a must share no common factor with 26 (only the twelve values listed are valid). b can be any value from 0 to 25.
Jump to: How the tool works · The math · Worked example · Breaking it · History · FAQ
How the Affine Cipher Tool Works
The tool has two modes. In Encode mode, type your message, set your two keys (a and b), and the encrypted text appears as you type. In Decode mode, paste the ciphertext, enter the same a and b, and the original message is recovered.
Your a value must be one of twelve specific numbers: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, or 25. Your b value can be any whole number from 0 to 25. The live formula line shows exactly which function is being applied, so encrypting HELLO with a = 5 and b = 8 displays E(x) = (5x + 8) mod 26 and returns RCLLA.
If you have an encrypted message but no key, use the auto-solver. Because an affine cipher on the English alphabet has only 312 possible keys, the tool tests every one, ranks the results by how closely each looks like English, and shows you the most likely plaintexts. Click any candidate to load its keys into the main fields.
The Affine Cipher Formula
The affine cipher is a monoalphabetic substitution cipher in which each letter is replaced using a single mathematical function. First, letters map to numbers: A = 0, B = 1, on through Z = 25. Each plaintext number x is then transformed by the encryption function:
E(x) = (ax + b) mod 26
Here a and b are the two keys, and mod 26 wraps the result back into the 0–25 range so it lands on a letter. Decryption reverses this with:
D(y) = a⁻¹(y − b) mod 26
where a⁻¹ is the modular multiplicative inverse of a: the number that satisfies a · a⁻¹ ≡ 1 (mod 26). A modular inverse only exists when a and 26 share no common factor, which is why the twelve legal values of a are exactly those coprime to 26: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, and 25.
Two famous ciphers are special cases of this formula. Set a = 1 and the function collapses to a plain shift, which is the Caesar cipher. Set a = 25 (the same as −1 modulo 26) and you get the reversed alphabet of the Atbash cipher. The affine cipher is the general form that contains both.
Worked Example: Encrypting "AFFINE CIPHER"
Take the plaintext AFFINECIPHER with keys a = 5 and b = 8, so the encryption function is E(x) = (5x + 8) mod 26. Converting the first letters to numbers, A = 0 and F = 5, then applying the function: A becomes (5·0 + 8) mod 26 = 8, which is I; F becomes (5·5 + 8) mod 26 = 33 mod 26 = 7, which is H. Working through every letter gives the ciphertext IHHWVCSWFRCP.
To decrypt, the tool computes the modular inverse of 5, which is 21 (because 5 · 21 = 105 = 4·26 + 1). The decryption function D(y) = 21(y − 8) mod 26 turns IHHWVCSWFRCP back into AFFINECIPHER.
Breaking the Affine Cipher
The affine cipher is a teaching cipher, not a secure one. Two weaknesses make it easy to break. First, the keyspace is tiny: 12 values of a times 26 values of b gives just 312 possible keys (311 if you discard the trivial a = 1, b = 0 that leaves text unchanged). A computer tests all of them in an instant, which is exactly what this tool's auto-solver does.
Second, because it is monoalphabetic, each plaintext letter always maps to the same ciphertext letter, so frequency analysis works. In English the most common letter is usually E, followed by T and A, so the most common letters in a long ciphertext betray the mapping. If a cryptanalyst can pin down the plaintext of just two ciphertext letters, the two keys fall out of a simple pair of simultaneous equations.
History of the Affine Cipher
The affine cipher is a mathematical generalization rather than a historical artifact: the idea of replacing each letter through a linear function ax + b that mathematicians call an affine transformation, which is where the cipher gets its name. Its components are ancient, though. The shift half of the formula is the cipher Julius Caesar used for military dispatches in the first century BC, and the reversed-alphabet case appears as the Atbash cipher in the Hebrew scriptures centuries earlier.
What the affine cipher adds is the multiply step, and with it a clean lesson in modular arithmetic, coprimality, and inverses. That is why it earns its place in nearly every introductory cryptography and number-theory course rather than in any spy's toolkit.
How the Affine Cipher Compares to the Caesar Cipher
The cleanest way to understand the affine cipher is as the Caesar cipher with one extra dial. The Caesar cipher only shifts (b), so it has 25 useful keys and can be cracked by trying each shift in turn. The affine cipher shifts and multiplies (a and b), which scrambles the alphabet so that adjacent plaintext letters no longer stay adjacent in the ciphertext. If your ciphertext was produced by an unknown substitution that is not affine at all, the Cryptogram Solver is the better tool, and the Vigenère cipher is the historical next step up to genuine polyalphabetic strength. For the full set of classical ciphers, see the Cipher & Encoding Tools Hub.
Frequently Asked Questions
The affine cipher is a monoalphabetic substitution cipher that encrypts each letter with the function (ax + b) mod 26. It is the general form of letter-shift ciphers: the Caesar cipher is simply the affine cipher with a = 1, and the Atbash cipher is the case a = 25. Because one letter always maps to the same ciphertext letter, it shares the weaknesses of all substitution ciphers.
Each letter becomes a number (A = 0 to Z = 25), gets transformed by (ax + b) mod 26, and converts back to a letter. The "mod 26" keeps the result inside the alphabet by wrapping around. Set your a and b keys in the tool above and the live formula line shows the exact function being applied, with the output updating as you type.
Decryption uses D(y) = a⁻¹(y − b) mod 26, where a⁻¹ is the modular multiplicative inverse of a (the number for which a · a⁻¹ ≡ 1 mod 26). For example, the inverse of 5 modulo 26 is 21, so a message encrypted with a = 5 is decrypted by multiplying by 21 after subtracting b. The Decode mode of the tool computes this inverse for you automatically.
Only the twelve numbers coprime to 26: 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, and 25. A value of a that shares a factor with 26 (like 2 or 13) has no modular inverse, so the message could not be decrypted uniquely. The tool only offers the valid values. The value of b has no such restriction and can be 0 through 25.
There are 312 possible keys: 12 valid values of a multiplied by 26 values of b. Discounting the trivial a = 1, b = 0 key that leaves text unchanged, there are 311 that actually scramble the message. This small keyspace is one of the reasons the cipher is easy to break by exhaustive search.
Use the auto-solver in the tool above. It decrypts your ciphertext with all 312 keys and ranks the results by how closely each matches normal English letter frequencies, then shows you the most likely plaintexts to choose from. This works because the keyspace is tiny and the cipher is vulnerable to frequency analysis.
No. With only 311 meaningful keys it falls instantly to a brute-force search, and as a monoalphabetic cipher it is also exposed to frequency analysis on any reasonably long message. It is valuable as a teaching tool for modular arithmetic and as a puzzle cipher, not for protecting real information.