Affine Cipher Decoder & Encoder

What is the affine cipher?

The affine cipher turns each letter into a number (A = 0 … Z = 25), multiplies it by a key a, adds a second key b, and turns the result back into a letter, wrapping around after 25. It is a substitution cipher like the Caesar cipher, with one extra step: the multiplication scrambles the alphabet instead of only sliding it along. The Caesar cipher is the affine cipher with a = 1, and Atbash is the affine cipher with a = 25 and b = 25.

It is mostly met in math and computer science classes, because it is a friendly way to practice modular arithmetic: encoding needs multiplication mod 26, and decoding needs a modular inverse.

How to use the affine cipher decoder and encoder

1. Choose Encode or Decode.
2. Set a with the − and + buttons; they step through only the twelve values that work (1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25). Set b anywhere from 0 to 25.
3. Type or paste the text. Case, spaces, digits and punctuation are kept.
4. Copy the result, or press Decode this to check it.

No key? Open Crack it: I don’t know the key: the tool tries all 312 key pairs and ranks them by how much the result reads like English, and Use a = …, b = … applies the winner. Step by step shows the full cipher alphabet for your keys and the arithmetic for each letter. A link such as ?text=IHHWVC&mode=decode&a=5&b=8 opens the tool filled in.

The affine cipher formula

With the letters numbered from A = 0 to Z = 25:

• Encode: E(x) = (a × x + b) mod 26
• Decode: D(y) = a⁻¹ × (y − b) mod 26

Here x is a plain letter, y a cipher letter, and a⁻¹ is the modular inverse of a: the number that gives 1 when multiplied by a and divided by 26 (it leaves a remainder of 1). “mod 26” means “take the remainder after dividing by 26”, which is what makes the alphabet wrap around.

Worked example: encoding

Let’s encode AFFINE CIPHER with a = 5 and b = 8, one row for each different letter:

So AFFINE CIPHER becomes IHHWVC SWFRCP. With these keys the whole cipher alphabet is:

Worked example: decoding

First find the inverse of a = 5. Try multiples of 5 until one is 1 more than a multiple of 26: 5 × 21 = 105 = 4 × 26 + 1. So a⁻¹ = 21. Now apply D(y) = 21 × (y − 8) mod 26 to the code:

Negative numbers are fine: to take −21 mod 26, add 26 until the number is between 0 and 25, which gives 5. Carry on for every letter and IHHWVC SWFRCP decodes back to AFFINE CIPHER.

Which values of a work? (Inverse table)

Decoding needs a⁻¹, and a has an inverse mod 26 only when it shares no factor with 26, that is, when it is odd and not 13. That leaves twelve values. Here they are with their inverses:

What goes wrong with an even a? Take a = 2 and b = 3. The cipher alphabet becomes DFHJLNPRTVXZBDFHJLNPRTVXZB: only half the letters are used, and A and N both turn into D. A message encoded that way cannot be decoded for sure, which is why the tool will not let you pick it.

How many keys? Twelve choices for a and 26 for b make 12 × 26 = 312 key pairs. One of them (a = 1, b = 0) leaves the text unchanged, so 311 actually encode anything.

How to crack an affine cipher

Brute force: try all 312 keys

312 keys is far too few to be safe. The tool decodes the message with every key pair and ranks the results by how English they look (common letter sequences plus real dictionary words). Here is Myyp hfqw tehy qt g wgjy pxgcy through the cracker, best five:

The message was encoded with a = 11 and b = 6, the reading at the top. Everything below the top line is nonsense, which is typical: as soon as the message is a sentence long, only one key gives English.

Known letters: solve two equations

By hand, there is a smarter way. If you know (or guess) what two cipher letters stand for, you can work out a and b directly. Frequency analysis gives good guesses: the most common cipher letter is probably E, the next probably T.

Say that in a message encoded with unknown keys, F stands for E (4) and G stands for T (19). That gives two equations: 5 = 4a + b and 6 = 19a + b (mod 26). Subtract the second from the first: 5 − 6 = (4 − 19)a, so 25 = 11a (mod 26). The inverse of 11 is 19, so a = 25 × 19 mod 26 = 7. Put a back into the first equation: b = 5 − 4 × 7 mod 26 = 3. The keys were a = 7 and b = 3, exactly what the equations found.

If the guess was wrong, the equations either have no answer (the difference has no inverse) or give keys that turn the message into nonsense. Then try the next most common letter.

How to tell an affine cipher from other ciphers

A message in an affine cipher looks just like any other single-alphabet substitution: the spaces and punctuation are where they were, word lengths are unchanged, and the letter counts are as lopsided as in English but led by the wrong letters. A few clues point to affine in particular:

• A Caesar brute force fails but the text clearly keeps its word shapes (THE, AND and double letters still show through as repeated patterns).
• The puzzle mentions two numbers, a multiplier, or modular arithmetic.
• The cracker finds it. Paste the text and open Crack it: if one of the 312 keys reads as English, you have your answer. If none does, use the cryptogram solver, which handles any scrambled alphabet.

The Which cipher is this? section below the tool runs these checks for you and links to the right decoder.

Where the affine cipher comes from

The affine cipher is named after affine functions in mathematics, functions of the form f(x) = ax + b: a multiplication followed by an addition. It is a teaching cipher rather than a historical one. It appears in textbooks on number theory and cryptography because it is the smallest step up from the Caesar cipher that needs real mathematics, and it leads naturally to bigger ideas: the multiplicative inverse it relies on is the same tool used, with much larger numbers, in modern public-key cryptography.

Affine cipher vs. Caesar and Atbash

All of them map each letter to one fixed letter, so all keep English letter patterns. A general substitution cipher allows any scrambled alphabet at all, of which the affine alphabets are a tiny fraction.

Modular arithmetic in two minutes

“mod 26” is clock arithmetic with 26 hours. On a 12-hour clock, 9 o’clock plus 5 hours is 2 o’clock, because 14 wraps around to 2; in the alphabet, 30 wraps around to 4, which is E. To find any number mod 26, divide by 26 and keep the remainder: 43 mod 26 is 17, because 43 = 1 × 26 + 17.

Division does not exist in clock arithmetic, so to “undo” multiplying by a you multiply by its inverse instead. Multiplying by 5 and then by 21 is the same as multiplying by 105, and 105 is 4 × 26 + 1, so it lands exactly one step past a full set of turns: it has the same effect as multiplying by 1. That is all a modular inverse is. Only numbers that share no factor with 26 have one, which is the rule from the inverse table above.

The same idea works for other alphabets. With 29 symbols (26 letters plus a space, a period and a question mark, for example) the keys work mod 29, and because 29 is a prime number, every a from 1 to 28 is usable.

Affine cipher practice problems

Decode these with the keys given: find a⁻¹ in the inverse table, then apply D(y) to each letter.

Common mistakes

• Counting from A = 1. The formula assumes A = 0. Starting at 1 gives a different (still valid) cipher, and the two will not decode each other.
• Subtracting before multiplying when encoding. Encoding is multiply, then add. Decoding is subtract, then multiply by the inverse. Swapping the order gives wrong letters.
• Dividing instead of using the inverse. 17 ÷ 5 is not a whole number, and even when division comes out even it gives the wrong answer mod 26. Always multiply by a⁻¹.
• Forgetting negative remainders. Many calculators (and some programming languages) return a negative remainder for a negative number. Add 26 to bring it into 0 to 25.

Affine cipher in Python

def affine(text, a, b, decode=False):
    inv = pow(a, -1, 26)          # modular inverse (Python 3.8+)
    out = []
    for ch in text:
        if ch.isalpha():
            base = 65 if ch.isupper() else 97
            x = ord(ch) - base
            y = inv * (x - b) % 26 if decode else (a * x + b) % 26
            out.append(chr(y + base))
        else:
            out.append(ch)
    return "".join(out)

print(affine("AFFINE CIPHER", 5, 8))          # IHHWVC SWFRCP
print(affine("IHHWVC SWFRCP", 5, 8, True))     # AFFINE CIPHER

pow(a, -1, 26) raises an error if a has no inverse, which is a useful check that the key is valid.

Tips for using the affine cipher

• Avoid a = 1 if you want more than a Caesar shift, and avoid a = 25, b = 25, which is just Atbash.
• Watch for fixed letters. Some key pairs leave a letter unchanged. With a = 5, b = 8, L and Y stay the same; look at the cipher alphabet in Step by step before you choose.
• For a classroom puzzle, give the keys as a riddle (“a is the number of days in a week, b is the number of legs on a spider”) and let students check their working with the tool.
• Remember it is easy to break. With only 312 keys, a computer tries them all in a blink.

Free and private

The affine cipher tool runs entirely in your browser: free, with no sign-up, and nothing you type is uploaded or stored.