Classical Ciphers

No. Every one of them was broken centuries or decades ago and exists here purely for education, recreation (CTF, geocaching, escape rooms) or historical curiosity. To protect a real secret, use the Encrypt/Decrypt tool (AES-256).

Every letter-by-letter classical cipher here operates on the 26-letter A-Z alphabet — the same alphabet used in the original historical examples. Any character outside it (accented letter, punctuation, digit, space) passes through unchanged, and decrypting always returns the text exactly as typed. Two exceptions: the Null Cipher (see the question about it below) strips accents instead of dropping them, because the message never appears directly in the cover text; and Playfair drops spaces/punctuation entirely (never preserves position), because it encrypts letter pairs — there's no such thing as a "pair" with a space in the middle.

No — every encryption/decryption happens in your browser. No text, key, or result ever leaves your computer.

Every language has letters that appear more often than others (in English, E and T are the most common). In a substitution cipher, that distribution survives encryption — only the letters' labels change, not the proportions. Comparing the ciphertext's chart against the reference distributions is how a cryptanalyst figures out where to start breaking the cipher.

With only 25 possible shifts (26 minus shift 0, which wouldn't encrypt anything), it's faster to generate all of them and read which one makes sense than to guess one at a time — exactly how a computer (or a patient person) would break this cipher in practice.

Because not every value of 'a' works — only the 12 that are coprime with 26 (not divisible by 2 or 13) keep the cipher reversible; the other 13 would make two different letters land on the same ciphertext letter, and decrypting wouldn't know which one was the original. 12 valid values of 'a' × 26 of 'b' = 312 combinations — few enough to try all at once, same spirit as Caesar's brute force.

Because the Playfair grid has 25 cells (5×5) for the alphabet's 26 letters — one short. The near-universal convention is for I and J to share the same cell: any J in the message is treated as I before encrypting. This creates a real, well-known ambiguity in the cipher itself: when decrypting, there's no way to tell whether a letter was originally I or J — the reader has to decide from context, exactly as it always worked in real life.

Yes — that's one of the audiences this tool has in mind. Caesar's brute-force mode and the Substitution/Vigenère frequency chart were designed to help crack a puzzle, not just to encrypt one.

No — it's the easiest to brute-force in the whole catalog: there are only 6 possible positions (1st through 6th letter of each word), so trying all six finds the right one instantly. Its security was never about math — it was always about nobody suspecting a message is hidden there in the first place.

Spaces and digits (0-9), yes — each becomes part of the cover (a space is a symbol sequence, a digit is its own word made entirely of digits, never mixed with letters). Accents are stripped before hiding (é → e, ç → c), never dropped — that would lose real content from a message with diacritics. Only punctuation (commas, question marks, etc.) is discarded.

From this page's own language — Portuguese here becomes a Portuguese cover, and the English version of the tool becomes an English cover, with no separate selector. Both word lists are embedded in the tool itself (never fetched from a server): in English, the EFF Long Wordlist (Electronic Frontier Foundation, CC-BY license); in Portuguese, the frequency list from the "fserb/pt-br" repository (MIT license). Coverage of all 26 letters across all 6 possible positions was checked before shipping in both cases — only one combination in the entire English language has no candidate word (the letter "q" in the 6th position, rare even outside this tool), and that one case falls back to "Made-up words" mode for just that letter.

Because their "ciphertext" is source code ("+-<>[].," or the "Ook."/"Ook?"/"Ook!" tokens), not a natural language with a letter distribution to compare, and there's no key to test every combination of — they're a full program, not a substitution with a finite key space.

Yes — "Decrypt" runs any valid code, whether this tool generated it or not. That's the most common real-world use: a CTF flag hidden as source code that needs to be run (never decrypted through statistics) to reveal the readable text.

Execution stops on its own after reaching 1,000,000 steps (protection against freezing the browser tab) and shows a warning — the output shown is partial, everything the program produced up to the interruption, never discarded.