Ciphers & Codes
The encoded message that is only a puzzle if the solver can tell it is one and can get inside it.
A cipher is the most recognisable puzzle in popular culture, and for that reason the easiest to get wrong. Strings of shifted letters, dot-and-dash patterns, grids of symbols: they read as “secret” on sight, which is exactly the trap. The recognisability does half the designer’s work and hides the other half. A cipher that any solver spots and decodes in seconds is a lock, not a puzzle. A cipher with no key in reach is a wall.
The craft is not in the cryptography. It is in the fit. The cipher has to match who is solving. The solver needs to tell that something is encoded and which something it is, with a way in that does not depend on knowledge they were never given. Get the fit right and the moment of recognition (this is Morse, this is Pigpen) is its own small reward, before the decoding even starts. Get it wrong and the cipher becomes the part of your puzzle that solvers resent.
This article is about choosing a cipher and deploying it fairly. The cipher is a subset of the verbal-faculty puzzles catalogued in A Taxonomy of Puzzles, and everything here rests on the contract set out in Cluing & Fairness: a solver who pays attention can get there from here.
The Mechanism (How it works)
Three questions before you pick a cipher
A cipher choice is not free. Before reaching for one, answer three questions, because each one changes which cipher is right.
The first is recognition. Working out that a thing is encoded, and which cipher it uses, is itself a puzzle step. For solvers new to ciphers, that recognition is most of the challenge and most of the satisfaction. Spotting the dot-dash rhythm of Morse or the boxed symbols of Pigpen, and then naming it, is the whole game. For seasoned puzzle-hunt solvers, recognition of the common ciphers is near-instant, so the encoding type is effectively a given and the challenge has to live in what the decoded text then demands. So the same cipher lands as a fair test for one audience and as filler for another. The recognition step is a form of cluing, and the indicators that drive it (covered below) are cluing in the sense of Cluing & Fairness: they have to point.
The second is tooling. A Vigenère cipher that takes thirty minutes by hand falls to under two minutes with an online identifier like Boxentriq or dCode. Paper-and-pencil solving with no internet is a different world from open-access online solving where automated cipher-identification tools are a tab away. In a live escape room phones are often confiscated; in an online hunt they are assumed. Decide which world your solvers are in, because it sets the real difficulty of every cipher you might choose. Run that check without flinching, because it is easy to fool yourself: if your solvers have phones, an online identifier will name the cipher and halve the difficulty you think you built, so the satisfying work has to live in what the plaintext demands next, not in the decode itself. The cipher you fell in love with for its elegance is often the one your solvers will meet through a cipher-identifier tab.
The third is role. Is the cipher the puzzle, or a gate in front of one? A cipher that demands forty minutes of cracking only to yield a three-word answer that merely feeds a separate puzzle is too expensive as a gate. The cost and the payoff are mismatched. Calibrate the cipher’s difficulty to the job it is doing. A cipher carrying the whole climactic challenge has room for a Vigenère; a cipher that is just the doorway should be cheap. So settle the job first and spend to match it. A gate to the real puzzle wants something cheap and recognisable. Put the difficulty into the recognition or the key-finding rather than into forty minutes of hand-decoding that buys three words. A climactic cipher keeps a Vigenère within budget. Even then its keyword needs a reason to exist. Make it recoverable from the theme or from an earlier answer, never a random string. The clue-versus-gate distinction itself belongs to Cluing & Fairness; here it sets the budget.
A working palette
There is no single right cipher, only a cipher that fits a particular audience, theme, and tooling context. The table below is the data-dense exception to this guide’s no-lists rule: it pairs common ciphers with the indicator that lets a solver recognise them and the audience they suit, then names the way each most often fails. Difficulty is given for hand-solving; assume an online identifier collapses most of it.
| Cipher | Solver-facing indicator | Best fit | Failure mode |
|---|---|---|---|
| Caesar / ROT13 | Short text, plausible letter frequencies, one fixed shift | Beginners, Roman themes, a cheap gate | Anticlimax: spotted and solved in seconds by anyone experienced |
| Atbash | Mirror substitution (A↔︎Z); frequency-analysable on any length | Biblical or historical flavour, a component | Trivial once named; almost no challenge alone |
| A1Z26 | Numbers all between 1 and 26 | A final extraction step, not a cipher in its own right | Too trivial as a standalone encoding |
| Pigpen | Distinctive boxed and dotted geometric symbols | Family or younger solvers, Masonic and historical themes | Mechanical once the grid is known; pure gate to experienced solvers |
| Polybius square | Two-digit number pairs, each digit 1 to 5 | Spy or telegraph themes, intermediate solvers | Multiple valid grids, so it needs the grid given or a standard assumed |
| Morse | Dots and dashes; iconic, lookup against a chart | Spy, military, maritime; strongest delivered as sound | A flat lookup task when shown as static dots on paper |
| Semaphore | Images of flag (or arm) positions | Nautical and military themes; high visual impact | Unrecognisable without a chart; the whole difficulty is recognition |
| Simple substitution | Scrambled but stable letter-for-letter mapping | Cryptography-themed events, intermediate solvers | Unsolvable on short text, where frequency analysis fails |
| Vigenère | Substitution that resists single-shift frequency analysis | Advanced, climactic cipher with a keyword to find | A pure barrier when the keyword is a random string with no hook |
| Book cipher | (page, line, word) triples pointing into a text | Spy, literary, treasure-hunt themes | Broken if the key text is undisclosed; unbreakable without it |
| Bacon’s cipher | Two typefaces or cases carrying a hidden 5-bit code | Advanced, academic and Elizabethan steganography themes | Invisible: solvers must first notice the text has hidden structure at all |
Two threads in that table are worth pulling out, because they show how a cipher’s difficulty actually works. A Vigenère is a Caesar cipher whose shift changes letter by letter under a repeating keyword, so the standard hand attack is to recover the keyword length first (the Kasiski examination spots repeated ciphertext sequences and factors the gaps between them; the index of coincidence confirms the guess by testing whether splitting the text at that length yields English-like letter frequencies), then frequency-analyse each position separately. That is a genuine boss-level challenge by hand and a two-minute job with tooling, which is the whole point of the tooling question. A Vigenère is most satisfying when the keyword means something, recoverable from the puzzle’s theme or another part of the chain, rather than a random string that turns the cipher into a flat barrier.
Bacon’s cipher pulls the opposite way. Francis Bacon’s biliteral scheme encodes each letter as a five-symbol sequence of two states, then hides those states in a carrier text using two typefaces, roman and italic, or two letter-cases, so the secret is not that the message is encrypted but that a message exists at all. Its difficulty is almost entirely in noticing that the typeface variation carries the message; once seen, the decoding is mechanical. That makes it the rare cipher that is fresh to nearly every audience, and also the one most able to slip past solvers entirely if nothing nudges them to look.
The indicator: telling solvers a cipher is there
A cipher is only fair if the solver can find their way to recognising it. The indicator is the signal that does that work, and it is where the cipher meets cluing. Some ciphers carry their own indicator in their surface form: Pigpen’s symbols, Morse’s dots and dashes, semaphore’s flag positions all announce that something is encoded and narrow down which. Others hide even the fact of encoding, which is precisely why Bacon’s cipher needs an external nudge and a substitution on a three-word fragment does not (a substitution at least looks like scrambled letters; Bacon’s looks like ordinary prose).
The designer’s job is to make the recognition step reachable without making it free. For a new audience, the cipher needs to be identifiable from inspection. The satisfaction then sits in the act of naming it before the decode even begins. An experienced audience sees through the common ciphers at once, so the challenge moves to unusual encodings (Bacon, Polybius, an odd semaphore variant) or to what the plaintext then demands. Either way the indicator must point, in exactly the sense that every clue must do work: an encoded message with no findable indicator is the obscure-without-recourse failure from Cluing & Fairness, wearing a cryptographic costume.
Theme is the most elegant indicator of all, because it does double duty. A Caesar cipher in a Roman setting, Pigpen in a Masonic lodge, semaphore on a ship, a book cipher in a spy story: the fiction itself tells the solver what kind of code to expect, so recognition flows from the world rather than from a bolted-on hint. A thematically motivated cipher is one of the surest signs you have chosen well.
When a cipher is cliché, and when that is fine
A cipher is cliché when its appearance produces no reaction beyond “oh, it’s Pigpen again.” The tells are consistent. The cipher is instantly recognisable and the decoding is mechanical. It is the entire puzzle rather than a component. The decoded text is already the final answer, with no further insight to extract, or the key is simply handed over with no challenge in finding it. When all four hold, the cipher is functioning as a lock, not a puzzle.
Cliché is not always wrong. A Pigpen cipher in an introductory set for ten-year-olds is well chosen; the same cipher as the climactic reveal in a competitive hunt is a let-down. Context and audience decide. The reliable fixes all push the cipher from lock back toward puzzle. Motivate it thematically. Make recognising the type part of the challenge, or require further work on the decoded message once it falls. Hide the key so that finding it is a puzzle step, or pick a cipher unusual enough to demand genuine thought. A book cipher is the clean illustration: retrieving the key text can itself be a link in the chain, which is the move that turns the meta-puzzle of Extraction, Indexing & Meta-Puzzles into the engine that delivers a cipher its key.
Ciphers across the media
In a live game or escape room, the cipher is usually a physical artefact such as a printed grid or a Caesar wheel, a slide rule, or a message hidden in a prop, and the tooling question turns on whether solvers have their phones. This is the cipher’s home ground, where the corpus on cipher selection lives.
At the high end sit the puzzle hunts, where the cipher stack runs all the way up to genuine modern cryptography. Cicada 3301, the self-concealing recruitment hunt that ran on 4 January in 2012, 2013 and 2014, layered classical ciphers (Caesar, Vigenère, Atbash) with steganography, prime-number mathematics, and a book cipher, and authenticated every genuine clue with a consistent OpenPGP key, so that learning PGP verification was itself a precondition for trusting any clue. That is the cipher pushed to its limit: not one encoding but a whole toolkit, where recognising which technique applies is the recurring puzzle. The book-cipher tradition it drew on is old and well documented, the Beale ciphers of 1885 being the canonical case, where the second of three messages was decoded against the Declaration of Independence and the other two remain unsolved and are widely thought to be a hoax.
Cicada 3301 is the cipher pushed to its structural extreme, and worth studying precisely because it breaks the rules a smaller puzzle cannot. Across three annual rounds it demanded competence in cryptography, classical literature, linguistics, and operational security at once. An OutGuess-hidden message on an image board led through PGP-signed clues and Mayan numerals. From there it ran through Welsh and Latin passages and on through GPS coordinates to physical QR codes posted on street corners across several continents, each pointing onward to a Tor hidden service. The recognition step (which technique is this clue using?) recurred at every stage, which is the cipher-selection problem turned into the entire game. It also shows the format’s hazard plainly. The 2014 Liber Primus remains only partly deciphered. A cipher that may or may not encode anything sits exactly on the line between an unsolved puzzle and a puzzle with no answer.
Interactive fiction inherits the cipher as an in-text puzzle rather than a printed artefact, and here the governing constraint shifts from the craftsmanship of the object to fairness inside normal play. The standard IF fairness test holds that an ideally perceptive player wins on a first attempt without recourse to saved games. So every fact a cipher demands must be discoverable in play and never reliant on outside knowledge or trial-and-error reloads. A cipher keyed on a visual pun or an obscure reference is the classic IF failure. An inside joke fails the same way. The game can stall out into a dead end whenever that familiarity is the only route to the answer. The structural defence is Mike Roberts’ old IF rule. It is usually quoted as the idea that the player should always be able to find a locked door before the key. The solver should meet the encrypted text before being expected to produce the decoding. That way the cipher motivates exploration instead of blocking it. The exemplary fair pattern is the substitution code in the game Avon, which is insoluble in full but allows partial deductions, just enough to solve the immediate problem, so a stuck player can still progress on a fragment without ever fully breaking the cipher. Decipherment and constructed-language puzzles are an established IF tradition on the same principle, from the invented Nalian language of Edifice to the hieroglyphics of Infidel. What digital IF can offer that a printed artefact cannot is an in-fiction decoding helper. This might be a found cipher key or a partial-decode command, perhaps backed by an optional hint tier. The fairness literature implies it usually should, because gating progress on a fully manual break is the cipher equivalent of the unfair locked door.
The tabletop is the one place a cipher does not naturally belong. A cipher is a solver-facing encoding problem, not a board-and-table mechanism, so where investigation reaches a table it is carried by the redundant clue trails of Cluing & Fairness rather than by a code to break. A printed cipher can be handed to players as a prop, but at that point it is a live-game artefact resting on the table rather than a tabletop mechanism.
The cipher-as-unfair-gate is the failure that ends runs. It arrives two ways. The first is the missing key. A cipher whose decoding needs some fact or chart, or a book the solver was never given and cannot find, is the obscure-without-recourse failure dressed in cryptography. A book cipher with an undisclosed key text is simply a broken puzzle. The second is the wall of ciphertext. A long encrypted block that has to be fully broken before anything moves, with no partial progress possible, traps the solver. The IF tradition has the cleaner answer here than the live-game one. Let the solver make partial deductions and break only the fragment the immediate problem needs, so a stuck solver still inches forward. When your playtest notes say a solver “just had to crack it,” check whether they had a route in that let them win on a fragment. A cipher that only opens at full break is a wall, however handsome the code.
Where this fits
The bigger picture. A cipher is a narrow, recognisable species within the verbal-faculty puzzles of A Taxonomy of Puzzles, and it is unusual in carrying its own reputation: solvers arrive with expectations a cipher either honours or disappoints. Everything that makes a cipher work is a special case of fairness. The indicator that lets a solver recognise the encoding is cluing; the question of whether the cipher is a clue or a gate is the clue-versus-gate line; the missing-key failure is obscure-without-recourse. So a cipher is best understood not as a cryptographic object but as a fairness problem with a cryptographic surface, one that depends utterly on Cluing & Fairness and adds little if that contract is broken.
Next steps. Once the cipher is chosen and fair, the craft turns to its place in the chain. If the cipher’s output feeds an answer or its key is recovered from elsewhere, that wiring is Extraction, Indexing & Meta-Puzzles. If recognising the cipher type is the moment you are designing toward, the payoff you are engineering is The Aha Moment. When fair solvers still stall on a cipher in a way no redesign will fix, the graceful exit is Hint Systems & Recovery. And where the cipher lives as a physical instrument on the table (a Caesar wheel, a grille, a printed grid), its making belongs to Artefact Design & Document Production.
Referenced by
- A Taxonomy of Puzzles
- Artefact Design & Document Production
- Cicada 3301
- Extraction, Indexing & Meta-Puzzles