How the Keyword substitution cipher works

The idea in one sentence

Keyword substitution is a Substitution whose Cipher alphabet is spelled out for you: write the Keyword first, then continue with the letters the keyword missed — the alphabet remembers the keyword in its very shape.

The recipe

1. Choose a keyword, say KRYPTOS. Write its letters in order, dropping every repeat: K R Y P T O S.

2. Underneath the plain alphabet, continue with the remaining letters in their normal order: A B C D E F G H I J L M N Q U V W X Z.

3. The two rows together are the cipher alphabet: KRYPTOSABCDEFGHIJLMNQUVWXZ.

4. Encrypt each plaintext letter by the cipher letter standing under it: A becomes K, B becomes R, C becomes Y. Decryption runs the rows the other way round.

A worked example

The middle column shows where each cipher letter comes from: K marks letters that belong to the keyword, · marks the plain remainder that follows. That split is the whole trick — and the whole weakness.

The continuation variant

Some keyword alphabets do not restart at A after the keyword; they keep counting from the keyword's last letter. With KRYPTOS that gives KRYPTOSUVWXZABCDEFGHIJLMNQ — after S comes U (T is already used), then V, W, X, Z, then the wrap-around A, B, C… The tool offers both modes with the "Continue after the keyword" checkbox.

Free alphabets

Any arrangement of the 26 letters works as a cipher alphabet — the keyword is just the memorable way to write one down. The tool's "Free alphabet" mode accepts any permutation, which is exactly what the cryptoanalysis wizard produces: a recovered alphabet need not come from any keyword at all.

Keyword substitution: guides

Guide 1 — your first keyword cipher

1. Open the tool and type the keyword SHADOW. Watch the alphabet strip: the bottom row starts S H A D O W, then continues B C E F G… — the keyword letters first, everything else in order.

2. Type MEET ME AT NOON. Notice how every E encrypts to the same letter — that sameness is what later breaks the cipher.

3. Turn on "Keep spaces" and encrypt again. The word lengths now travel with the message — convenient for the reader, and a gift for the codebreaker.

Guide 2 — the two alphabets

1. Encrypt the same message with KRYPTOS, once with "Continue after the keyword" off and once on. Compare the strips: the first half is identical, the second half rotates.

2. Both alphabets are legitimate keyword alphabets — which is why a codebreaker who recovers an alphabet still has to check whether it spells a keyword at all.

3. Switch to decrypt mode and paste your own cryptogram. Encryption and decryption use the same two rows in opposite directions.

Guide 3 — from keyword to free alphabet

1. Tick "Free alphabet" and type any 26 letters in a scrambled order — the tool validates that every letter appears exactly once.

2. Encrypt a message and study the strip: nothing marks the alphabet as keyword-built, because it no longer is.

3. This is the honest picture of every substitution cipher: one fixed, arbitrary mapping. The keyword alphabet is a special, well-behaved case of it — and special cases leak their specialness.

Breaking the Keyword cipher

A keyword alphabet feels personal and memorisable — and it is still a monoalphabetic Substitution, so the classic statistics apply unchanged. The wizard on the Cryptoanalysis tab walks the attack; this page explains what each step does and why it works.

The flaw: one fixed mapping

Whatever the alphabet's shape — keyword, continued keyword or free permutation — every plaintext letter encrypts to the same cipher letter for a whole message. That is the invariant Frequency analysis feeds on: counts of cipher letters are counts of plain letters in disguise.

The wizard, step by step

1. Count the letters. The board sorts the cipher symbols by how often they appear and draws each count as a bar. Compare the shape with English — E, T, A, O lead — and check that the text is long enough to be trustworthy (the tool warns below 100 letters).

2. Assign the obvious ones. Click the most frequent cell and pick the letter you think it stands for; the suggestion under a cell is only a hint. After every click the partial plaintext updates, so a wrong guess shows immediately — undo it and try the runner-up.

3. Find the words. With a few letters placed, whole words light up. The panel lists cipher words whose shape matches a common English word (Pattern word matching — THE has the shape ABC, THAT ABCA) and only shows candidates consistent with your assignments. Clicking a candidate places the whole word in one click. Doubled letters and one-letter words (only A and I in English) are clues too.

4. Fill the gaps. Rare symbols are last: use the partial text as your guide, assigning until every cell is taken.

5. Done. The recovered alphabet appears; if it is keyword-shaped, the wizard names the keyword it hides. "Use this key" carries the alphabet to the Tool tab, which decrypts the rest.

The tool never assigns a letter on its own. Every click is yours, and every click can be taken back — that is deliberate: breaking it yourself is the lesson.

What the keyword adds — and what it does not

A keyword shrinks the alphabet choices a designer must memorise, not the choices an attacker must consider. Frequency analysis does not care how the permutation was written down. The keyword only matters after the fact: a recovered alphabet may reveal the password-like word it was built from, which is satisfying — and a warning about choosing keys your ciphertext can confess.