Subscribe to the Roleplaying Tips Weekly Newsletter - game master tips

Knowledge: Decipher Script

By Michael 'Old Man' Ullom

Why should I read this?

This article gives a short but comprehensive background for DMs who want to describe the efforts of PCs and NPCs dealing in information secrecy via the methods of ciphering and deciphering information through writing or symbols. It will also demonstrate what decipher script could reasonably allow. Even if you're not interested in ciphering yourself, they will help you describe ciphers that characters find in your games, adding detail and color.

Lock and Key

The most basic things involved with encoding are the message itself and the means of decipherment, or the lock and key. For your budding amateur, the simplest process might look something like this:


The Key: A=A+2 (Plain A equals C when ciphered, B equals D, and so forth)

The Conversion:

Plain script ( P ) : A B C D E F G H I J K L M N O P Q R S T U C W X Y Z
Cipher script (C): C D E F G H I J K L M N O P Q R S T U V W X Y Z A B

The answer is 'Meet me at midnight'.

Plain script refers to the original message, and cipher script refers to the message after it's been encoded. Thus, 'Meet me at midnight' is in plain script, and OGGVOGCVOKFPKIJV is in cipher script.


Usually, the lock is a simple matter. For most ciphers, substituting numbers for letters or letters for letters once will work fine. Things will get trickier for those to whom secrecy is a professional matter but the essential part is of the initial substitution. However, there are things that even at a basic level can help:

  • While this may seem obvious, it's worth mentioning that the message doesn't have to be in English. This allows a great deal of flexibility and trickiness on the part of the DM- decoding it won't do a thing if the characters don't understand the language, and it also allows for messages that don't 'translate' perfectly.

  • Not all information secrecy is changing letters around. Here are some examples of other methods of transferring information, both real and fictitious:

    • Sheet music and the melody of a song
    • Many differing kinds of invisible ink
    • Adding mulberry juice to a document-the silkworms eat through the treated paper, hollowing out the 'writing' from the rest of the paper.
    • Odd placements of rocks near certain species of flora.
    • A game of solitaire in a crowded inn, the cards chosen and their placement conveying the message
    • A bouquet of flowers, carefully picked.
    • Patterns on the Rubik's Cube

    The only limit to transferring information is imagination and patience.

  • As a DM, information secrecy is also a great way to encourage complementary skills. If the deciphered script talks in terms of alchemical symbols, you'll need somebody who knows alchemy... Referring to Lady Nightshade could refer to any number of nobles or infamous people, and it would take a bard to determine the subject, or a herbalist to guess at the qualities of said Lady.

  • Of note-outside information that makes deciphering easier is known as a crib, and it's quite common to substitute spying when deciphering fails. For example, knowing the origin of the message and the author will help greatly. If every letter from a noble starts off 'In the Name of King Richard' and you know this, you will have an easier time deciphering his letter.
  • Elements of the Key: A=A+2

    The most important aspects of the key are as follows:

    • Safety, or 'Guessibility': In general, simpler keys are easier to guess.
    • Ease of use: The time it takes to actually cipher or decipher things.

    To an extent, increased safety makes a cipher harder to use. The means of transferring the key between parties is almost always the weakest part of the process-interception of the key means that the entire cipher is compromised. In the medieval era, key transfer was usually done in one of two way:
  • A simple key phrase.
  • A comprehensive codebook Let's look at these options in detail.

    The Key Phrase

    A key phrase is a simple phrase that sets the cipher. It's easy to use and remember and surprisingly good for most communications. We'll use the phrase Blood as an example. There are only three stops to follow:

    1: Place the key phrase at the beginning of the plain alphabet-the position can be anywhere, but the beginning will do for now.
    P: A B C D E F G...
    C: B L O O D

    2: Delete any repeating letters in the phrase.
    P: A B C D E F G…..
    C: B L O D

    3: And set the remaining letters to the rest of the alphabet.
    P: A B C D E F G….
    C: B L O D E F G….

    Make sure you don't repeat any letters when setting the cipher script.

    Thus, Blood as a key phrase ciphers the alphabet as follows:

    P: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
    C: B L O D E F G H I J K M N P Q R S T U V W X Y Z A C

    Disadvantages of the Key Phrase:

    The key can't be too complex. It has to be something your simplest scribe can memorize. In addition, most groups will use something symbolic to their cause, just like the way many people set their internet passwords. If you're familiar with the group, you can probably guess the keyword, especially if you've figured out a few of the letters. Useful for the average conspirator, but if you're going to do a full-scale operation, you're probably going to want to use a codebook.

    The Codebook

    The codebook allows for complex messages and means of decipherment. In essence, it is a language spoken only by those who carry the codebook. Without it, deciphering a message would be as difficult (ideally) as learning a whole new language. Even reworking the substituted letters won't help--if the player intercepts a code and deciphers it, 'Alpha Orange Frog' is going to be a bit perplexing in the least, and most people will be unlikely to know that the attempted assassination will occur at the duke's mansion at midnight. It gets worse when Alpha, Orange and Frog aren't letters but strange and unknown symbols.

    The difficulty of codes should increase greatly with the absence of codebooks, or at least take much more time. In general, the more time and coded material the party has, the easier it should be to decode it. If the party has the key and the codebook, it should take no more time to read it then to decode the document.

    The Disadvantages of the Codebook:

    Codebooks must be reasonably accessible to whoever's deciphering it. When an army has a codebook in every platoon, a well-placed theft would easily gain access to the entire army's code. Once a codebook has been compromised, the entirety of your operation is at risk unless you have a backup plan not in the book.
    In addition, replacing the Codebook takes much more time then sending out a new key phrase. It takes more time to decipher the ciphered text as well (Unless your poor scribes have been spending their speak language skills on learning the code books by heart). With magic, these problems can be both mitigated and magnified greatly.

    Note that both for codebooks and key phrases, the more often they're used, the more easily they can be broken, for the simple reason that the more encoded material you have, the more you can analyze the code used to cipher it.

    The Advanced Stuff

    While the Romans worked well with A=A+2, in a renaissance world stronger precautions are necessary. Two subjects in particular bear mention: Frequency Analysis, and Polyalphebetic Substitution Ciphers.

    Frequency Analysis

    Developed by Arabian scholars trying to decide which religious works were attributable to Muhammad, frequency analysis measured the rate at which words and phrases (and more importantly, letters) were used. A very large part of this deciphering method checks the frequencies of letters and compares them to the frequencies of letters in the given language. For example, E is the most common letter of the English alphabet. Looking at 'meet me at midnight', if the person guesses e, the rest is easier to decipher. In addition, if you have t*e, you can probably guess the middle letter is h. Frequency analysis gets much more interesting and trickier, but the short of it is that Frequency Analysis will tear through basic ciphers like a knife through butter.

    There are several ways to sneak by this. One is to remove unnecessary words, such as as, the, his, her, and so on. The shorter a message is, the harder it is to decode. In addition, by removing the particles, people looking for common repetitions of symbols will be stumped.
    A more malicious trick is to do misspellings. Though easy to place in the document, it will likely drive anyone trying to decipher it mad. Likewise, adding 'white noise' could help. For example, every third letter is random and meaningless.
    Another trick is to use words that don't reflect the common frequencies of a language, such as avoiding the usage of E's entirely. One Frenchman wrote a book without E's (it was later translated into English with gimmick intact). What is the easiest way to test a code's difficulty in terms of frequency? Play Hangman, and see how many guesses it takes.
    There's a greater trick however: using more then one symbol for commonly used letters. Using 6 different numbers to represent E will mitigate frequency analysis, if spread out consistently. But it can get even trickier. Having E=16, 79, and 76 is one thing, but what if 16 could equal E, Q, or H? This brings us to polyalphabetic substitution.

    'Polyalphabetic Substitution Cipher (PSC)

    Every example so far has been a 'Monoalphabetic Substitution Cipher', or MSC, which is a fancy way of saying that if you use the key A=A+2, M will always be ciphered as O. Any MSC is fairly weak when Frequency Analysis kicks in, no matter how complicated the initial formula. But what if M=D, L, or Q, and L=Q, O, or D? This is where things become a pain for the would-be spy, and where Polyalphabetic Substition Ciphers come in.

    Take the word Ah-Ha. Using an MSC with the key A=A+2, Ah-Ha comes out to be CJJC. This is very dangerous to the security of the cipher-there's not a lot of 4 letter words with a repetition like this. With a PSC, this problem can be fixed.

    Here's an example of a basic PSC:

    For every even letter, A=A+2
    For Every odd letter, A=A-1
    The phrase Ah-ha would be ciphered in this system as ZJGC. Notice how the problem of letter repetition has been stopped in its tracks.

    But if we have the following alphabets A=A+2, A=A-17, A=A+9, and A=A+12, how does this message get translated by the intended recipient? The sanest way to do this is to have a systematic pattern for alphabet-switching, so that the recipient knows when to use A=A+2 and when to use A=A-1. There are a few common ways to switch alphabets:

    • By every X letter, line, or keyword (every time 'And' is used, for example)
    • By certain combinations of letters.
    • To a key phrase or codebook
    • To a key text. For example, the first letter on each page of a book could dictate what alphabet is used for a line.
    Note that shortening the time between switching alphabets makes ciphers more secure. Switching alphabets every letter avoids things like ah-ha turning into CJJC, while longer ones don't.

    Before we go too wild, remember-the intended recipient has to be able to translate this. A time sensitive message is useless if it can't be deciphered quickly. Each person will have to decide which is more important, timeliness or secrecy. One particular PSC deserves special mention (bear with me!):the Vigenere Cipher.

    The Combination Safe-the Vigenere Cipher

    The Vigenere square is a nasty development--a pathetically easy way to create 26(!) alphabets for one text. Let's say I have an alphabet of four letters-A, B, C, and D. The Vigenere square makes 4 alphabets out of these like so:

    A B C D
    B C D A
    C D A B
    D A B C

    Notice how they shift one left for every line down? Expand this table by the normal English alphabet and one can quickly see what a nightmare this becomes. Note that, for sanity's sake, using every possible alphabet is by no means necessary. A key phrase usually sets the rows used for the text: The word CAB would use only the first, second, and third rows of the Vigenere Square in ciphering and deciphering the message (ie, only the rows that start with letters used in the word). Longer key phrases will most likely be used. Invented in the 1500s, it took the likes of Babbage to break it. It should be more then sufficient for most standard D&D campaigns.

    Next Time: We will look at making ciphered documents on the PC, setting DCs for Decipher Script, and providing in-game puzzles to confound your players and their PCs.
    The Knowledge series is devoted to aiding DMs in breathing life into their campaigns, exploring unfamiliar areas in a comprehensive format. It is entirely run by contributions from guest writers. We accept any well written and interesting article, but are actively looking for informed articles on the following subjects as of October 2003:

  • The history and evolution of swords, and how to identify them
  • Methods of herbal identification (A primer in describing realistic plants)
  • How to speak 'medieval'
  • How to talk 'arcane’ (ie Magic jargon)
  • Means and Methods of thieving in the medieval world

    Submissions may be sent