Cipher Playground
Caesar/ROT, XOR, and Vigenère — the classic ciphers from the CTF zone.
Classical ciphers are useless for protecting anything today, which is exactly why they are worth playing with. They are simple enough to break by hand, so you can watch each idea — shifting, keying, combining — fail for reasons that still explain how modern cryptography is attacked.
How to use it
- Choose a cipher: Caesar/ROT shift, Vigenère with a keyword, or XOR with a key.
- Enter your key.
- Type into Input and press Encrypt ↓ or Decrypt ↑.
What to take away
Caesar has only 25 keys
You can break it by trying all of them, which is why key space size is the first thing to ask about any cipher.
Vigenère hides letter frequency — until it does not
It resists simple frequency analysis, but repeating the key means repeating patterns, and the key length can be recovered from those repeats. Reusing key material is still how real systems fall.
XOR is genuinely unbreakable, under conditions nobody meets
XOR with a truly random key as long as the message, used once, is a one-time pad and is provably secure. Reuse that key even twice and the messages leak each other. This is not history — it is the same flaw that broke WEP.
Frequently asked questions
What is ROT13?
A Caesar cipher with a shift of 13. Because the alphabet has 26 letters, applying it twice returns the original — which is why it survives as a way to hide spoilers, not secrets.
Are these ciphers safe to use for anything real?
No, and that is the point of the page. Every one of them is breakable by hand. For real work you want vetted modern algorithms in a library written by cryptographers.
Why do CTF challenges still use these?
Because recognising an encoding or a classical cipher quickly is a genuinely useful skill, and because they teach the reasoning — key space, frequency, reuse — that transfers to modern attacks.
Where this fits in the course
This security tool pairs with Path 19 — CTF Zone — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Diffie-Hellman Key Exchange Visualizer — Watch two sides land on the same shared secret without ever transmitting it, with small real numbers.
- Encoder / Decoder — Base64, URL, and Hex — encode or decode text both ways.
- Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
- Timing Attack Visualizer — See exactly why a naive string comparison leaks how many leading characters were correct — and why constant-time comparison fixes it.