Classical Cipher Decoder
EncodingEverything runs locally in your browser — nothing is uploaded
The real use for a tool like this is having a piece of text and no idea what was done to it — a puzzle, a CTF, something cryptic a friend sent — rather than knowing it is a Caesar cipher and wanting it decoded. So every common transform is listed at once and you scan for the line that reads as language. Pick a specific method when you want just one. Only the characters that should move, move. Caesar, Atbash and Vigenère touch letters alone; punctuation, digits and spaces are left exactly as they were, because rotating those too destroys the structure of the text and does not undo. The one exception is ROT47, defined as a 47-place rotation over printable ASCII, which is why it changes punctuation as well — the result says so.
Features
- Lists everything by default: ROT13, Atbash, ROT47, ROT18 and ROT5 at once, so you can spot the readable line
- Caesar takes any shift, and can brute force all 25
- Vigenère with your own key; the key advances only on key letters, so punctuation costs nothing
- Polybius square, both ways
- ⚠️ ROT47 is the only one that touches punctuation and digits, and the result explains why
- ⚠️ The square merges I and J, so decoding turns every J into an I — a property of the cipher, and stated in the result
- No Bacon cipher: it has two incompatible alphabets (24 and 26 letters) that encode to entirely different strings, and the text itself gives no clue which was used
How to use
- Paste the text
- The default “list all” shows every common transform; choose a specific method to narrow it down
- Facing a Caesar cipher with an unknown shift? Turn on brute force and read down the list
FAQ
- Why not shift every character?
- Because classical ciphers are defined over letters only. Caesar, Atbash and Vigenère permute the alphabet; punctuation, digits and spaces take no part. Shifting those too destroys the readable structure and does not round-trip. The single exception is ROT47, which by definition rotates all of printable ASCII by 47.
- Why are encoding and decoding the same operation for ROT13?
- Because there are 26 letters and 13 is exactly half — rotate twice and you are back where you started. Atbash and ROT47 work the same way (the latter rotates 94 printable characters by 47, also half). So these need no direction setting, and this tool does not pretend they have one.
- What happens to digits and symbols in a Vigenère key?
- They are ignored; only letters are used. A key decides shift amounts, and a shift can only be 0–25, so digits and symbols have no meaning there. Note also that the key advances only on key letters: punctuation and spaces in the ciphertext do not consume a key letter, otherwise the same plaintext would fall out of step merely because it contained a few spaces.
- Why is there no Bacon cipher?
- Because it has two mutually incompatible alphabets: the original uses 24 letters (I/J and U/V share a slot) and the later version uses 26. The same run of A/B characters decodes to different text under each, and nothing in the text reveals which was used. Handing over a “decoded” answer the user cannot check — one that may be half wrong — is worse than not offering it.
Related tools
Base64
EncodingConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
URL Encode
EncodingEscape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.
HTML Entities
EncodingTurn < > & and quotes into HTML entities and decode them back in a single pass, so &lt; becomes <, not an angle bracket. Runs in your browser.
JWT Decoder & Verifier
EncodingDecode a JWT and verify an HS256, HS384 or HS512 signature with your secret, reading exp and nbf as dates. All local to your browser.
Unicode Escape
EncodingConvert non-ASCII text and emoji into \uXXXX or \xXX escapes and back, with emoji written as proper surrogate pairs. Runs entirely in your browser.
File to Base64
EncodingDrop any file to get its Base64 and a data URL ready for src or url(), plus MIME, sizes and the encoded length. Nothing is uploaded.