Homophonic Cipher
One-to-many substitution cipher that maps each plaintext letter to multiple ciphertext symbols.
By Jack Shi · Updated October 5, 2026
How to Use Homophonic Cipher
- Enter plaintext and keep the Default substitution table.
- Choose Encode; each letter randomly selects one of its assigned two-digit codes.
- Expect a different valid sequence on later runs because the choice is random.
- For Decode, paste space-separated two-digit codes and use the same table.
Frequent letters receive more possible codes to flatten symbol frequencies. The audited examples are actual sampled outputs; future runs can legitimately differ.
TL;DR
- A homophonic cipher gives each letter several possible symbols, with more symbols for common letters.
- The goal is to flatten letter frequencies so simple frequency counting no longer reveals the plaintext.
- Here the symbols are the 100 two-digit codes 00–99, and each code belongs to exactly one letter.
- It is a classical cipher for learning and puzzles, not for protecting real secrets.
The default code table
This is the table the tool uses by default. It spends all 100 two-digit codes: the more common a letter is in English, the more codes it gets. The last column shows the share of all ciphertext symbols one code of that letter should take on average, which is the letter's English frequency divided by its number of codes.
| Letter | Codes | Count | English frequency | Per code |
|---|---|---|---|---|
| A | 01 02 03 04 05 06 07 08 | 8 | 8.2% | 1.02% |
| B | 09 10 | 2 | 1.5% | 0.75% |
| C | 11 12 13 | 3 | 2.8% | 0.93% |
| D | 14 15 16 17 | 4 | 4.3% | 1.07% |
| E | 18 19 20 21 22 23 24 25 26 27 28 29 | 12 | 12.7% | 1.06% |
| F | 30 31 | 2 | 2.2% | 1.10% |
| G | 32 33 | 2 | 2% | 1.00% |
| H | 34 35 36 37 38 39 | 6 | 6.1% | 1.02% |
| I | 40 41 42 43 44 | 5 | 7% | 1.40% |
| J | 47 | 1 | 0.16% | 0.16% |
| K | 48 | 1 | 0.77% | 0.77% |
| L | 49 50 51 52 | 4 | 4% | 1.00% |
| M | 53 54 | 2 | 2.4% | 1.20% |
| N | 55 56 57 58 59 60 | 6 | 6.7% | 1.12% |
| O | 61 62 63 64 65 66 67 68 | 8 | 7.5% | 0.94% |
| P | 69 70 | 2 | 1.9% | 0.95% |
| Q | 71 | 1 | 0.12% | 0.12% |
| R | 72 73 74 75 76 77 | 6 | 6% | 1.00% |
| S | 78 79 80 81 82 83 | 6 | 6.3% | 1.05% |
| T | 84 85 86 87 88 89 90 91 92 | 9 | 9.1% | 1.01% |
| U | 93 94 95 | 3 | 2.8% | 0.93% |
| V | 96 | 1 | 0.98% | 0.98% |
| W | 97 98 | 2 | 2.4% | 1.20% |
| X | 99 | 1 | 0.15% | 0.15% |
| Y | 00 45 | 2 | 2% | 1.00% |
| Z | 46 | 1 | 0.074% | 0.07% |
Worked example: HELLO
To encode HELLO with the default table, pick one code for each letter: H has 6 choices, E has 12, each L has 4 and O has 8. Two valid results are:
34 19 52 52 67 decodes to HELLO
37 23 49 50 65 decodes to HELLO
The two L's in the first version use the same code (52), and in the second they use different ones (49 and 50). A repeated letter does not have to repeat its code. Multiplying the choices gives 6 × 12 × 4 × 4 × 8 = 9,216 different ways to write HELLO, and every one decodes back to HELLO. TEST has 9 × 12 × 6 × 9 = 5,832.
To decode, look each code up in the table: 34 is H, 19 is E, 52 is L and 67 is O. Because every code belongs to one letter, decoding needs no guessing; the randomness only exists when encoding.
Why it still leaves clues
With enough codes, the common letters spread out: in the table above, each code of E, T, A, O, S, N, R and H takes roughly 1% of the ciphertext, close to the 1% a perfectly flat distribution would give. That is the point of the cipher, and it defeats a simple count of which symbol appears most.
It cannot flatten everything with only 100 codes. The rare letters J, K, Q, V, X and Z each keep a single code, so their codes show up only about 0.07% to 0.98% of the time, well below 1%. A code that is rarely seen is a clue that it stands for an uncommon letter. Some letters also end up above the average: with five codes, each I code takes about 1.40%.
Beyond single letters, homophonic ciphers keep the structure of the language. Letters still follow one another in typical pairs and patterns, and a solver can use that, with a computer, to test many possible tables. Modern solvers do this routinely, so a homophonic cipher is a good puzzle rather than a safe way to hide a message.
A short history
- 1401: Francesco I Gonzaga, Duke of Mantua, used the earliest known example of a homophonic substitution cipher, in correspondence with Simone da Crema ( Wikipedia: Substitution cipher).
- 1578–1584: Mary, Queen of Scots used homophonic ciphers, with a nomenclator for frequent prefixes, suffixes and names, while imprisoned by Elizabeth I (same source).
- 1885: The Beale ciphers, a set of three numeric ciphertexts, are a homophonic type in which each number stands for one letter, keyed to a text; the solved one used the Declaration of Independence (same source).
- 2020: After 51 years, the Zodiac Killer's 340-character cipher was solved by David Oranchak, Sam Blake and Jarl Van Eycke. It used 63 different symbols for the letters, and its symbols had also been rearranged, so the solvers tried hundreds of thousands of rearrangements with the AZdecrypt program ( Cryptologic Foundation).
What this tool does and does not do
- It encodes the letters A–Z. Spaces are kept, and other characters are passed through unchanged.
- Codes are two digits separated by spaces. When decoding, a token that is not a two-digit code is passed through, and an unknown code shows as ?. Decoding does not restore the spaces between words, so ZYZ HELLO comes back as ZYZHELLO.
- Generate Random builds a new table from all 100 codes, with every letter getting at least one, and more for common letters. Keep the table (the download includes it) or you cannot decode the result later.
- It does not accept a custom table you type in, and it does not protect your data: processing happens in your browser, and the output is not secure encryption.
Examples
Default table, one sampled encode — input:
HELLO
Output:
34 19 52 52 67
The encoder randomly chooses among valid codes, so later output may differ.
Default table, one sampled encode — input:
TEST
Output:
88 24 78 89
The encoder randomly chooses among valid codes, so later output may differ.
Frequently Asked Questions
What is a homophonic substitution cipher?
A homophonic substitution cipher replaces each plaintext letter with one of several possible symbols. Common letters get more symbols than rare ones, which flattens the letter frequencies that a simple substitution cipher leaves visible.
How many codes does each letter get in this tool?
The default table uses all 100 two-digit codes, 00 to 99. E has 12, T has 9, A and O have 8 each, and J, K, Q, V, X and Z have one each (Y has two). The table is shown on this page, and you can also generate a random table that uses all 100 codes.
Why does the same word encode differently each time?
Each letter picks one of its codes at random, so HELLO can be written in 9,216 different ways with the default table (6 x 12 x 4 x 4 x 8). Every version decodes back to HELLO with the same table.
Is a homophonic cipher secure?
No. It is a classical cipher. It makes single-letter frequency analysis harder, but patterns remain, such as letter pairs and the rare letters whose single codes appear far less often than the others, and modern solvers use computer search. Do not use it to protect real secrets.
How do I decode a homophonic cipher?
Switch to Decode, paste the two-digit codes separated by spaces, and use the same table that encoded them. With the default table, each code belongs to exactly one letter, so decoding is a direct lookup.
Can I use my own substitution table?
Not yet. The tool offers the default table and a random table. The download button saves the output together with the table used, so you can decode it later by comparing with that table.
Features
Privacy Focused
All processing happens in your browser. No data is sent to servers.
Free Forever
No registration, no limits, completely free to use.