# Atbash & Affine Cipher Decoder

> Decode Atbash (the reversed alphabet) or an affine cipher with keys a and b.

- Page: https://decoder.tools/atbash-affine-decoder
- Category: Classical & Obfuscated Ciphers
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

Atbash and affine ciphers are simple substitution ciphers. Atbash swaps each letter with its mirror (A with Z, B with Y). An affine cipher maps each letter number `x` to `(a·x + b) mod 26`. This tool reverses both.

## Example

```text Input
Gsv jfrxp yildm ulc
```

```text Output
The quick brown fox
```

For the affine cipher, choose **Cipher: Affine** and set `a = 5`, `b = 8`: `IHHWVC SWFRCP` decodes to `AFFINE CIPHER`.

## Atbash

Atbash comes from the Hebrew alphabet, where the first letter (aleph) swaps with the last (tav), and the second (bet) with the second-to-last (shin). The name spells that out: *a-t-b-sh*. In the Latin alphabet:

| Plain | A | B | C | D | E | F | G | H | I | J | K | L | M |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Atbash | Z | Y | X | W | V | U | T | S | R | Q | P | O | N |

Atbash has no key and is its own inverse. It turns up in puzzles, in TV shows such as *Gravity Falls*, and in biblical texts (the Book of Jeremiah uses it).

## Affine cipher

The affine cipher numbers letters A = 0 to Z = 25 and encrypts with `E(x) = (a·x + b) mod 26`. To decrypt it needs the **modular inverse** of `a`: `D(y) = a⁻¹·(y − b) mod 26`.

`a` must share no factor with 26, so it can only be **1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23 or 25**. With 26 values of `b`, that makes 312 keys (311 if you exclude the identity). Caesar is the case `a = 1`, and Atbash is `a = 25, b = 25`.

## How to break them

- **Atbash:** just apply it. There is no key.
- **Affine:** brute force is easy with only 312 keys. With frequency analysis, two letters are enough: if ciphertext `X` is probably plaintext `E` and ciphertext `Q` is probably `T`, solving the two equations gives `a` and `b`.

## How to use the decoder

1. Paste the ciphertext.
2. Choose **Atbash**, or choose **Affine** and enter `a` and `b`.
3. Read the plaintext. If `a` has no inverse mod 26, the tool tells you to pick another value.

## Decode in code

```python Python
def atbash(s):
    return "".join(chr(155 - ord(c)) if c.isupper() else chr(219 - ord(c)) if c.islower() else c for c in s)

def affine_decrypt(s, a, b):
    inv = pow(a, -1, 26)  # modular inverse (Python 3.8+)
    return "".join(chr(inv * (ord(c) - 65 - b) % 26 + 65) if c.isupper() else c for c in s)

print(atbash("Gsv jfrxp yildm ulc"))            # The quick brown fox
print(affine_decrypt("IHHWVC SWFRCP", 5, 8))    # AFFINE CIPHER
```

## At a glance

| | |
|---|---|
| Atbash | `x → 25 − x`. No key, self-inverse |
| Affine | `x → (a·x + b) mod 26` |
| Valid a | 1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25 |
| Key space | 312 affine keys |

## FAQ

### Why can't a be 2 or 13?

Because 2 and 13 divide 26, those values would map two different letters to the same ciphertext letter, so the message couldn't be decrypted. `a` has to be coprime with 26.

### Is Atbash the same as ROT13?

No. ROT13 shifts every letter by 13. Atbash reverses the alphabet. Both are self-inverse, but they produce different results: `A` is `N` in ROT13 and `Z` in Atbash.

### How do I find the affine key?

Guess two plaintext letters from frequencies (E and T are the most common in English), set up `y = a·x + b` for both, and solve mod 26. Or try all 312 keys.