The Hill Cipher Decoder encrypts and decrypts A–Z text with a 2×2 invertible matrix using A=0 through Z=25, two-letter column vectors, X padding for odd plaintext, and the C = K × P mod 26 formula the page documents in full. The default key [3 3; 2 5] turns the four-letter plaintext HELP into the ciphertext HIAT, and that exact pair is the single fixture worth confirming before trusting longer output. Decryption multiplies each ciphertext column by the modular inverse of K, which exists only when gcd(det K, 26) = 1; keys whose determinant shares a factor of 2 or 13 are rejected instead of returning misleading text. Negative and large key entries are normalized into the 0–25 range, spaces, punctuation and digits are stripped before grouping, and ciphertext must arrive with an even number of normalized letters because every block carries exactly two values. Plaintext may be odd length because encryption appends one X, but a real trailing X in the original message cannot be distinguished from padding once it has been normalized, so the original length should be recorded on any controlled exercise rather than inferred from the decrypted text.
Conventions the Decoder Locks In
Every reference describes a Hill cipher slightly differently. The decoder commits to one documented convention and refuses to guess which textbook variant the reader is following. Most wrong-output complaints are convention mismatches rather than arithmetic bugs, so this is the first place to look when a result disagrees with a worksheet or a lecture slide.
| Setting | This page | Some textbooks and tools |
|---|---|---|
| Letter mapping | A=0 through Z=25 | A=1 through Z=26, or 0–25 with shifted boundaries |
| Vector orientation | Column vectors | Row vectors |
| Encryption formula | C = K × P | C = P × K, with matrix laid out differently |
| Block size | Fixed at 2 letters | 2 or 3 letters depending on the key |
| Padding for odd plaintext | One X is appended at the end | No padding, or other letters, or random fill |
| Key entry | Four whole numbers; rows separated by a semicolon | Comma list, brace syntax, or PDF table |
| Decryption | Modular inverse of K, only when gcd(det K, 26) = 1 | Same requirement, but the rejection behaviour varies |
When another source produces a different ciphertext from the same visible numbers, the difference almost always traces back to one of those rows. Re-read the reference's example, identify which rows disagree with the table above, and reproduce that convention manually before assuming the tool is wrong.
The mod 26 Formula and the Default Key
For a 2×2 key K = [[a, b], [c, d]] and a plaintext column P = [x, y] drawn from the pairs of normalized letters, the encryption formula used by the Hill Cipher Decoder is:
C = K × P = [a·x + b·y, c·x + d·y], each entry reduced modulo 26.
Decryption multiplies each ciphertext column by det(K)-1 times the adjugate of K, all reduced modulo 26, after first proving that gcd(det K, 26) = 1. The default key [3 3; 2 5] is the canary pair because the arithmetic is short enough to verify by hand:
- HELP pairs into the columns [H, E] = [7, 4] and [L, P] = [11, 15].
- K × [7, 4] = [3·7 + 3·4, 2·7 + 5·4] = [21 + 12, 14 + 20] = [33, 34].
- 33 mod 26 = 7 (H) and 34 mod 26 = 8 (I), giving the first output pair HI.
- K × [11, 15] = [3·11 + 3·15, 2·11 + 5·15] = [33 + 45, 22 + 75] = [78, 97].
- 78 mod 26 = 0 (A) and 97 mod 26 = 19 (T), giving the second output pair AT.
- Concatenated, HELP encrypts to HIAT under the page's documented convention.
Run the same calculation with row vectors, A=1 mapping, or a different padding rule and the answer will not be HIAT. That single mismatch is usually enough to identify which convention row is wrong.
How to Encrypt or Decrypt a 2×2 Message
These are the operating steps the page expects, in order. Treat them as a checklist so that no input field is left in an inconsistent state.
- Confirm the exercise uses A=0 through Z=25, two-letter column vectors, and X padding. If any of those three facts differ, the result will not match the expected answer even when the arithmetic is correct.
- Enter the two matrix rows as four whole numbers in the key field, separated by a semicolon, for example 3 3; 2 5 to match the default.
- Choose encrypt or decrypt from the mode control so that the page applies the modular inverse rather than the forward multiplication when appropriate.
- Paste or type the A–Z message or ciphertext into the text field. Spaces, punctuation and digits are removed automatically, and grouping happens in the browser.
- Run the conversion, then compare a known pair such as HELP to HIAT under the default key before relying on longer output.
When the Decoder Rejects Your Key
A 2×2 key is acceptable only when its determinant a·d − b·c is coprime with 26, which means gcd(det K, 26) = 1. The factors of 26 are 2 and 13, so any key whose determinant is even or a multiple of 13 has no modular inverse and cannot uniquely decrypt every pair. Instead of producing ambiguous output, the decoder rejects those keys with a clear error. Negative or oversized entries are accepted but normalized into the 0–25 range before the determinant test runs.
Practical implication: if the page rejects a key that a worksheet calls valid, the worksheet is using a convention where the determinant check is different, or the key was entered as row vectors when the page expects column vectors. Re-check the convention rather than the arithmetic. A more thorough walkthrough of the modular-inverse step lives in the How to Decrypt a Hill Cipher: A Worked Example guide.
Verify HELP→HIAT Before Trusting Longer Output
The four-letter HELP example is short enough to recompute by hand and long enough to expose every convention difference at once. That combination is rare in cryptography exercises, and it is the reason the decoder publishes the pair rather than a longer fixture. Use it as a tripwire every time the page is loaded in a new browser, a new device, or after a configuration change.
If the default key [3 3; 2 5] fails to map HELP to HIAT, the cause is almost always one of the following: the alphabet mapping is A=1 through Z=26 instead of A=0 through Z=25, the matrix was entered as column vectors rather than row vectors, the formula was inverted to P × K, or the comparison is being made against ciphertext produced by a different padding rule. None of those are browser arithmetic bugs. Re-derive the expected output by hand using the convention the other source claims to use, then re-run the decoder under the page's documented convention to confirm both calculations are internally consistent.
Hill Cipher Decoder Limits Worth Knowing
Input is capped at 100,000 letters to keep interaction responsive, so very large corpora should be processed in chunks rather than as a single paste. Ciphertext must contain an even number of normalized letters because every block holds exactly two values; odd-length ciphertext is rejected rather than silently padded. Plaintext can be odd length because encryption appends one X, and the page deliberately leaves a decrypted trailing X in place so that a real final X in the original message is not destroyed. Case, punctuation, accents and digits are not preserved; only normalized uppercase A–Z letters appear in the output, and any spacing the exercise expects must be tracked separately. The tool is a 2×2 implementation only, so 3×3 keys from a textbook exercise will not run on this page.
The Hill cipher was historically important because it applied linear algebra to polygraphic substitution, but it is not secure for modern confidentiality. Known plaintext reveals linear relationships, the alphabet and block size are small, and the key is entered directly on the page. Never use it for passwords, tokens, personal information, files or production messages. For real security, use a reviewed authenticated-encryption scheme such as AES-GCM, and reach for the Hill Cipher Decoder only when an exercise explicitly asks for this historical cipher.
For a deeper look, see How to Use a ROT13 Decoder Command in Terminal.