How large is the substitution cipher's key space?

26! permutations, roughly 4 * 10^26 keys — too large to brute-force. Despite this, the cipher falls easily to frequency analysis: letter, bigram, and trigram frequencies in English are very distinctive.

What makes the random key generator different from a simple shuffle?

It uses crypto.getRandomValues for entropy and the Fisher-Yates shuffle so every permutation is equally likely. That matters for CTFs where a biased key reveals patterns.

Is the mapping kept locally?

Yes. Your custom mapping and the encoded text never leave the browser.

substitution · 26-letter key · monoalphabetic · live

Apply a Substitution cipher

Define your own one-to-one mapping for the alphabet, then encrypt or decrypt any message. Shuffle for a random key. All processing runs locally in your browser.

Substitution Cipher

Input

43 B

1 lines

Output

43 B

1 lines

Status

ready

live

Ratio

1.00×

out/in

input · text

output · substitution

ZIT JXOEA WKGVF YGB PXDHL GCTK ZIT SQMN RGU

Quick Start

How to use a Substitution cipher

Provide a 26-letter key — each input letter is mapped to the matching position. Encrypt uses key[i] as the substitute for plain[i]; decrypt reverses the mapping.

01
Choose a key
26 unique letters. Use Shuffle for a fresh random key, or hand-craft one.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
keyUTF-8TextEncoderlosslesslive
key · raw bytes26 letters · UTF-8
```
QWERTYUIOPASDFGHJKLZXCVBNM
```
loaded · UTF-8MIME · ready
02
Pick a mode
Encrypt or decrypt with the current key. Decrypt builds the inverse mapping automatically.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
modeWeb Cryptosubtledeterministiclive
mode · optionsencrypt · live
```
encrypt | decrypt
```
options applied · livelive
03
Type or paste text
Letters are mapped; digits, spaces and punctuation pass through unchanged.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
inputmemoisedoptionsinstantreactive
input · encodedtext · ready
```
THE QUICK BROWN FOX
```
encoded · livelossless
04
Copy or download
One click to clipboard. Download as .txt.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to use a Substitution cipher

Puzzles, classroom demos, cryptanalysis practice.

Classroom demos

Compare 26! keyspace with the weakness against frequency attacks. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

CTF puzzles

Pair with Letter Frequency Analyzer for the canonical cracking workflow. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Escape rooms

Hand out a mapping table and a ciphertext clue. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

Crossword pangrams

Build cryptograms — sentences using all 26 letters. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Crypto study

Step before learning polyalphabetic and rotor ciphers. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Cross-implementation

Verify other substitution implementations on the wire. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

How big is the keyspace?

26! is about 4 x 10^26 — enormous, yet the cipher is still trivially broken by letter frequency analysis.

What is a valid key?

Any string of 26 unique letters A-Z, in any order. Press Shuffle to get a random one.

How is this different from Caesar?

Caesar fixes the mapping to a shift. Substitution lets you choose any permutation of the alphabet.

Is it secure?

No. Pair Letter Frequency Analyzer with educated guesses and most English ciphertexts crack in minutes.

Is anything sent to a server?

No. The cipher runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!