Calculator
gcd(a, 26) = 1 is required.
No key needed: all 312 keys are tried. The controls show the top-ranked key.
Key (5, 8) gcd(5, 26) = 1 5⁻¹ ≡ 21 (mod 26)
With a = 1, this is exactly a Caesar Cipher with shift 0. Open in Caesar Cipher
Enter some ciphertext containing letters to see the best-ranked decryptions.
There are only φ(26) × 26 = 12 × 26 = 312 valid keys, so an affine cipher can be broken by trying every one; φ(26) = 12 because exactly 12 residues modulo 26 are coprime to 26. Select a candidate to decrypt with that key. Candidates are ranked by pattern score, which measures out of 10 how closely each candidate's letter sequences follow English spelling, plus a bonus for the share of the text made up of listed words from a list of about 73,000 English words and names, and a small one for English-like letter frequencies. The top-ranked candidate is marked Likely English when such words cover at least half of it, its spelling looks English, and it is well ahead of the second-ranked key; Low confidence when the top keys are nearly tied or nothing looks English; and Best guess otherwise. These labels are a rough guide, not probabilities: a short text can fit several keys.
See the mapping
How your message is transformed
| Position | Input letter | Number | Calculation (mod 26) | Result number | Output letter |
|---|
Type some letters above to see the arithmetic for each one.
Position counts letters only; spaces, digits, and punctuation are not transformed and are left out of the table.
Why must gcd(a, 26) = 1?
If a is not invertible modulo 26, different plaintext letters map to the same ciphertext letter, so unique decryption is impossible. That is why the multiplier list above offers only the 12 values coprime to 26. Take the invalid value a = 2:
The same happens to every pair of letters 13 places apart, because 2 × 13 = 26 ≡ 0.
How does decryption work?
Encryption computes y = ax + b. To undo it, subtract b first, then multiply by a⁻¹, the number with a⁻¹a ≡ 1 (mod 26). With the current key:
Why isn't this just a shift?
A Caesar cipher has a = 1, so E(x) = x + b and every letter moves by the same amount. The affine cipher allows a ≠ 1: multiplication rearranges the alphabet before the shift is added, which makes it a more general monoalphabetic substitution.
What happens to letter frequencies?
The affine cipher is monoalphabetic: each plaintext letter always maps to the same ciphertext letter. The frequency counts of the message are therefore preserved, only assigned to different letters. If E is the most common letter of the message, then under this key the most common ciphertext letter is C.
Related topics
The Caesar Cipher is the special case a = 1, where E(x) = x + b (mod 26).