To decipher a Vigenere cipher, subtract each key letter's shift from the corresponding ciphertext letter modulo 26, using a repeating key that wraps from its beginning once it runs out of letters — and only ASCII letters A through Z (and their lowercase counterparts) actually participate in the transformation. The Vigenere Cipher Decoder does exactly that in your browser: you paste the ciphertext, supply the known repeating key made from ASCII letters only, choose Decrypt, and the tool reverses every shift while keeping spaces, line breaks, digits, punctuation, emoji, accented letters, and CJK characters exactly where they were. Crucially, this is decipherment, not key recovery: the tool cannot find the key for you, estimate its length, run frequency analysis, or score candidate plaintexts, so a wrong key still produces a deterministic but meaningless result. Everything happens locally in the current tab — no text, key, or output is uploaded, and no account is required. The convention the tool follows is locked in its tests: only ASCII letters consume key positions, every other UTF-16 code unit is copied unchanged, and the output is labeled plaintext only because Decrypt mode was selected, not because the result has been verified as meaningful. Always retain the exact key and the alignment convention when exchanging a Vigenere puzzle, because other programs may advance the key across spaces or normalize characters differently.
The Math Behind Deciphering a Vigenere Cipher
Deciphering a Vigenere cipher is the reverse of encrypting with one. Encryption adds the current key letter's shift to each ASCII letter in the message, treating A as 0, B as 1, and so on up to Z as 25, then wraps the result modulo 26: (letter + keyShift) mod 26. Deciphering does the opposite, subtracting the shift and re-adding 26 only to keep the arithmetic positive: (letter − keyShift + 26) mod 26. Because the cipher is polyalphabetic — different positions in the message can be shifted by different amounts — the same plaintext letter appears as different ciphertext letters depending on where it sits. A repeating key produces a periodic pattern of shifts, and once the message has more participating letters than the key, the key restarts from its first letter.
The Vigenere Cipher Decoder implements exactly that arithmetic in your browser. The message and the key are both reduced to ASCII letters A–Z (case-insensitive on the key side, with original case preserved on the message side), so every participating letter gets its shift from the key letter at the current position, and the index advances only for those participating letters. Punctuation, digits, spaces, line breaks, emoji, accented letters, and CJK code units are copied byte-for-string and do not advance the key. This convention is deliberately locked by tests so users do not have to guess how spacing changes alignment, and a worked example makes the mechanics concrete.
Take the ciphertext LXFOPVEFRNHR with key LEMON. Map letters to numbers: L→11, X→23, F→5, O→14, P→15, V→21, E→4, F→5, R→17, N→13, H→7, R→17. Map key shifts: L=11, E=4, M=12, O=14, N=13, then repeat. Subtract position by position: 11−11=0 (A), 23−4=19 (T), 5−12=−7+26=19 (T), 14−14=0 (A), 15−13=2 (C), 21−11=10 (K), 4−4=0 (A), 5−12=19 (T), 17−14=3 (D), 13−13=0 (A), 7−11=−4+26=22 (W), 17−4=13 (N). The recovered plaintext is ATTACKATDAWN. If the key were a single letter repeated instead of five, the cipher would collapse into a fixed shift — exactly the case handled by the Caesar Cipher Decoder, which is worth keeping open alongside Vigenere for teaching and for verifying what a repeating single-letter key produces.
Decipher a Vigenere Cipher With the Vigenere Cipher Decoder
Open the Vigenere Cipher Decoder in a browser tab. Follow these steps to reverse a known Vigenere ciphertext:
- Paste the ciphertext into the input box, preserving original capitalization, spaces, line breaks, digits, and punctuation. Up to 500,000 JavaScript UTF-16 code units are accepted; anything above that limit is rejected as a whole with an explicit message rather than processed as a partial prefix.
- Type the repeating key using ASCII letters A through Z only — no spaces, no digits, no punctuation, no accents. Keys are case-insensitive, so LEMON, Lemon, and lemon all produce identical shifts. The key must be between 1 and 256 letters; an empty or invalid key returns a direct error and no partial result.
- Select Decrypt from the mode control. The tool labels its output as plaintext when Decrypt is chosen, but the label describes the requested transformation, not a verification of meaning.
- Run the transformation. The tool iterates through the input, applies (letter − keyShift + 26) mod 26 to every ASCII letter, advances the key index only for ASCII letters, and copies every other code unit unchanged.
- Copy the labeled plaintext with the Copy button and store the exact key with it. If you edit the text, the key, or the mode afterward, the previous output and any error are cleared so a stale plaintext cannot be mistaken for a current one.
How Key Alignment Works During Decryption
The behavior of each character during decryption is fixed and tested. The table below summarizes what happens to common character classes and whether they consume a key position.
| Character class | Example | Advances key index? | How it is handled during decryption |
|---|---|---|---|
| ASCII uppercase A–Z | T | Yes | Subtract current key shift modulo 26; case preserved |
| ASCII lowercase a–z | t | Yes | Subtract current key shift modulo 26; case preserved |
| Space | (single space) | No | Copied as-is |
| Line break | \n | No | Copied as-is |
| Digit | 7 | No | Copied as-is |
| ASCII punctuation | , . ! ? | No | Copied as-is |
| Emoji | 🔑 | No | Copied as-is; counts toward the UTF-16 limit (typically 2 code units) |
| Accented letter | é ñ ü | No | Copied as-is; never transformed |
| CJK character | 字 鍵 | No | Copied as-is |
Three consequences follow from this alignment. First, the key index for any letter is determined by counting only previous ASCII letters, so two ciphertexts that differ only by inserted spaces produce the same plaintext with the same key. Second, emoji and CJK characters do consume from the 500,000 UTF-16-code-unit input budget even though they do not transform, because that is how JavaScript measures string length. Third, decryption with the same key is the inverse of encryption with that key, so any text you can encrypt and then decrypt round-trips identically — but only under this tool's locked convention. Other programs may advance the key across spaces, fold accented letters, or normalize differently, and the same ciphertext can therefore decrypt to different plaintexts under different conventions.
Inputs and Limits That Affect a Successful Decipher
The decoder enforces four hard constraints. Inputs that violate any constraint produce an explicit message and no partial output.
- Input length: the input must be at most 500,000 JavaScript UTF-16 code units. Text exactly at the limit is transformed in full; text above it is rejected as a whole. The counter measures code units rather than characters, so supplementary-plane symbols such as emoji typically occupy two units.
- Key length: the key must be between 1 and 256 ASCII letters A–Z. A key of 257 letters is rejected outright.
- Key composition: the key may contain only ASCII letters A–Z or a–z. Spaces, digits, punctuation, accents, emoji, and symbols all make the key invalid. Keys are normalized internally to uppercase, so capitalization does not change the result.
- Mode and reversibility: select Encrypt or Decrypt before running. Decrypt mode requires the correct key — there is no warning or detection of a wrong key, only deterministic output. Editing the text, key, or mode after a run clears the previous output and any error so an old plaintext or ciphertext cannot remain visible.
Where Vigenere Decipherment Is Useful and Where It Is Not
Vigenere is a 16th-century polyalphabetic cipher that remains valuable as a teaching artifact and as a puzzle format. The repeating-key method is documented in classical cryptography education sources, including the CrypTool educational presentation, and it illustrates modular arithmetic, key periodicity, and the difference between monoalphabetic and polyalphabetic substitution in a way students can compute by hand. Common legitimate uses include classroom exercises, escape-room clues, geocaching puzzle books, recreational CTF challenges, and demonstrations of why classical ciphers are insecure against modern cryptanalysis.
The tool is not, however, suitable for protecting anything sensitive. Repeating keys leak statistical structure, and modern computers can estimate key length, score candidate keys, and recover plaintext from Vigenere ciphertext in seconds. Do not use the Vigenere Cipher Decoder or any hand-rolled Vigenere implementation to protect passwords, authentication tokens, financial details, personal records, confidential messages, or production secrets. For any real security need, use a maintained modern encryption system with authenticated encryption and proper key management — AES-GCM, for example, with a unique key per message. The Vigenere Cipher Decoder is also not a solver: it will not try dictionary keys, estimate key length, score plausible plaintexts, or claim that the output is meaningful when the supplied key is wrong. If the key is wrong, the output is deterministic nonsense with a "plaintext" label — a useful reminder that deciphering with the right key and decrypting without one are different problems.
For a deeper look, see Is XOR Encryption Secure? A Repeating-Key Reality Check.