Caesar cipher, and that tool includes an automatic brute-forcer over all 26 shifts. To defeat frequency analysis you need a polyalphabetic scheme, where one plaintext letter can map to several ciphertext letters: see the Vigenère cipher. For a non-alphabetic encoding that changes the shape of the text entirely, the Morse code translator converts letters to dots and dashes with audio playback.

Frequently asked questions

How is Atbash different from a Caesar shift?

Atbash reverses the alphabet with 25 - x, while Caesar rotates it with x + b. Atbash is self-inverse and fixed; Caesar has 25 possible non-trivial keys. Both are special cases of the Affine cipher.

Why are there only 12 valid Affine multipliers?

Because 26 factors as 2 \times 13, a multiplier works only if it shares no factor with 26. Euler's totient of 26 is 12, so exactly 12 of the values 1 through 25 are coprime with it.

Can frequency analysis break Affine as easily as a random key?

Yes, and often faster. With only 312 keys, a computer can try every one and score each candidate against English letter frequencies in well under a second. A random 26-letter key needs statistical hill-climbing instead of brute force, but still falls quickly.

What is the modular inverse and how do I find it?

The modular inverse of a is the number a^{-1} with a \cdot a^{-1} \equiv 1 \pmod{26}. For small moduli you can test each candidate: for a = 5, try 5 \times 21 = 105 \equiv 1, so the inverse is 21.

Are these ciphers ever safe for real messages?

No. Treat them as educational and recreational. Any message longer than a sentence or two is readable by an analyst, and short messages leak through word patterns. Use modern authenticated encryption for anything that matters.

Try it yourself in the tool

Related tools

Enigma Machine Simulator

Operate a full Enigma I — rotors, plugboard, lamp board — and watch each letter travel the wiring.

Caesar Cipher & ROT

Shift-cipher encode/decode with an automatic brute-forcer.

Vigenère Cipher

Keyword polyalphabetic cipher, encode and decode.

Morse Code Translator

Text to Morse and back, with audio playback.

AES Encryption

Encrypt and decrypt text with AES-GCM or AES-CBC.

Cryptographic Key Generator

Random keys, IVs, salts and API tokens from a CSPRNG.