How the autokey cipher works

The idea in one sentence

The autokey cipher is what the "Vigenère cipher" really was in 1586: a {{term:Vigenère}}-style cipher whose Key grows out of the message itself. It starts with a short primer — say QUEEN — and after those five letters the keystream continues with the plaintext you have already written. The key feeds on itself; that is the auto in autokey.

The recipe

1. Write your message and keep only the letters.

2. Choose a primer — a short key word, typically much shorter than the message.

3. Build the Keystream: the primer first, then your own plaintext appended after it.

4. Add as in Vigenère: each plaintext letter plus the keystream letter above it (wrapping around the Alphabet) gives the Ciphertext.

A worked example

Watch the keystream column: QUEENLY runs out after six letters, and from then on every key letter is simply the message's own letter from one primer-length earlier. The tool shows this live: the keystream row under the input grows with your text, the primer part highlighted.

The formula

Numbering A=0 … Z=25, with the keystream K built from the primer and the plaintext itself:

cipher = (plain + key) mod 26
key[i] = primer[i]                  for i < primer length
key[i] = plain[i − primer length]   after that

Decryption walks the same keystream: recover the plaintext letter by letter, and each recovered letter becomes key material one primer-length later. That is why the primer is the whole secret — everything else regenerates itself.

What it buys — and what it costs

Because the keystream never repeats a fixed period, the periodic fingerprints of Vigenère (repeated sequences, slice-wise Index of coincidence gains) disappear. The cipher resists the classic 19th-century attack.

The cost is fragility. Any error in the ciphertext propagates through every later key letter, and the whole scheme leans on one short secret: if an attacker guesses plaintext ("Crib dragging"), the guessed letters are key material and unravel the rest of the message — that is exactly what the tool's guided cracker does with you.

Step-by-step guides

Encrypt your first message

1. Type your message into the message input.

2. Pick a short primer and enter it in the Key field — four to six letters is typical.

3. Check the mode: the swap button the swap button toggles between encrypt and decrypt. The header shows the current mode.

4. Read the encrypted result in the output field. Only letters are encrypted; spaces and punctuation are dropped.

5. Look at the keystream row under the controls: the highlighted letters are your Primer, and every letter after them is your own message coming back as key.

Decrypt a message you received

1. Paste the cryptogram into the message input.

2. Enter the primer the sender used in the Key field — you need the exact same primer that encrypted the message.

3. Press the swap button the swap button to switch to decrypt mode.

4. Read the original message in the output field. The keystream row regrows itself from the recovered plaintext.

Break a message without the key

1. Open the Cryptoanalysis tab. The guided cracker works by Crib dragging — guessing a word and letting the cipher's own key trick unravel the message.

2. Step 1 — guess a word that likely appears in the plaintext (type it into the crib input; the challenge hints suggest one) and set the primer length in Set the assumed primer length.. A crib at least as long as the primer reveals everything; a shorter one leaves a few letters for you.

3. Step 2 — drag the word along the text in The crib dragged along the ciphertext; click a position to place it.. At each position the cipher implies a key fragment — in autokey that fragment is earlier plaintext, so the readable positions are the right ones.

4. Step 3 — the placement unrolls: the plaintext chains propagate in both directions in The plaintext unrolled from the crib placement., and the primer appears at the start. Type any remaining letters in Type the primer letters the crib could not reach..

5. Step 4 — check the assembled primer, then press the "Use this key" button. The tool decrypts the message with it.

Breaking the autokey cipher

The autokey cipher has no repeating Key to find — so the Vigenère attack finds nothing. But it has a weaker seam: the key is plaintext. This page explains the Crib-dragging attack; every step has a matching step in the tool's guided cracker, so you can follow along while reading.

Why the classic attack fails

Periodicity is gone. With the keystream being primer-then-plaintext, two identical plaintext letters almost never encrypt the same way twice, so repeated sequences dry up and slice-wise frequency analysis has no slices to stand on. Kasiski's examination and the Index of coincidence both come up empty.

The seam: the key is the message

Every keystream letter (after the primer) is a plaintext letter from one primer-length earlier. That means a guessed plaintext word does double duty:

1. Drag the word. Place your guess at each position of the Ciphertext. At position p, the guess implies key letters K = C − guess — and in autokey those key letters are plaintext from one primer-length earlier. A wrong placement produces alphabet soup; the right one produces readable English.

2. Unroll. Once the placement is right, the known plaintext letters propagate on their own: a recovered letter at position p becomes the key at p + L (revealing the plaintext there), and the letter at p − L is revealed the same way backwards. A few passes and the chains cover everything the crib's position classes touch.

3. Read the primer. The keystream's first L letters are the primer: K(i) = C(i) − P(i) for each of them. Where the crib never reached, the primer letters stay blank — the last step of the wizard is you typing those by hand, from what looks like English.

Nothing here needs statistics. It is one guessed word, one subtraction rule, and the cipher doing the rest of the demolition itself.

The limits

• The guess is the whole game. If the plaintext does not contain a word you can guess, the attack stalls — no ranking machinery can rescue a wrong crib.

• Short primers are fragile. A primer of 1–3 letters is nearly a Caesar cipher with extra steps; the unrolled chains cover almost everything at once.

• Long primers behave like a one-time pad. A primer as long as the message never reuses anything — unbreakable, as with any key used once. The autokey's weakness only exists because the primer is short.