How the Nihilist cipher works

The idea in one sentence

Take the Polybius square, write every plaintext letter as its coordinate number, and add a repeating key's numbers digit by digit without carry — the ciphertext is a stream of numbers that looks like coordinates but has drifted off the grid.

The recipe

1. Fix the square — plain or keyed. Every letter now has a number from 11 to 55 (I and J share a cell).

2. Convert the key word to its own numbers the same way. With the key RUSSIA the numbers are 42 45 43 43 24 11, and they repeat over the whole message — this is the Additive key.

3. Add each plaintext number to the key number above it, digit by digit, no carry. 44 + 42 gives 86; 15 + 45 gives 60 — the row digits 1 + 4 = 5, the column digits 5 + 5 = 10, and a sum of 10 spills over as its own digit. That spill is why Nihilist numbers can reach 110, and why a sum like 60 means 5|10, not 6|0.

4. The ciphertext is the sums, usually written with spaces: 86 68 58 ….

A worked example

Each row is one plaintext letter: its coordinate number, the key number that absorbed it, and the sum. Watch the key column cycle 42 45 43 43 24 11 — the periodicity the cracker listens for.

Decryption

Subtract the key's digits from each ciphertext number and look the resulting pair up in the square. Because the addition never carried, the subtraction never borrows: each digit of the sum is exactly plaintext digit + key digit.

The tells in the numbers

Every sum still contains the grid: subtract any key number and both digits must land in 1–5, or the guess is wrong. And because the key repeats, sums at the same key position share its bias — the stream ripples with a period, exactly what the Cryptoanalysis tab measures.

Nihilist cipher: guides

Guide 1 — your first addition table

1. Open the tool, leave the square key empty, type the key RUSSIA and encrypt ATTACK AT DAWN. The output is a stream of numbers.

2. Look at the addition table under the text: each cell shows one letter's plain + key = sum. Follow the key column — it repeats every six letters, RUSSIA's length.

3. Switch to decrypt mode and paste the numbers back. Subtraction undoes the addition digit by digit; no borrowing, ever.

Guide 2 — the keyed square

1. Add a square key, say MOSCOW, and encrypt the same message. The sums change because the coordinates underneath changed — the additive key works on whatever square it is given.

2. Clear the square key again and compare: the same key word produces different numbers over a different square. Two independent keys, one cipher.

Guide 3 — seeing the period by eye

1. Encrypt a longer message with the key REVOLUTION (10 letters) and write the numbers in rows of 10, one key position per column.

2. Scan each column: its values cluster in a narrow band — the bias of one fixed key number. Columns of a wrong width scatter.

3. That clustering is the whole secret: the band of each column pins the key number almost by eye, which is what the cracker's green and red feedback makes explicit.

Guide 4 — the 10s

1. Encrypt ZZZZZ with the key ZZZZZ: every sum is 110, the largest possible — 5 + 5 in both digits.

2. Now decrypt a stream containing 30 or 100: those mean a column sum of 10 (2|10, 9|10), not a zero column. The overflowed 10 is the Nihilist quirk that trips every casual attack.

Breaking the Nihilist cipher

Two keys, two weaknesses. The wizard on the Cryptoanalysis tab walks the attack in four steps; this page explains what each one listens for.

The flaw: the key repeats, and the grid clips

Two facts do all the work. First, the Additive key repeats, so sums at the same key position share its bias — the stream has a Key length to find. Second, every coordinate digit lives in 1–5, so a candidate key number is only plausible if subtracting it from every value in its column leaves both digits in 1–5. One wrong digit and the value falls off the grid.

The wizard, step by step

1. Key length. The tool slices the number stream at each candidate period and measures how strongly each slice clusters (the number stream's version of the Index of coincidence), plus how often short runs of numbers repeat at key intervals. Pick a card — the score is a hint, not an answer.

2. Pin each key number. One column at a time: you try key numbers (two digits, each 1–5) and every value in the column votes — green when the subtraction stays inside the square, red when it does not. On easy, numbers that cannot fit any value are greyed out before you try; on hard you see only the red and green after each try. No column is ever filled for you.

3. Rebuild the square. With the key pinned, subtract it and the stream collapses back to plain Polybius coordinates — 11 to 55. That is a straight Substitution, so the shared assignment board takes over: assign letters by frequency, watch the partial plaintext, undo anything. The square fills in beside the board as you go.

4. Done. The recovered square (and the keyword it spells, if it is a keyed one) plus the additive key travel to the Tool tab with "use this result".

Why the two-stage attack works

Neither stage alone is decisive, but each shrinks the other's search: the range constraint turns 25 possible key numbers per column into a handful, and once the key is gone the cipher is a textbook frequency count. It is the same divide-and-conquer the Vigenère cracker uses — find the period, then attack each slice — with the slices made of numbers instead of letters.