Autokey Cipher: When the Message Becomes the Key

The Autokey cipher begins like Vigenère. It uses a keyword, turns letters into numbers, adds plaintext and key letters together, and works modulo 26. But then it does something clever: instead of repeating the keyword forever, the Autokey cipher extends the key using the message itself.

A normal Vigenère cipher might use a repeated key like this:

Autokey starts the same way, but then changes direction:

The keyword QUEENLY starts the process. Then the plaintext begins to supply the rest of the key. That is the central idea.

Autokey is a polyalphabetic substitution cipher, but unlike ordinary repeated-key Vigenère, its keystream does not simply cycle back to the beginning of the keyword again and again. It feeds the message into the cipher. That makes it less periodic than Vigenère, but it also makes decryption more delicate, because the receiver must rebuild the keystream as plaintext letters are recovered.

Autokey is not secure by modern standards. It remains a classical cipher, vulnerable to known-plaintext attacks, crib-based attacks, and statistical reasoning. But as a teaching cipher, it is excellent. It shows the reader what happens when a cipher tries to fix one weakness, repetition, by introducing feedback.

That is why Autokey matters: not because it is strong today, but because it shows the moment when the key stops being merely repeated and starts being generated.

Autokey cipher at a glance

The Autokey cipher is often described as a Vigenère variant. The ordinary Vigenère family uses several monoalphabetic substitutions selected by a key, rather than one fixed substitution alphabet, which is why it belongs to the broader class of polyalphabetic ciphers.

Autokey keeps the Vigenère-style formula:

C = (P + K) mod 26

But it changes where the key comes from.

That change is the whole cipher.

What is the Autokey cipher?

The Autokey cipher is a classical polyalphabetic substitution cipher.

It encrypts each plaintext letter using a key letter, but the key does not simply repeat. Instead, the keystream begins with a shared keyword and then continues with letters from the plaintext itself.

For example, suppose the starting keyword is:

QUEENLY

and the plaintext is:

ATTACKATDAWN

The keystream becomes:

QUEENLYATTAC

Why?

Because the first seven key letters come from the keyword:

QUEENLY

After that, the key is extended using the plaintext:

ATTAC...

So the full alignment is:

This is why it is called Autokey. The cipher begins with a key, then automatically generates more key material from the message.

This makes it different from repeated-key Vigenère.

Vigenère repeats the keyword:

QUEENLYQUEEN

Autokey extends it with plaintext:

QUEENLYATTAC

That means Autokey reduces the obvious repeated-key pattern that makes ordinary Vigenère easier to attack.

But it also introduces a new dependency.

During decryption, once the starting keyword has been used, the receiver needs recovered plaintext letters to continue rebuilding the key.

So Autokey is not reciprocal. Encryption and decryption are not the same process.

The Autokey tool describes this exactly: Autokey starts with a keyword, extends the keystream using plaintext letters, encrypts with C = P + K mod 26, and during decryption must rebuild the key from recovered plaintext.

How Autokey works

The Autokey cipher uses the usual alphabet numbering:

The encryption formula is:

C = (P + K) mod 26

The arithmetic is the same as Vigenère encryption.

The difference is the keystream.

In ordinary Vigenère, the keyword repeats. In Autokey, the keyword starts the keystream, then the plaintext continues it.

Take a tiny example.

Plaintext letter:

A

A = 0.

Key letter:

Q

Q = 16.

Apply the formula:

C = (P + K) mod 26
C = (0 + 16) mod 26
C = 16

16 = Q, so:

A with Q becomes Q

That is the first mapping shown in the Autokey tool when the keyword is QUEENLY.

Now try the second letter.

Plaintext:

T

T = 19.

Key:

U

U = 20.

So:

C = (19 + 20) mod 26
C = 39 mod 26
C = 13

13 = N, so:

T with U becomes N

That is the Autokey cipher at letter level. Plaintext number plus key number. Wrap around the alphabet. Convert back to a letter.

The special part is not the addition. The special part is how the later key letters are produced.

Key and rules

The Autokey cipher has a starting keyword.

For example:

QUEENLY

But the keyword is only the beginning. Once the keyword has been used, the plaintext itself extends the keystream.

Using:

Plaintext: ATTACKATDAWN
Keyword: QUEENLY

the keystream becomes:

QUEENLYATTAC

That gives this alignment:

The main rules are:

The rule about key advancement matters.

If the message is written with spaces:

ATTACK AT DAWN

the letter stream is usually treated as:

ATTACKATDAWN

The space does not consume a key letter. That is why the tool can preserve punctuation and numbers for readability while still treating the letter stream separately.

This is practical for a web tool. A user can type a normal phrase with spaces and punctuation, while the cipher still operates on the letters.

Classical ciphertext may be grouped into blocks of five:

QNXEP VYTWT WP

That looks more traditional and hides word lengths better. But grouping is only formatting.

The underlying cipher is unchanged.

Worked example: ATTACKATDAWN with QUEENLY

Now encrypt:

ATTACKATDAWN

using the keyword:

QUEENLY

First, write the plaintext:

Now build the keystream.

The keyword is:

QUEENLY

That gives the first seven key letters:

After that, use the plaintext itself.

Plaintext begins:

ATTACKATDAWN

After the keyword has supplied seven letters, the next key letters are taken from the beginning of the plaintext:

A T T A C...

So the full keystream for this example is:

Now convert letters to numbers.

Put the ciphertext letters together:

QNXEPVYTWTWP

So:

ATTACKATDAWN -> QNXEPVYTWTWP

using the keyword:

QUEENLY

This is the example used in the Autokey tool.

The important thing is the keystream:

QUEENLYATTAC

It starts as a keyword. Then it becomes the message.

That is the Autokey idea.

The keystream is the real trick

The encryption formula:

C = (P + K) mod 26

is not unusual. That is the same basic addition used in Vigenère.

The interesting part is the keystream.

Compare the two systems using the same keyword:

QUEENLY

and the same plaintext:

ATTACKATDAWN

Repeated-key Vigenère

Here the keyword repeats:

QUEENLYQUEEN

That repetition is useful to the receiver, but dangerous cryptographically. If the key repeats, the ciphertext has periodic structure.

Autokey

Here the keystream is:

QUEENLYATTAC

The repeated keyword pattern is gone.

This was the purpose of Autokey: reduce the obvious periodic weakness of repeated-key Vigenère.

But it does not make the cipher modern or secure.

It trades one kind of structure for another. Instead of repeating the keyword, the cipher embeds the plaintext into the future key.

That is clever. It is also dangerous.

If an attacker can guess plaintext, they can begin to reconstruct the key stream.

Decryption: rebuilding the key as you go

Autokey decryption is more delicate than encryption.

Encryption is straightforward because the sender already knows the whole plaintext. That means the sender can build the full keystream easily:

keyword + plaintext

The receiver does not begin with the plaintext.

The receiver begins with the ciphertext and the starting keyword.

So decryption must recover the plaintext gradually.

The decryption formula is:

P = (C - K) mod 26

This is the usual Vigenère-style subtraction.

But after the starting keyword runs out, the key letters must come from plaintext letters that have just been recovered.

That gives Autokey a feedback structure.

Let us decrypt:

QNXEPVYTWTWP

with the keyword:

QUEENLY

The first seven key letters are known:

Q U E E N L Y

Use them to decrypt the first seven ciphertext letters.

The recovered plaintext so far is:

ATTACKA

Now the starting keyword has been used. The next key letters come from the recovered plaintext.

The next key letter is the first plaintext letter:

A

So decrypt the eighth ciphertext letter:

Ciphertext: T = 19
Key: A = 0
P = (19 - 0) mod 26
P = 19

19 = T.

Now the plaintext is:

ATTACKAT

The next key letter is the second plaintext letter:

T

That lets the receiver decrypt the next ciphertext letter. This process continues until the whole message is recovered.

So:

QNXEPVYTWTWP -> ATTACKATDAWN

The key point is this:

Autokey decryption is sequential.

You cannot freely decrypt every letter independently, because later key letters depend on earlier recovered plaintext.

That is why the tool notes that Autokey is not reciprocal and that decrypt mode rebuilds the keystream from recovered plaintext.

History and origin

The Autokey cipher is closely tied to the history of the Vigenère family of ciphers.

The ordinary "Vigenère cipher" name is historically messy. The cipher commonly called Vigenère is often credited in modern accounts to Giovan Battista Bellaso, while Blaise de Vigenère later described a related and more ambitious system.

The Autokey idea is where Vigenère's own contribution becomes especially important.

Autokey systems incorporate the message into the key. One common form places a short primer key at the beginning and then extends the key with plaintext; this is the text-autokey form.

That distinction is worth preserving.

The cipher most people call "Vigenère" is a repeated-key polyalphabetic cipher. The Autokey cipher is a more ambitious version of the idea.

It tries to avoid the simple periodic repetition of a short keyword by letting the message extend the keystream.

That makes Autokey historically interesting.

It shows that cryptographers were not merely inventing alphabet tricks. They were thinking about pattern, repetition, key management, and how to make a cipher less predictable.

Autokey is not modern encryption. But it is a step toward a more serious idea:

A cipher is not only about substituting letters. It is about generating the sequence of transformations used to hide them.

Why Autokey was useful

The Autokey cipher was useful because it addressed a real weakness in repeated-key Vigenère.

A repeated keyword creates periodic structure.

If the keyword has length 7, then every 7th letter is encrypted with the same key position. Given enough ciphertext, that repetition can be detected and exploited.

Autokey tries to disrupt this.

Instead of:

QUEENLYQUEENLYQUEENLY

it uses something like:

QUEENLYATTACKATDAWN...

That removes the simple keyword cycle.

The advantages are:

Autokey is also useful as a programming example. It forces the programmer to think carefully about the difference between encryption and decryption.

Encryption can build the full keystream immediately. Decryption must rebuild it gradually.

That is a subtle but important distinction.

It is one of the reasons Autokey is a good teaching cipher. It looks like Vigenère at first. Then the feedback loop appears.

Weaknesses and limitations

The Autokey cipher is clever, but it is still weak.

It removes simple keyword repetition, but it does not remove the statistical structure of language.

In fact, it brings the plaintext directly into the keystream. That creates serious weaknesses.

The main limitations are:

A repeated-key Vigenère cipher leaks key periodicity. Autokey tries to fix that.

But the fix introduces a different kind of leakage.

The later key is not random. It is the plaintext. And plaintext has structure.

English has letter frequencies, common digraphs, common words, predictable openings, repeated phrases, and grammatical patterns.

So Autokey should be understood as a clever historical improvement, not as a secure system.

It is harder than simple Vigenère in some ways. It is still breakable.

How Autokey is broken

A useful way to attack Autokey is to look for likely plaintext.

In cryptanalysis, a guessed piece of plaintext is often called a crib.

Examples might include:

ATTACK
THE
MEET
FROM
DEAR
DAWN
WEATHER
REPORT
COMMAND
MESSAGE

If an attacker guesses part of the plaintext, they can compare it with the ciphertext to recover the corresponding keystream.

The encryption formula is:

C = (P + K) mod 26

Rearrange it:

K = (C - P) mod 26

That means if the attacker knows or guesses P, and has C, they can calculate K.

For example, suppose the attacker sees the ciphertext:

QNXEPV

and guesses the plaintext might be:

ATTACK

Write the plaintext and ciphertext as numbers:

Now use:

K = (C - P) mod 26

The recovered key fragment is:

QUEENL

That strongly suggests the keyword may begin:

QUEENLY

A small guessed plaintext fragment has revealed most of the starting keyword.

This is the danger.

Autokey hides repeated keyword patterns, but it is sensitive to known or guessed plaintext.

Once part of the key or plaintext becomes known, more may follow. The decryption feedback loop that makes Autokey interesting can also help an attacker extend a partial solution.

Autokey is therefore a good example of a recurring cryptographic lesson:

Removing one pattern does not automatically make a cipher secure. You have to ask what new structure has been introduced.

Autokey vs Vigenère

Autokey is easiest to understand by comparing it directly with Vigenère.

Both use the same encryption formula:

C = (P + K) mod 26

But they build the key differently.

Vigenère is simpler to use because the key is predictable once the keyword is known.

Autokey is more subtle because the key changes according to the message.

That is both its strength and its weakness.

It is a better attempt to avoid repetition. It is also more fragile during decryption.

A mistake in one recovered plaintext letter can affect later key letters.

That makes Autokey an excellent cipher for showing how encryption systems can have internal dependency.

Related ciphers and comparisons

Autokey belongs to the Vigenère family, but it points toward broader ideas about keystream generation.

The running key cipher is especially close in spirit.

Instead of extending the key with the plaintext, a running key cipher uses a long passage of text, such as a book passage, as the keystream.

That avoids short-key repetition, but it still uses language-like material as the key. Language is not random. It has structure.

The one-time pad goes much further.

It requires a truly random key that is as long as the message and never reused. When used correctly, that is a completely different security level.

Autokey is not that. Autokey's key extension comes from the plaintext, not from true randomness.

So Autokey is historically clever, but cryptographically limited.

Where Autokey appears today

The Autokey cipher is less famous in popular culture than Caesar, Atbash, Morse code, binary, or A1Z26.

Those systems are more visually immediate. They work well in puzzle books, escape rooms, ARGs, geocaching clues, and visible cipher culture because the reader can often see the pattern quickly.

Autokey is more subtle.

It needs a keyword, letter-to-number conversion, modular arithmetic, keystream construction, and different encryption and decryption procedures.

That makes it less likely to appear as a quick background clue on screen.

But it is still common in online cipher tools, recreational cryptography, programming exercises, classical cryptography lessons, Vigenère-family explanations, puzzle hunts, codebreaking practice, and discussions of historical cipher improvement.

Its modern value is educational.

Autokey teaches a concept that remains important far beyond classical ciphers:

Where does the keystream come from?

That question matters in many encryption systems.

A cipher is not only its formula. It is also its key schedule, feedback behaviour, randomness, and error propagation.

Autokey lets a beginner see those ideas in a small, hand-workable form.

A simple Python Autokey cipher

The Autokey cipher is a good programming example because encryption and decryption are different enough to be interesting.

Encryption can build the full keystream immediately:

keyword + plaintext

Decryption must rebuild the keystream gradually from recovered plaintext.

The code below:

1. encrypts with Autokey;
2. decrypts with Autokey;
3. preserves spaces and punctuation;
4. preserves uppercase and lowercase style;
5. advances the key only when a letter is processed;
6. demonstrates the example ATTACKATDAWN -> QNXEPVYTWTWP using QUEENLY.

ALPHABET_SIZE = 26


def clean_key(key):
    """
    Keep only letters from the keyword and convert them to uppercase.
    Autokey needs at least one usable keyword letter.
    """
    cleaned = ""

    for char in key:
        if char.isalpha():
            cleaned += char.upper()

    if cleaned == "":
        raise ValueError("Keyword must contain at least one letter.")

    return cleaned


def letter_to_number(char):
    """
    Convert A-Z to 0-25.
    """
    return ord(char.upper()) - ord("A")


def number_to_letter(number, uppercase=True):
    """
    Convert 0-25 back to a letter.
    """
    if uppercase:
        base = ord("A")
    else:
        base = ord("a")

    return chr(base + number)


def autokey_encrypt(text, keyword):
    """
    Encrypt text using the plaintext-autokey cipher.

    Keystream:
        keyword + plaintext letters

    Formula:
        C = (P + K) mod 26
    """
    keyword = clean_key(keyword)

    output = []
    plaintext_letters = []
    key_index = 0

    for char in text:
        if char.isalpha():
            uppercase = char.isupper()

            p = letter_to_number(char)

            if key_index < len(keyword):
                key_char = keyword[key_index]
            else:
                # After the keyword, use earlier plaintext letters.
                plaintext_index = key_index - len(keyword)
                key_char = plaintext_letters[plaintext_index]

            k = letter_to_number(key_char)

            c = (p + k) % ALPHABET_SIZE

            output.append(number_to_letter(c, uppercase))
            plaintext_letters.append(char.upper())

            key_index += 1
        else:
            output.append(char)

    return "".join(output)


def autokey_decrypt(text, keyword):
    """
    Decrypt text using the plaintext-autokey cipher.

    The key begins with the keyword, then continues with recovered plaintext.

    Formula:
        P = (C - K) mod 26
    """
    keyword = clean_key(keyword)

    output = []
    recovered_plaintext = []
    key_index = 0

    for char in text:
        if char.isalpha():
            uppercase = char.isupper()

            c = letter_to_number(char)

            if key_index < len(keyword):
                key_char = keyword[key_index]
            else:
                # After the keyword, use plaintext recovered so far.
                plaintext_index = key_index - len(keyword)
                key_char = recovered_plaintext[plaintext_index]

            k = letter_to_number(key_char)

            p = (c - k) % ALPHABET_SIZE
            plain_char = number_to_letter(p, uppercase)

            output.append(plain_char)
            recovered_plaintext.append(plain_char.upper())

            key_index += 1
        else:
            output.append(char)

    return "".join(output)


# Example
plaintext = "ATTACKATDAWN"
keyword = "QUEENLY"

ciphertext = autokey_encrypt(plaintext, keyword)
decrypted = autokey_decrypt(ciphertext, keyword)

print("Plaintext :", plaintext)
print("Keyword   :", keyword)
print("Encrypted :", ciphertext)
print("Decrypted :", decrypted)

Expected output:

Plaintext : ATTACKATDAWN
Keyword   : QUEENLY
Encrypted : QNXEPVYTWTWP
Decrypted : ATTACKATDAWN

The encryption formula appears here:

c = (p + k) % ALPHABET_SIZE

That is:

C = (P + K) mod 26

The decryption formula appears here:

p = (c - k) % ALPHABET_SIZE

That is:

P = (C - K) mod 26

The most important difference is not the arithmetic. It is how the key is built.

During encryption, the code can use the plaintext directly:

plaintext_letters.append(char.upper())

During decryption, the code must use plaintext only after it has been recovered:

recovered_plaintext.append(plain_char.upper())

That is Autokey in programming form.

Encryption knows the message already. Decryption has to rediscover it one letter at a time.

Reading the code like the cipher

The code follows the same logic as the cipher.

First, it cleans the keyword:

keyword = clean_key(keyword)

This means a keyword such as:

Queenly!

becomes:

QUEENLY

Then, during encryption, the code processes the text one character at a time.

If the current character is a letter, it is converted to a number:

p = letter_to_number(char)

Then the code chooses the key character.

If the keyword still has unused letters, it uses the keyword:

if key_index < len(keyword):
    key_char = keyword[key_index]

Once the keyword has run out, it uses earlier plaintext:

plaintext_index = key_index - len(keyword)
key_char = plaintext_letters[plaintext_index]

That is the Autokey extension. The plaintext becomes the following key.

Then the cipher applies:

c = (p + k) % ALPHABET_SIZE

This gives the ciphertext number.

Decryption is similar, but more sensitive.

It cannot use the original plaintext because it does not have it yet. So it stores plaintext as it recovers it:

recovered_plaintext.append(plain_char.upper())

That recovered plaintext then becomes the later key material.

This is why Autokey decryption must be done in order. The first letters unlock the next letters. The next letters unlock the ones after that.

That makes the cipher feel more alive than a simple repeated-key system. It also makes it more fragile.

Common questions about the Autokey cipher

Is the Autokey cipher secure?

No. The Autokey cipher is not secure by modern standards. It is a classical cipher. It improves on repeated-key Vigenère by reducing simple key repetition, but it still leaks structure through the plaintext-based keystream.

It should be used for education, puzzles, and historical interest only.

Is Autokey the same as Vigenère?

No. Autokey uses the same encryption formula as Vigenère:

C = (P + K) mod 26

But it builds the key differently.

Vigenère repeats the keyword. Autokey starts with a keyword and then extends the keystream using plaintext.

What is the Autokey keystream?

The keystream is the sequence of key letters used to encrypt the message.

For Autokey, it is:

keyword + plaintext

For example:

So the full keystream is:

QUEENLYATTAC

How do you decrypt Autokey?

Use:

P = (C - K) mod 26

But after the starting keyword has been used, each new key letter comes from plaintext that has already been recovered.

That means Autokey decryption rebuilds the key as it goes.

Why is Autokey harder than Vigenère?

Autokey avoids the simple repetition of a short keyword.

A repeated-key Vigenère cipher might use:

QUEENLYQUEENLYQUEENLY

Autokey uses:

QUEENLY

followed by plaintext.

That reduces periodic key repetition. However, it does not make the cipher secure, because the plaintext itself has patterns.

What happens if decryption goes wrong?

A mistake can affect later letters.

Because recovered plaintext becomes part of the future keystream, a wrong recovered letter can cause later decryption errors.

This makes Autokey more sensitive than ordinary repeated-key Vigenère.

Can Autokey preserve spaces and punctuation?

Yes. A tool can preserve spaces, punctuation, numbers, and case for readability.

But the cipher itself usually operates only on letters.

So:

ATTACK AT DAWN!

may preserve the space and exclamation mark while the key advances only over the letters.

What is a good Autokey example?

A clean example is:

This is the example used in the Autokey tool.

Why the Autokey cipher still matters

The Autokey cipher should not be used to protect anything serious.

Not passwords. Not private messages. Not financial information. Not recovery phrases. Not API keys. Not personal data.

Modern encryption depends on carefully analysed algorithms, large keys, secure randomness, authentication, and resistance to many different forms of attack. Autokey has none of that.

But it still earns its place.

It shows why repeated keys are dangerous. It shows how a cipher can try to generate a longer keystream. It shows how plaintext can become part of the encryption process. It shows why decryption sometimes depends on earlier recovered output. It shows how fixing one weakness can create another.

And most importantly, it teaches that a cipher is not just a formula.

It is a system. A key schedule. A stream. A dependency. A source of patterns. A source of leakage.

Caesar uses one shift. Vigenère repeats a keyword. Autokey lets the message extend the key.

That is a major conceptual step.

Not modern security. But a real movement toward the idea that the key stream itself matters.

That is why the Autokey cipher still matters.

Not because it is unbreakable. Because it shows how classical cryptography began to think beyond repetition.