Nihilist Cipher Decoder & Encoder

What the Nihilist cipher is

Short answer: the Nihilist cipher writes each letter as its row-column number in a keyworded 5×5 Polybius square, then adds the number of the next letter of a repeating key word. The output is a list of two- and three-digit numbers. Decrypting subtracts the same key numbers and looks the result up in the square.

Sender and receiver share two secrets: the square keyword, which arranges the alphabet, and the key word, whose coordinates are added. I and J share one cell because the square has 25 cells. The addition is ordinary decimal addition, so 55 + 55 is 110.

How the Nihilist cipher works, step by step

1. Build the keyword square

The square keyword controls where letters sit. Start with ZEBRA, keep each letter only on its first appearance, then append the unused alphabet letters in order. Fill rows from left to right, starting at the top. The tool uppercases the keyword, changes J to I, and removes characters outside A–Z before removing duplicates. The resulting alphabet has 25 letters because I and J share a cell. Here is the complete ZEBRA square:

2. Turn plaintext into coordinates

Read each letter as a row digit followed by a column digit. S is in row 4, column 4, so its coordinate is 44. T is 45, A is 15, and Y is 55. These are ordinary two-digit numbers for the next calculation. Do not reverse the digits: the row tells you which horizontal line to use, and the column selects the letter within that line.

3. Convert and repeat the key word

Use the same square for the second key, entered in the Numeric Key Word field. KEY becomes 32, 12, 55. Repeat those three coordinates until every plaintext letter has a partner. This keyword supplies the numbers to add; it does not rearrange the square. Unlike the square keyword, repeated letters in this key are retained. Spaces between words do not restart the sequence or consume a key letter.

4. Add each pair of numbers

Add the full plaintext coordinate to the full key coordinate. For the first S with key letter K, that is 44 + 32 = 76. Carry normally between decimal places. There is no modulo operation, no alphabet wrap, and no rule to drop a leading digit. A sum can therefore have three digits. Keep separators between sums so the receiver can tell where one ciphertext number ends and the next begins.

Worked example: STAY BY

Use plaintext STAY BY, square keyword ZEBRA, and key word KEY. The six message letters line up with KEYKEY. The space after STAY marks a word boundary, but B still uses the next key letter, E. The table shows every addition, including a three-digit result at the end.

Final ciphertext: 76 57 70 87 / 25 110. An independent calculation and the converter give this same output. Notice that the two occurrences of Y produce different sums because their key letters differ. Also, 70 is a valid ciphertext sum even though it is not a valid square coordinate.

Decrypt by hand

Recreate the square before doing any subtraction. Convert KEY into 32, 12, 55 and repeat it under the ciphertext, starting at the first number. Subtract one complete key coordinate from each complete sum, then read the remaining pair as row followed by column. Here is the first word of the worked example in reverse:

Continue across the slash without resetting KEY: 25 − 12 = 13 gives B, and 110 − 55 = 55 gives Y. The recovered text is STAY BY. A result outside the square is a reason to check the key, square, and number boundaries. This tool displays a question mark for such a result. A wrong key can also produce valid coordinates, so the absence of question marks does not prove that a decryption is correct.

How to recognize a Nihilist cipher

Each digit of a sum adds a row (or column) digit of the letter to the same digit of the key letter. Both are 1 to 5, so each digit of the sum is 2 to 10. That leaves a fingerprint you can check in seconds:

A number such as 21, 41 or 115 rules out the standard cipher (or means a number was split or merged while copying). Passing the tests does not prove a Nihilist cipher, but plain Polybius numbers usually fail them quickly: every letter in the first column gives a number ending in 1, and they never go above 55. The Analyze tab checks the range and the last digit for you; the other rows are quick manual checks.

How to decrypt a Nihilist cipher without the key: measured results

The attack needs no guessing of words at first. Pick a key length L, split the numbers into L groups by position, and for each group keep only the key coordinates k for which every number minus k is a valid square coordinate (both digits 1 to 5). If some group keeps nothing, L is wrong. With enough ciphertext the shortest L that survives is the key length (unless the key word itself repeats, like ABAB); its multiples survive too.

We measured how fast this narrows the key. Plaintext: the first 20, 50, 100 and 200 letters of the Declaration of Independence (letters only, J counted as I). Square keyword ZEBRA, four key words, encrypted with this page's own engine. The table shows how many key combinations are left after the digit test; "all possible keys" is 25 to the power of the key length.

• In all 16 runs the shortest surviving length was the true key length, and the true key was never ruled out.
• A 3-letter key was fully determined from 50 letters. An 8-letter key needed 200; a 10-letter key still left 2 candidates at 200 letters.
• What you recover is the key's coordinates (for example 32 12 55), not its letters. Subtracting them gives the plaintext coordinates, which still need the square.

Try it on our 100-letter sample (key length 8): load the sample into the Analyze tab. The tool runs the same test for lengths 1 up to 12 and lists the candidates at each key position. The table is computed by the same code at build time, and unit tests check the figures quoted in the text.

Decrypting without the Polybius square

Once the key coordinates are subtracted, every number is a plain square coordinate such as 44 or 15. Without the square keyword you do not know which letter is in which cell, but the same letter always gives the same coordinate. What is left is a simple substitution of 25 symbols.

1. Count each coordinate. In English the most common one is usually E, then T, A, O.
2. Look for short repeated groups that could be THE, AND or ING.
3. Use the layout: a keyword square puts the unused letters in alphabetical order, so the last rows often read like the end of the alphabet (in ZEBRA's square: …O P Q S T / U V W X Y).
4. Once a few letters are placed, guess the square keyword from the first row and test it in the tool.

If you know or can guess the square keyword (puzzles often reuse a theme word), enter it in the tool together with the recovered key letters and decrypt directly.

What the tool does

• Letter normalization: plaintext and both keywords are uppercased, J becomes I, and characters outside A–Z are removed. Decoding returns uppercase letters with I, so original capitalization and the distinction between I and J cannot be recovered.
• Word boundaries: encryption splits plaintext on whitespace before removing nonletters. Surviving words are joined with / , and numbers within a word are separated by single spaces. Repeated spaces, tabs, and newlines are collapsed; chunks containing no letters disappear. Punctuation is discarded, so STAY-BY becomes one encoded word, while STAY BY produces two.
• Key handling: enter letters in Numeric Key Word despite the word “numeric” in its label. Numbers come from those letters through the square. Digits and punctuation in the key are ignored. A nonempty message with no usable key letters returns “Enter at least one letter in the numeric key.” Blank message input returns an empty output. An empty square keyword uses the alphabet in order with J omitted.
• Decrypt input: slashes separate words. Within each slash-delimited group, the decoder reads consecutive digit runs as numbers; other characters separate or surround those runs. Use spaces between sums for clarity: joining them into one long digit string makes one number, not several letter codes. The key advances for every number, even one that produces a question mark.
• Output limits: the tool uses full integer sums, including values above 100. Decryption joins slash-delimited groups with spaces and does not restore removed punctuation. Copy and Download use the displayed output. The decoder needs both keywords. Without them, the Analyze tab tests key lengths 1 up to 12 and lists the possible key coordinates, but it does not guess the square or print plaintext.

Why the Nihilist cipher is weak

A repeating key makes the same addition recur at regularly spaced positions. If the key has three letters, positions one, four, seven, and so on all use the same key coordinate. Within that group, equal plaintext letters always produce equal sums. Their frequency pattern survives, shifted by a constant number. A short key gives an analyst more samples per key position in a message of a given length.

One attack is to try candidate key lengths, divide the numbers into groups by key position, and test possible coordinate offsets. Subtracting the correct offset leaves only valid square coordinates. Wrong offsets may produce impossible pairs, while letter frequencies and likely words help assess the remaining candidates. If the square is unknown, assigning letters to those coordinates is an additional problem. Short messages can remain ambiguous; there is no promise that every puzzle has a unique or instantly recoverable solution. The measured results above show how many letters that takes.

Ordinary addition also exposes magnitude. Any sum greater than 100 requires both coordinates to come from the fifth row: a coordinate outside that row is at most 45, and even 45 + 55 only reaches 100. Thus the final 110 in our example reveals more than just an arbitrary ciphertext symbol. These leaks follow from the square and the arithmetic, not from a particular historical codebreaking event. Separately, the slashes this tool writes between words reveal word boundaries; remove them before sending a puzzle.

For comparison, a basic Polybius square stops at coordinate substitution. The Vigenère cipher shares the repeated-key weakness but works with alphabet shifts, while Gronsfeld uses digit-based shifts. Adding a second keyword makes Nihilist interesting to explore, but does not make it safe for private information. Use it for puzzles and learning, and use modern, vetted encryption for actual confidentiality.

History and variants of the Nihilist cipher

The cipher is named after the Russian Nihilists, revolutionary groups who, according to Wikipedia, used it in the 1880s for secret messages against the tsarist government. It needs only pencil and paper: a letter square for the coordinates and repeated additions. See the Nihilist cipher article on Wikipedia for a summary and sources.

Its best-known descendant is the VIC cipher, used by the Soviet agent Reino Häyhänen in the 1950s. It replaced the square with a straddling checkerboard (common letters get one digit, others two), combined digits with addition without carrying, and added transpositions, so the digit test above does not work on it.

Today it is used for puzzles and cryptography lessons. For how it compares with Polybius, Vigenère and Gronsfeld, see the section on why it is weak.