How does a running-key cipher differ from Vigenère?

Standard Vigenère repeats a short keyword, which creates a period a cryptanalyst can find. The running-key cipher draws its key from a long text passage, so the key is as long as the message and has no repeating period.

How long must the key passage be?

It must contain at least as many letters as your message. If the passage runs out, the tool leaves the remaining message letters unchanged and warns you how many extra key letters are needed.

Do spaces and punctuation in the key matter?

No. Only the letters of the key passage are used; spaces, punctuation and digits are skipped. Likewise, non-letter characters in the message pass through and do not consume key letters.

Is the running-key cipher unbreakable like a one-time pad?

No. A one-time pad uses a truly random key once. A running key uses natural-language text, which has statistical structure, so techniques that exploit the redundancy of both message and key can break it.

Why must I keep the exact key passage to decrypt?

Decryption subtracts the same key letters that encryption added. Even a one-character difference in the passage — including punctuation that shifts the letter alignment — will corrupt the recovered text from that point on.

What is the Running Key Cipher Encoder & Decoder?

Free running-key cipher tool — a Vigenère cipher that draws its key from a long passage of text instead of a repeating word, so the key never repeats. Encrypt and decrypt in your browser, no upload. It runs free in your browser on Gera Tools, with nothing uploaded.

Running Key Cipher Encoder & Decoder

Name: Running Key Cipher Encoder & Decoder
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

The running-key cipher is a polyalphabetic substitution cipher that works like the Vigenère cipher but takes its key from a long stretch of text — classically a passage from an agreed book — rather than repeating a short keyword. Because the key is as long as the message and never repeats, it removes the periodic structure that makes ordinary Vigenère vulnerable to Kasiski analysis.

How it works

Letters are numbered 0 (A) through 25 (Z). The letters of the key passage are lined up beneath the message, one key letter per message letter. Encryption adds them modulo 26:

C = (P + K) mod 26

Decryption subtracts the same key letters:

P = (C - K) mod 26

Only letters in the key passage are used; its spaces and punctuation are skipped. In the message, non-letter characters pass through unchanged and do not consume a key letter, so the alignment between message letters and key letters is preserved.

Worked example

With key passage KING and plaintext MEET:

P:  M  E  E  T   (values: 12, 4, 4, 19)
K:  K  I  N  G   (values: 10, 8, 13, 6)
C:  W  M  R  Z   (results: 22, 12, 17, 25)

M (12) plus K (10) = 22 → W. E (4) plus I (8) = 12 → M. And so on. Decrypting WMRZ with the same key passage subtracts each key letter modulo 26 to recover MEET.

Why the running-key cipher is interesting but not secure

The cipher solves Vigenère’s periodic key problem — Kasiski analysis fails because the key never repeats. However, it introduces a different weakness: both the message and the key are natural language, and natural language is heavily non-random. This redundancy makes the cipher vulnerable to a probabilistic attack that tries candidate key passages and scores the resulting plaintexts by their plausibility as English text.

In practice, an attacker who knows the plaintext is English can work backward: for each possible ciphertext letter, only one key letter produces a valid plaintext letter, and many of those pairs are uncommon in natural language. Combining constraints across multiple letters narrows the candidate key passages quickly. This attack requires significant effort but is much easier than breaking a true one-time pad, which is completely information-theoretically secure.

Agreement requirements

Sender and receiver must agree on:

The exact source text — typically a specific edition of a book or a memorised poem.
The starting position — which character in the text to begin from.
Non-letter handling — whether digits and punctuation are stripped or passed through. This tool skips non-letters in the key and passes them through unchanged in the message.

A single discrepancy in the source text — different editions can have different punctuation — causes decryption to diverge from the correct point onward, corrupting the recovered message. This fragility is one reason the cipher was historically impractical for long-distance communication.