Yes — you can play Cryptogram without downloading anything, because the entire puzzle runs inside your browser tab on a single HTML page. The fixture is a fixed, original monoalphabetic substitution built from a disclosed 26-letter key, and the phrase behind it is original Lizely text rather than a quotation, proverb, lyric, or book excerpt, so there is no third-party puzzle collection, no app store listing, and no installer to manage. When you open the game, no phrase state, mapping guess, or interaction history leaves your device, and the shell does not request an account, package dependency, remote API, or device permission. The 49 encoded letters, the 20 used cipher mappings, and the exact 1,000-point finish all happen locally, which is exactly the scenario most readers searching for browser-playable puzzles actually want. This article explains what the browser version delivers, why the substitution is verifiable, how to work through the puzzle step by step, and what the rules around one-to-one mappings, mistakes, and scoring actually mean in practice.
What the Browser Version Includes
The browser version of Cryptogram is intentionally self-contained. Everything runs in your browser, which means the puzzle state, your current guesses, your mistake count, your best score, and the boss-key cover screen all live in local browser storage rather than on a remote server. There is no phrase upload, no mapping upload, no result upload, and no interaction history upload.
You do not need to install an app, register an account, accept a subscription, or grant a device permission such as microphone, camera, location, or notifications. The page uses only existing site CSS token classes for surfaces, borders, foreground text, muted text, accent feedback, and danger feedback, so it does not load external visual assets and does not hardcode color values that would clash with a dark or light theme.
The shared game shell also exposes a double-Escape boss key. Press Escape twice within the shell timing window and the puzzle is covered by a spreadsheet-style screen. Press Escape twice more and the puzzle returns. That covers the no-download promise for users who want a quick browser puzzle they can hide in an instant, without installing anything at all.
The Fixed Substitution and Why It Is Auditable
The puzzle uses one deterministic monoalphabetic substitution built from a single uppercase plaintext sentence and a product-authored 26-character permutation. The plaintext alphabet ABCDEFGHIJKLMNOPQRSTUVWXYZ is paired position-by-position with the fixed ciphertext key QWERTYUIOPASDFGHJKLZXCVBNM. Plaintext A becomes cipher Q, plaintext B becomes cipher W, plaintext C becomes cipher E, and the same positional rule continues through plaintext Z becoming cipher M.
Because every key character is a distinct uppercase A-through-Z letter, the key is a complete bijection, meaning every plaintext letter has exactly one inverse and every ciphertext letter is reachable from exactly one plaintext letter. An independent oracle walks through the disclosed plaintext one character at a time, looks up each letter's index in the ordinary alphabet, takes the character at that index from the disclosed key, and preserves spaces. A second pass inverts all 26 key positions and verifies every one of the 49 encoded letter positions against its original plaintext character, so the fixture can be reproduced and audited without calling the production encoder.
Only 20 distinct plaintext letters occur in this sentence, so exactly 20 distinct ciphertext letters appear. The interface lists those used cipher letters in sorted order and does not demand six irrelevant mappings that would never occur in the puzzle. The independent frequency table also supplies a reproducible solving clue: cipher T occurs seven times, more than any other encrypted letter in the fixture. Frequency is a hint, not a guarantee about what T means, and repeated word shapes offer additional clues. The first and last words begin with the same two cipher letters, and the one-letter word Q can represent only the same plaintext letter everywhere Q appears.
How to Play Cryptogram in Your Browser
Open Cryptogram on a desktop or mobile browser, then work through these concrete steps:
- Pick a starting cipher letter. Tap any ciphertext occurrence in the encrypted phrase, or tap one of the 20 mapping cards in the grid. The selected cipher letter is highlighted, and every occurrence of that letter in the sentence becomes editable together.
- Assign a plaintext guess. Choose a plaintext letter from the on-screen A-through-Z keyboard, or type the letter on a physical keyboard. Every occurrence of the selected cipher letter updates in the decoded preview, with underscores filling in for unmapped letters so the word shape remains visible.
- Use frequency and shape clues. The first and last words share a two-letter opening, the one-letter word Q narrows to a single plaintext letter, and cipher T appears seven times. Treat these as hints and test your candidate against repeated symbols and word boundaries.
- Resolve conflicts atomically. Attempting to assign a plaintext letter that is already mapped to a different cipher letter produces an explicit conflict message and leaves the complete mapping object untouched. Two different ciphertext letters cannot both map to the same plaintext letter under the disclosed bijection.
- Clear a wrong guess. Use Clear mapping to remove only the currently selected cipher letter's guess. Other mappings stay in place, and you can move on without losing unrelated progress.
- Map every used cipher letter. The puzzle exposes exactly 20 used cipher letters, and Check mapping refuses to score until all 20 have a plaintext assignment. An incomplete check reports an incomplete puzzle and adds no mistake.
- Submit for exactly 1,000 points. Once all 20 used cipher letters are mapped and no conflict exists, choose Check mapping or press Enter. A correct full inverse awards exactly 1,000 points. A complete but wrong one-to-one mapping is a full wrong attempt and adds one mistake.
One-to-One Mappings and Atomic Conflict Handling
The disclosed substitution key is a bijection, so the puzzle enforces the inverse direction. If the ciphertext displays E, your task is to determine which plaintext letter produced E, and that mapping applies to every E in the sentence, not just one tile. Because the key is one-to-one, two different ciphertext letters cannot both map to the same plaintext letter.
The state transition checks that constraint before making any change. A conflicting choice leaves the complete mapping object untouched and displays a clear explanation, so the interface never silently steals a plaintext letter from another cipher mapping. The plaintext buttons remain available even when a letter is already used, because the user-facing behavior on a conflict is explicit rather than hidden.
Repeated keydown events are also ignored. Holding a letter or holding Enter does not cause rapid unintended assignments or submissions, so accidental key repeats do not lock you out of the puzzle before you have a chance to inspect what happened.
Scoring, Mistakes, Restart, and Boss Key Behavior
Checking distinguishes incomplete work from completed attempts. If any of the 20 used cipher letters remains unmapped, Check mapping reports an incomplete puzzle and adds no mistake. A complete one-to-one mapping that does not decode the original sentence is a full wrong attempt. The first distinct wrong mapping records one mistake but remains editable, so you can clear or replace guesses and continue solving.
The game serializes each fully populated mapping in stable sorted cipher order. Rechecking the exact same wrong mapping does not add another mistake. Only a different complete wrong signature counts as the second error and deadlocks the run. This prevents an accidental double-click from consuming both opportunities while enforcing a genuine two-distinct-error limit. One-to-one conflict attempts do not count as checks or mistakes.
Completion and deadlock freeze mapping selection, letter assignment, clearing, cursor movement, and checks. Restart is the deliberate way to return to a blank mapping with the first used cipher letter selected, zero mistakes, and zero score. The correct full inverse mapping always awards exactly 1,000 points. There is no timing bonus, frequency bonus, partial credit, hint penalty, or random modifier.
A 1,000-point result means only that this one product-authored substitution was inverted correctly under the stated one-to-one rules. The disclosed plaintext and key make the answer auditable and repeatable, and the locally stored best score tracks your best run in the same browser profile.
Keyboard, Touch, and Mobile Controls
The browser version works equally well on a 390-pixel mobile viewport and on a wider desktop layout. Mapping cards use large native buttons, the ciphertext wraps by whole words, the 20 mapping cards use four columns on narrow screens, and the 26 plaintext controls use seven compact columns. The layout stays within a 390-pixel viewport without page-level horizontal overflow.
Pointer interaction is complete. Tap a ciphertext occurrence or one of the 20 mapping cards, then choose a plaintext letter from the on-screen A-through-Z keyboard. Keyboard interaction mirrors every essential action:
| Input | Action |
|---|---|
| Left / Right arrow | Move through adjacent mapping cards |
| Up / Down arrow | Jump four positions to match the compact mobile grid |
| A–Z keys | Assign the typed letter to the selected cipher symbol |
| Backspace / Delete | Clear the selected mapping |
| Enter | Check the puzzle |
| Requirement | Browser version |
|---|---|
| App install | Not required |
| Account sign-up | Not required |
| Device permission | None requested |
| Score storage | Local browser storage only |
| Visual assets | None downloaded |
| Mobile layout | Fits 390-pixel viewport |
The double-Escape boss key covers the puzzle with a spreadsheet-style screen and is the same on touch and keyboard input. Repeated keydown events are ignored, so a held key never races through your assignments.
If you want a different single-word browser game with a similar no-download promise, Hangman follows the same pattern and is also playable in the browser tab without installation. Otherwise, opening Cryptogram directly in your browser is the full answer to the original search: there is nothing to download, nothing to sign up for, and nothing to grant, only an original 49-letter monoalphabetic substitution waiting to be inverted for exactly 1,000 points.