Security FIELD NOTES · 4 MIN READ
The Vigenère Cipher Explained: How the Rolling Keyword Shift Works
How the Vigenère cipher works: a repeating keyword gives every letter its own Caesar shift, with worked encrypt and decrypt examples and the real tool.
The Vigenère cipher looks like a Caesar cipher that can't sit still: instead of shifting every letter by the same amount, it walks a keyword across the message and shifts each letter by a different amount. For three centuries that rolling shift earned it the name le chiffre indéchiffrable — the indecipherable cipher. Here is exactly how the machinery works, letter by letter, using real outputs you can reproduce in seconds.
One keyword, a different shift per letter
Each letter of the keyword is really a Caesar shift in disguise: A shifts by 0, B by 1, up to Z by 25. Write the keyword above the message, letter for letter, and each pair says "shift this plaintext letter forward by this much, wrapping around the alphabet." Encrypting the classic example ATTACKATDAWN with the key LEMON: L shifts A by 11 to L, E shifts T by 4 to X, M shifts T by 12 to F (wraparound included), and so on — producing LXFOPVEFRNHR. The grid this walk uses is the famous tabula recta, a 26×26 table of shifted alphabets; implementations skip the table and do the row arithmetic directly: each output letter is (plaintext + key) mod 26.
Spaces, capitals, and punctuation: skipped, not shifted
The cipher shifts letters only. Spaces, digits, and punctuation pass through untouched, capitals keep their case, and — this detail matters — the keyword advances only when a letter is actually shifted. Encrypting Hello, World! with the key KEY gives Rijvs, Uyvjn!: the comma and exclamation mark sit exactly where they were, and the key stream ran K, E, Y, K, E, Y, K, E, Y, K across the ten letters. That is why meet at the bridge under the key QUEEN becomes cyix nj nli ohchkr — spaces still split real word boundaries. Convenient for readability, but it also hands an attacker the message's shape: word lengths and punctuation survive encryption.
Decryption is the same machine, run backwards
Because encryption adds the key letter's value, decryption subtracts it: (cipher − key) mod 26, with the same wraparound handled by the modulo. Feed LXFOPVEFRNHR back through the tool with the key LEMON and direction set to decrypt, and ATTACKATDAWN comes out. The symmetry means there is no separate "decoder" to build — one function with a sign flip — and it also means anyone holding the key holds the whole game. The security was never in the machinery; it was always in keeping the keyword secret.
Why the key length decides everything
The keyword cycles, and the cycle is the cipher's weak seam. Every letter sitting at positions 1, 6, 11 … of the message was shifted by the same key letter — so each of those letter-streams is secretly a plain Caesar cipher again. Recover the key length, split the ciphertext into that many streams, and frequency analysis picks off one key letter at a time: a six-letter key is six easy Caesars, not one hard cipher. That two-step autopsy is the story of how Vigenère fell, told properly in Classical Ciphers. The takeaway here is simpler: longer, less predictable keywords smear the frequency fingerprint further, but no classical cipher survives a determined modern attack.
Choosing a key in the tool
The tool accepts keyword letters only — digits or punctuation in the key are rejected with an error rather than silently mangled — and it treats uppercase and lowercase key letters identically, since K and k select the same shift. A good working key is long relative to the message, letter-diverse, and memorable to the people who need it. Short repeating keys like KEY are perfect for learning the mechanics but hand the attacker short streams to crack; something like QUEENANNE gives the rolling shift more room to spread letter frequencies. For puzzles and study this is ideal; for anything you actually want to keep private, modern cryptography is the only honest answer — and for the modern descendant of this same rolling-key idea, the XOR cipher applies an identical principle at the byte level.
Try it yourself
Open the Vigenère Cipher and reproduce the classics: encrypt ATTACKATDAWN with LEMON and confirm LXFOPVEFRNHR, then flip to decrypt and watch it come back. Try Hello, World! with the key KEY to see punctuation ride through untouched, and encrypt meet at the bridge with QUEEN to see spaces survive. To see why longer keys win, paste any output into the Letter Frequency Counter, and warm up on the single-shift version with the Caesar Cipher.