Hill Cipher

Hill Cipher

The first cipher to encrypt several letters at once. Blocks of n letters become a vector, multiplied by an n×n key matrix mod 26 — so changing one letter changes the whole block, and single-letter frequency analysis stops working.

2×2 and 3×3 matrices

Determinant and inverse mod 26

Block-by-block working

Live

Encrypting Several Letters at Once

C = K P mod 26 P = K^-1 C mod 26

Split the message into blocks of n letters and treat each as a column vector of numbers 0–25. Multiply by the key matrix K modulo 26 to get the ciphertext block.

Because every output letter depends on all n input letters, a single letter of plaintext no longer maps to a single letter of ciphertext. That is diffusion, and it is what breaks single-letter frequency analysis.

Decryption multiplies by K⁻¹ mod 26, which exists only when gcd(det K, 26) = 1 — the same coprimality condition as the affine cipher, now applied to the determinant.

For a 2×2 matrix, K⁻¹ = (det K)⁻¹ · [[d, −b], [−c, a]] mod 26. The adjugate is easy; the only real work is inverting the determinant.

Strong Against Counting, Weak Against Algebra

Lester Hill published this in 1929, and it was genuinely ahead of its time — the first practical cipher operating on blocks rather than single letters.

It defeats letter frequencies. With n = 3 you would need trigram statistics over 26³ = 17,576 blocks to attack it the classical way.
But it is linear. That is fatal. The cipher is just matrix multiplication, so it falls completely to a known-plaintext attack: collect n independent plaintext/ciphertext blocks, assemble them into matrices P and C, and solve K = C P⁻¹ mod 26.
No searching required. Three known blocks break a 3×3 Hill cipher outright — there is no brute force and no statistics, just linear algebra.

This is why every modern block cipher is deliberately non-linear. AES's S-box exists precisely to stop an attacker writing the cipher as a solvable system of linear equations.

Matrices mod 26 giving you trouble?