▥ Columnar transposition

How to use it

Enter a keyword and a text; the cipher text appears at once. To decrypt, switch to “Decrypt” or press “⇅”. Spaces are removed by default, so word lengths don’t hint at the answer.

The “grid” panel shows the whole mechanism. The text is written in rows under the keyword, one letter per cell, with as many columns as the key has letters. The key’s letters are numbered alphabetically: the one earliest in the alphabet comes first, and equal letters count left to right. Then the columns are copied out top to bottom in the order of those numbers. “Sort the columns by the key” rearranges them in front of you, so the cipher text reads straight down, column after column.

An example: the key ZEBRAS gives the order 6-3-2-4-1-5, and WEAREDISCOVEREDFLEEATONCE becomes EVLNACDTESEAROFODEECWIREE.

The last row and a second key

If the letters don’t fill the last row, you can leave it short or pad it with X. A short row is safer: it is harder for an attacker to guess the column heights. The “second key” box turns on double transposition: the result of the first pass goes through the grid again with a second word. Double transposition was used in earnest well into the twentieth century, and it is far stronger than a single pass.

If the key is unknown

What matters is not the keyword but only the column order: ZEBRAS and FCBDAE produce exactly the same cipher text. So for a short key every order can be tried. Five columns have 120 orders, seven have 5040, and all orders up to seven columns come to 5912. The tool decrypts with each one and ranks the results by how many familiar letter groups they contain. The right answer is usually among the first rows. Keys longer than eight or nine letters can’t be brute-forced this way; they need cleverer methods.

Questions

Is this the same as the scytale?

Nearly. The scytale is the same grid read column by column in plain order, with no keyword; the keyword adds the shuffle. Both are in the lesson on transposition.

How can I tell transposition from substitution?

Count the letters of the cipher text. If their frequencies look like ordinary English, lots of E, T and A, it is a transposition: the letters are the same, only their order is scrambled.

Is my text sent anywhere?

No, everything runs in your browser.