The Affine Cipher Explained: Why a Must Be Coprime With 26

The affine cipher is the cipher I reach for when I want to show someone exactly why number theory shows up in cryptography. It is two key numbers, one formula, and a single sharp rule that trips up almost everyone the first time. That rule — the key a must be coprime with 26 — is the whole reason the cipher is reversible, and it is also the reason a lot of CTF players paste in a value and get an error instead of a flag.

This post walks through the formula E(x) = (ax + b) mod 26, shows a worked example by hand, explains the coprime rule and the modular inverse, and is honest about where this cipher belongs: puzzles, lessons, and capture-the-flag challenges. Not anything you actually need to keep secret.

The formula: two keys, one multiply, one add

Every letter is turned into a number first: A is 0, B is 1, all the way to Z which is 25. Then the affine cipher applies:

E(x) = (a · x + b) mod 26

That is it. You pick two key numbers, a and b. The letter at position x is multiplied by a, shifted by b, and wrapped back into the 0–25 range with mod 26. The result is another position, which you turn back into a letter.

The name "affine" comes from the affine function ax + b in algebra — a linear multiply plus a constant shift. That is also why some people call it the linear cipher. Compared with a plain shift cipher, the only new ingredient is the multiply step, and the only new headache is that multiplying by the wrong a quietly destroys your message. You can try every part of this live in the affine cipher encoder and decoder, which shows the modular inverse on screen as you type.

A worked example: encrypting with a = 5, b = 8

Let me actually encrypt a letter the way I would on paper. Take a = 5, b = 8, and encrypt the letter A.

• A is position x = 0.
• Compute 5 · 0 + 8 = 8.
• 8 mod 26 = 8.
• Position 8 is the letter I.

So A becomes I. Now the letter B at position 1:

• 5 · 1 + 8 = 13.
• 13 mod 26 = 13.
• Position 13 is N.

So B becomes N. Keep going for the word AFFINE and you get IHHWVC. To reverse it you do not subtract — you multiply by the modular inverse of a, which for a = 5 is 21, using D(y) = 21 · (y − 8) mod 26. Feed "IHHWVC" with a = 5, b = 8 into decrypt and you get AFFINE back. That asymmetry — encrypt multiplies by a, decrypt multiplies by the inverse of a — is the single most common thing people get wrong, so reach for the Decrypt button rather than trying to undo it by hand.

Why a must be coprime with 26

Here is the concrete point that the whole cipher hinges on: a must be coprime with 26, meaning gcd(a, 26) = 1. There are exactly twelve values that qualify:

1, 3, 5, 7, 9, 11, 15, 17, 19, 21, 23, 25

Anything else fails. Why? Because 26 factors as 2 × 13, so any even a shares the factor 2, and any multiple of 13 (that is, 13 itself) shares the factor 13. When a shares a factor with 26, the multiply step is no longer a one-to-one map. Two different plaintext letters land on the same cipher letter, and once two inputs collide, no decryption can tell them apart.

Try a = 2 as a thought experiment. Position 0 gives 0, position 13 gives 2 · 13 = 26 = 0 mod 26. Both A and N map to the same place. The message is scrambled in a way that cannot be unscrambled, because information was thrown away, not hidden. A good tool refuses these keys outright rather than handing you ciphertext that silently cannot be decoded — when I type a = 13 into the affine tool it flags the error instead of pretending everything is fine.

The deeper reason is the modular inverse. Decryption divides by a, and in modular arithmetic dividing by a means multiplying by its inverse — the number that satisfies a · a⁻¹ ≡ 1 mod 26. That inverse exists if and only if gcd(a, 26) = 1. For a = 5 the inverse is 21, because 5 · 21 = 105 and 105 mod 26 = 1. No coprimality, no inverse, no decryption. This is the cleanest example I know of for teaching multiplicative inverses, which is exactly why it shows up in number-theory courses.

a = 1 is just the Caesar cipher

Set a = 1 and watch the formula collapse:

E(x) = (1 · x + b) mod 26 = (x + b) mod 26

The multiply does nothing, and you are left with a plain shift by b — which is precisely the Caesar cipher. Encrypt with a = 1, b = 3 and you get the same output as a Caesar shift of 3: A becomes D, B becomes E, character for character. You can verify that against the Caesar cipher encoder and the outputs will match exactly.

This makes the family tree concrete. Caesar is the affine cipher with the multiply switched off. ROT13, which you can try in the ROT13 encoder, is Caesar with b = 13. The Atbash cipher is itself an affine case with a = 25, b = 25, which mirrors the alphabet. And the Vigenère cipher extends the shift idea to a repeating key. The multiply step is what lifts affine above a single shift, expanding the key space from 26 shifts to 12 × 26 = 312 combinations.

Where it belongs: CTFs, classrooms, and puzzles

312 keys is a fun number for two reasons. It is large enough to feel like a real cipher to a beginner, and it is small enough to brute-force before your coffee cools. That is the affine cipher's natural habitat.

In CTF crypto challenges, a hint like "the key is ax+b" tells you immediately what to do: if you have a and b, decrypt directly; if you only have ciphertext, there are just 312 possibilities, so try each coprime a against a known crib — like a CTF{ flag prefix — and read the line where braces wrap readable text. In a number-theory class, it is the example that makes gcd(a, 26) = 1 stop being an abstract requirement and become something students watch fail in real time. And for an escape room, you pick something like a = 7, b = 11, encrypt the riddle, and print the key on the clue card; a shareable link reopens the exact same puzzle for the next player.

What it is emphatically not is security. With 312 total keys, an affine cipher falls to brute force or to simple frequency analysis on a couple of sentences. Never use it to protect a password, a token, or a private message — those keys live in the URL anyway. Treat it as a teaching aid and a puzzle toy, and it is genuinely one of the most elegant ciphers around. Treat it as encryption and you will get burned.

---

Made by Toolora · Updated 2026-06-13