What is the Hill cipher?
The Hill cipher, invented by Lester S. Hill in 1929, encrypts blocks of letters instead of single letters. A message is cut into blocks of n letters, each block becomes a column vector of numbers (A = 0, …, Z = 25), and the vector is multiplied by an n × n key matrix K with all arithmetic done modulo 26. It was the first cipher that used linear algebra in a practical way.
Because every cipher letter depends on all n letters of the block, the cipher hides the frequencies of single letters much better than a Caesar or affine cipher.
Encryption step by step
Encryption is C = K · P mod 26. Take the key K = [[3, 3], [2, 5]] and the message HELP. The first block HE is the vector (7, 4). Then 3·7 + 3·4 = 33 ≡ 7 (H) and 2·7 + 5·4 = 34 ≡ 8 (I), so HE becomes HI. The second block LP is (11, 15), giving 3·11 + 3·15 = 78 ≡ 0 (A) and 2·11 + 5·15 = 97 ≡ 19 (T). The ciphertext is HIAT.
If the number of letters is not a multiple of n, the last block is filled with the letter X (23), which is the usual textbook convention.
Decryption and the inverse key
To decrypt you need the inverse matrix modulo 26: P = K⁻¹ · C mod 26 with K⁻¹ = det(K)⁻¹ · adj(K) mod 26. This exists only if gcd(det(K), 26) = 1, that is, det(K) is odd and not a multiple of 13. If the determinant shares a factor with 26, different plaintext blocks can give the same ciphertext and the message cannot be recovered.
For K = [[3, 3], [2, 5]] the determinant is 3·5 − 3·2 = 9. The inverse of 9 modulo 26 is 3, because 9·3 = 27 ≡ 1. The adjugate is [[5, −3], [−2, 3]], so K⁻¹ = 3·[[5, −3], [−2, 3]] = [[15, −9], [−6, 9]] ≡ [[15, 17], [20, 9]] (mod 26). Multiplying back, K · K⁻¹ ≡ I.
Strengths and weaknesses
The Hill cipher is linear, and that is its weakness. An attacker who knows n blocks of plaintext and the matching ciphertext can solve for the key matrix with ordinary linear algebra modulo 26. It is therefore a useful classroom example of matrices over modular arithmetic, not a secure cipher.
Worked examples
These examples are computed by the same engine as the calculator above, so you can compare each step with your own working.
2×2 key, HELP
- Mode:
Encrypt - Key matrix K:
[[3, 3], [2, 5]] - Text:
HELP
Ciphertext
HIAT
2 blocks of 2
Convention: spaces, digits and punctuation are removed and the output is upper-case letters only, as in most textbook examples.
Step-by-step solution
Formula used
C = K · P (mod 26)
P and C are column vectors of n letters (A = 0, …, Z = 25); the key K must satisfy gcd(det(K), 26) = 1
NoteTurn the text into number blocks
A = 0, B = 1, …, Z = 25. Only the letters are used (4 letters found).
The key is 2×2, so the letters are cut into blocks of 2. No padding is needed.
CheckCheck that the key is invertible modulo 26
det(K) = 3·5 − 3·2 = 9
det(K) = 3·5 − 3·2 = 9
det(K) mod 26 = 9
gcd(9, 26) = 1 ✓ → K has an inverse modulo 26
det(K)⁻¹ mod 26 = 3 (9 · 3 = 27 ≡ 1 mod 26)
K =3325
CalculateMultiply each block by K
C = K · P (mod 26)
K (mod 26) =3325
| Block | Letters | Vector | K · vector | mod 26 | Result |
|---|
| 1 | HE | (7, 4) | (33, 34) | (7, 8) | HI |
| 2 | LP | (11, 15) | (78, 97) | (0, 19) | AT |
CheckVerify by reversing
Decrypting the result with the same key gives back HELP: ✓ yes
ResultCiphertext
HIAT
Decrypt HIAT
- Mode:
Decrypt - Key matrix K:
[[3, 3], [2, 5]] - Text:
HIAT
Plaintext
HELP
2 blocks of 2
Convention: spaces, digits and punctuation are removed and the output is upper-case letters only, as in most textbook examples.
Step-by-step solution
Formula used
P = K⁻¹ · C (mod 26), K⁻¹ = det(K)⁻¹ · adj(K) mod 26
Needs gcd(det(K), 26) = 1
NoteTurn the text into number blocks
A = 0, B = 1, …, Z = 25. Only the letters are used (4 letters found).
The key is 2×2, so the letters are cut into blocks of 2. No padding is needed.
CheckCheck that the key is invertible modulo 26
det(K) = 3·5 − 3·2 = 9
det(K) = 3·5 − 3·2 = 9
det(K) mod 26 = 9
gcd(9, 26) = 1 ✓ → K has an inverse modulo 26
det(K)⁻¹ mod 26 = 3 (9 · 3 = 27 ≡ 1 mod 26)
K =3325
CalculateCompute the key inverse K⁻¹ mod 26
K⁻¹ = det(K)⁻¹ · adj(K) (mod 26)
adj(K) is the transpose of the cofactor matrix.
K⁻¹ = 3 · adj(K) mod 26, entry by entry (negative entries are reduced mod 26).
Check: K · K⁻¹ mod 26 = I ✓
adj(K) =5−3−23K⁻¹ =1517209
CalculateMultiply each block by K⁻¹
P = K⁻¹ · C (mod 26)
K⁻¹ =1517209
| Block | Letters | Vector | K⁻¹ · vector | mod 26 | Result |
|---|
| 1 | HI | (7, 8) | (241, 212) | (7, 4) | HE |
| 2 | AT | (0, 19) | (323, 171) | (11, 15) | LP |
CheckVerify by reversing
Encrypting the result with the same key gives back HIAT: ✓ yes
ResultPlaintext
HELP
3×3 key, ACT
- Mode:
Encrypt - Key matrix K:
[[6, 24, 1], [13, 16, 10], [20, 17, 15]] - Text:
ACT
Ciphertext
POH
1 block of 3
Convention: spaces, digits and punctuation are removed and the output is upper-case letters only, as in most textbook examples.
Step-by-step solution
Formula used
C = K · P (mod 26)
P and C are column vectors of n letters (A = 0, …, Z = 25); the key K must satisfy gcd(det(K), 26) = 1
NoteTurn the text into number blocks
A = 0, B = 1, …, Z = 25. Only the letters are used (3 letters found).
The key is 3×3, so the letters are cut into blocks of 3. No padding is needed.
CheckCheck that the key is invertible modulo 26
det(K) = 441 (cofactor expansion along row 1)
det(K) = 441 (cofactor expansion along row 1)
det(K) mod 26 = 25
gcd(25, 26) = 1 ✓ → K has an inverse modulo 26
det(K)⁻¹ mod 26 = 25 (25 · 25 = 625 ≡ 1 mod 26)
K =6241131610201715
CalculateMultiply each block by K
C = K · P (mod 26)
K (mod 26) =6241131610201715
| Block | Letters | Vector | K · vector | mod 26 | Result |
|---|
| 1 | ACT | (0, 2, 19) | (67, 222, 319) | (15, 14, 7) | POH |
CheckVerify by reversing
Decrypting the result with the same key gives back ACT: ✓ yes
ResultCiphertext
POH
Frequently asked questions
Why must the determinant be coprime to 26?
Decryption needs the inverse of the key matrix modulo 26, and that inverse requires dividing by the determinant. Division modulo 26 is only possible when the determinant has no common factor with 26, i.e. it is odd and not divisible by 13.
What happens to spaces and punctuation?
This calculator removes everything except the letters A to Z and returns upper-case letters, which is the usual textbook convention. Keep the original spacing in your own notes if you need it.
What if the message length is not a multiple of the block size?
The last block is padded with the letter X. When you decrypt, the padding appears as trailing X characters that you can drop.
Which key sizes does the calculator support?
It supports 2×2 and 3×3 keys with integer entries. Entries can be negative or larger than 25; they are reduced modulo 26.
Is the Hill cipher secure?
No. It falls to a known-plaintext attack because the encryption is linear. It is taught because it shows how matrices and modular inverses are used in cryptography.