Affine Cipher
Classical substitution cipher that maps each letter with y = (ax + b) mod 26.
Alphabet mapping (a=5, b=8)
A→I B→N C→S D→X E→C F→H G→M H→R I→W J→B K→G L→L M→Q N→V O→A P→F Q→K R→P S→U T→Z U→E V→J W→O X→T Y→Y Z→D
How the affine cipher works
The affine cipher is a classical monoalphabetic substitution cipher. Each letter is converted to a number (A=0, B=1, … Z=25), then encrypted with the formula y = (ax + b) mod 26, where a and b are secret keys. The key a must be coprime to 26 (i.e. gcd(a,26)=1) so that decryption is possible — the valid values are 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, and 25.
Decryption uses the modular inverse: x = a⁻¹(y − b) mod 26. When a=1, the affine cipher reduces to the Caesar cipher. For other classical ciphers see Vigenère Cipher and Rail Fence Cipher.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Working through a classical cipher exercise that combines multiplication and addition.
- Solving a puzzle whose key is a coprime multiplier and an offset.
- Demonstrating why the multiplier must be coprime with the alphabet size.
- Reproducing a historical example against a published key.
- Showing how a Caesar shift is a special case of a more general scheme.
Frequently Asked Questions
- What is the affine cipher's formula?
- E(x) = (ax + b) mod 26, where x is the letter's position. It generalises the Caesar cipher, which is the special case a = 1 — the multiplication by `a` is what makes it more than a shift.
- Why must `a` be coprime with 26?
- Because decryption needs the modular inverse of `a`, which only exists when gcd(a, 26) = 1. Choosing a = 13 maps every letter onto just two outputs and the message becomes undecryptable — which is why only the twelve valid values are offered.
- How many keys are there?
- 12 valid values of `a` times 26 of `b` — 312, minus the identity. That is trivially brute-forceable by hand, let alone by a computer, so the cipher's interest is entirely mathematical rather than practical.
- How is decryption done?
- D(y) = a⁻¹(y − b) mod 26, where a⁻¹ is the modular inverse. It is not simply the reverse operations in reverse order — you cannot divide in modular arithmetic, so finding the inverse is the step that makes decryption possible at all.
- Is it stronger than a Caesar cipher?
- Marginally, and not in any way that matters. It is still a monoalphabetic substitution, so letter frequencies are preserved exactly — a frequency analysis breaks it as fast as it breaks Caesar, with only a slightly larger key space to search.
Common errors and gotchas
- Choosing a multiplier that shares a factor with 26, which makes the cipher non-invertible.
- Forgetting that a multiplier of 1 reduces it to a plain Caesar shift.
- Expecting punctuation and digits to encode, which the 26-letter scheme has no room for.
- Treating it as secure, since the key space is small enough to exhaust instantly.
- Losing the key, where recovery needs only frequency analysis and a little patience.