To decrypt a Hill cipher with a 2x2 key, multiply every ciphertext pair by the modular inverse of the key matrix under mod 26, then map the resulting numbers back to letters using A=0, B=1, …, Z=25. For the default key entered as 3 3; 2 5, the tool turns plaintext HELP into ciphertext HIAT; running the same key in decrypt mode with HIAT yields HELP back, which is the sanity check every example in this article relies on. That round trip is the single most useful thing to verify before processing longer exercises, because most "wrong answer" reports actually come from a mismatch in alphabet mapping, vector orientation, or padding rule rather than from a math error. The page below walks through the arithmetic once, then shows how the Hill Cipher Decoder applies the same convention automatically so you can confirm exercise pairs without redoing the modular inverses by hand.
What Hill Cipher Decryption Actually Does
The Hill cipher is a polygraphic substitution cipher: it processes letters in fixed blocks rather than one at a time. With a 2x2 key matrix, every pair of plaintext letters is treated as a column vector, multiplied by the key, and reduced modulo 26 to produce two ciphertext letters. Decryption is the algebraic inverse of that operation: multiply each ciphertext pair by the inverse of the key matrix, again reduced modulo 26, and each pair reconstructs the original plaintext pair.
The inverse exists only when the determinant of the key matrix shares no common factor with 26. The nontrivial divisors of 26 are 2, 13, and 26, so the forbidden determinants are any multiple of 2 or 13, including 2, 4, 6, 8, 10, 12, 13, 14, 16, 18, 20, 22, 24, and 26. Most textbook keys clear this test, which is why they work in practice. When the condition fails, multiple plaintext pairs map to the same ciphertext pair, so unique decryption is mathematically impossible.
Worked Example: Turning HIAT Back Into HELP
Use the default key 3 3; 2 5. Under the page's convention, HELP becomes two column vectors (H, E) = (7, 4) and (L, P) = (11, 15). Multiplying each pair by the key gives (7*3 + 4*3, 7*2 + 4*5) = (33, 34) reduced mod 26 to (7, 8) = HI, and (11*3 + 15*3, 11*2 + 15*5) = (78, 97) reduced mod 26 to (0, 19) = AT. So encryption of HELP produces HIAT.
To decrypt HIAT, first build the inverse of the key. The determinant is 3*5 − 3*2 = 9, and the modular inverse of 9 mod 26 is 3 because 9*3 = 27 ≡ 1 (mod 26). The adjugate of the key is [[5, -3], [-2, 3]], so the inverse is 3 × [[5, -3], [-2, 3]] = [[15, -9], [-6, 9]] reduced mod 26 to [[15, 17], [20, 9]].
Apply this inverse to the ciphertext pairs (H, I) = (7, 8) and (A, T) = (0, 19):
- Pair (7, 8): (15*7 + 17*8, 20*7 + 9*8) = (105 + 136, 140 + 72) = (241, 212). Since 241 mod 26 = 7 and 212 mod 26 = 4, the result is (7, 4) = HE.
- Pair (0, 19): (15*0 + 17*19, 20*0 + 9*19) = (323, 171). Since 323 mod 26 = 11 and 171 mod 26 = 15, the result is (11, 15) = LP.
The recovered plaintext is HELP, confirming the round trip. If you would rather skip the modular inverse derivation and still want to see the algebra written out, the companion guide How to Decrypt a 2x2 Hill Cipher Using the mod 26 Inverse walks through the same calculation in more detail.
The number-to-letter mapping for the letters in this example is:
| Letter | Number | Role |
|---|---|---|
| H | 7 | Plaintext and ciphertext |
| E | 4 | Plaintext |
| L | 11 | Plaintext |
| P | 15 | Plaintext |
| I | 8 | Ciphertext |
| A | 0 | Ciphertext |
| T | 19 | Ciphertext |
How to Decrypt With the Hill Cipher Decoder
- Confirm the exercise uses A=0 through Z=25, two-letter column vectors, and X padding for odd-length plaintext. Most courses follow this convention; if yours does not, the decoder will still run but the output will not match your answer key.
- Enter the two key matrix rows as four integers separated by a semicolon, for example 3 3; 2 5. Negative or large values are normalized internally to the range 0 through 25.
- Select the decrypt mode.
- Paste the ciphertext. The tool strips spaces, punctuation, and digits and groups the remaining letters into column vectors of length two.
- Run the conversion and read the uppercase A-Z output.
- Test a known pair first. After pasting HIAT with the default key, the output should read HELP. If the known pair matches, longer output is reliable; if it does not match, the convention in your source is different from the page's.
Conventions That Quietly Break Decryption
Hill cipher exercises differ in four ways. The first is alphabet mapping. This page uses A=0, B=1, through Z=25; some references start at A=1, which shifts every intermediate number by one and changes the encryption result. The second is vector orientation. The convention here is column vectors, so for key rows a b; c d and pair (x, y), the encrypted output is (a*x + b*y, c*x + d*y). Some textbooks use row vectors, which transposes the entire multiplication. The third is block size. This tool uses 2x2 blocks only; a 3x3 Hill cipher needs a different implementation. The fourth is padding. The encoder adds a single X only when the normalized plaintext has odd length, but the decoder cannot tell whether a trailing X in the recovered plaintext was padding or a real letter. Record the original length in your controlled exercise rather than stripping a trailing X automatically.
Why Some Keys Cannot Be Decrypted
A 2x2 key matrix K = [[a, b], [c, d]] has a modular inverse under mod 26 only when gcd(a*d − b*c, 26) = 1. If the determinant is even, multiple plaintext pairs map to the same ciphertext pair, and the inverse does not exist. If the determinant is a multiple of 13, the same ambiguity appears. The Hill Cipher Decoder rejects such keys rather than returning misleading text, because attempting to decrypt with a non-invertible key almost always means the source uses a different convention rather than a recoverable block. Common valid keys include 3 3; 2 5 (used in this article), 1 2; 1 3, 5 8; 3 7, and 7 2; 3 1. Each of these has a determinant coprime with 26.
Limits and Caveats of Hill Cipher Decryption
The Hill cipher is a teaching cipher, not a production cipher. Known plaintext pairs immediately reveal the key through linear algebra over mod 26, the alphabet and block size are tiny, and the decoder displays the key in its input field by design. Never use it for passwords, tokens, files, or any message with personal information. For real confidentiality, use a reviewed authenticated encryption scheme such as AES-GCM.
Two practical limits matter when working through exercises. First, the input is capped at 100,000 normalized letters to keep the browser responsive, so the tool handles multi-paragraph problem sets but not huge archives. Second, the normalized ciphertext must contain an even number of letters because every block produces two letters. If the ciphertext you were given has an odd letter count after stripping spaces and punctuation, the source may use a different block size or a different padding rule. Always cross-check the convention with the answer key before trusting the output.