Columnar Transposition Cipher: How a Keyword Scrambles a Grid

Most beginner ciphers swap letters for other letters. Caesar pushes A to D, Vigenère shifts each letter by a different amount, and a Polybius square turns letters into coordinate pairs. The columnar transposition cipher does something different and, to my eye, more interesting: it keeps every letter of the message exactly as it is and only moves them around. The puzzle is not "what does this letter become" but "where did this letter go."

This post walks through how the cipher works, why rearranging is a separate idea from substituting, and where you actually run into it today. You can follow along with the columnar transposition cipher tool, which shows the grid filling in as you type.

Writing the message into a grid

The mechanism is a rectangle and a keyword. Here is the recipe, step by step:

1. Pick a keyword, for example ZEBRAS. Its length sets the number of columns: six.
2. Write the plaintext into the grid one row at a time, left to right, top to bottom. Each new character drops into the next cell.
3. Number the columns by the alphabetical order of the keyword letters. A is the earliest letter, so its column is read first; Z is last, so its column is read last.
4. Read the grid out one full column at a time, following that numbered order, and concatenate everything into the ciphertext.

That third step is the whole trick. The keyword is never written into the message; it exists only to scramble the order in which you pull the columns out. Sort the letters of ZEBRAS alphabetically and you get A B E R S Z, which means the column under A is read first, then the column under B, then E, R, S, and finally Z. The grid did the spreading; the keyword decides the reading sequence.

Why transposition is not substitution

It is worth pausing on the difference, because it changes how you attack the cipher. A substitution cipher hides letters behind other symbols, so the giveaway is frequency: in English, E is everywhere, and a substitution that maps E to Q leaves Q suspiciously common. Cryptanalysts lean on that.

Transposition removes that handle entirely. If your message has eleven Es, the ciphertext still has eleven Es, because no letter was ever replaced. A simple letter count of the ciphertext looks exactly like ordinary English. What you have to recover instead is the permutation: the order the columns were pulled. That is why solving a transposition by hand often means anagramming columns, sliding them around until words snap into place, rather than building a substitution table.

This also explains why people stack the two ideas. Run a message through a Caesar cipher or a Vigenère cipher first to disguise the letters, then push that output through columnar transposition with a separate keyword to disguise their positions. Each step blinds a different style of analysis, and a friend holding both keys can peel them off in reverse.

A worked example

Let me encrypt a real message so the columns are concrete. Take the classic plaintext WEAREDISCOVEREDFLEEATONCE with keyword ZEBRAS. That is 25 letters across six columns, so the grid is five rows with one short cell at the end.

Lay it into the grid under the keyword letters:

Z E B R A S
-----------
W E A R E D
I S C O V E
R E D F L E
E A T O N C
E

Now number the columns by alphabetical order of the heading letters. A B E R S Z maps to the original positions: the A column is fifth from the left, B is third, E is second, R is fourth, S is sixth, and Z is first. Read them in that order.

• Column A (5th): E V L N
• Column B (3rd): A C D T
• Column E (2nd): E S E A
• Column R (4th): R O F O
• Column S (6th): D E E C
• Column Z (1st): W I R E E

Stitch those together and the ciphertext is EVLNACDTESEAROFODEECWIREE. Every original letter is present; only the order changed. To decrypt, the tool divides the ciphertext length by the keyword length to learn the row count, figures out which columns carry the extra cell of the short last row, slices the text into column-sized runs in keyword order, drops them back into place, and reads the grid row by row.

Regular and irregular padding

That short last row is the one detail that trips people up. In my example one column is a cell shorter than the rest, which is called irregular padding: nothing is added, and the round trip stays perfectly reversible. The downside is that decryption has to reason about which columns are short.

The alternative is regular padding, where you fill the short row with a chosen letter, usually X, until the rectangle is complete. Every column ends up the same height and the ciphertext length is a clean multiple of the keyword length. Many textbooks and CTF graders assume this regular form, so if you encrypt with irregular padding and the grader expects a multiple of six, your answer gets rejected even though your method was right. The padding toggle exists precisely so you can match whichever convention the puzzle uses, and forgetting to check it is the most common reason a correct columnar solution still fails.

Where you meet it today

Nobody protects real secrets with columnar transposition anymore. It was a serviceable field cipher a century ago, and even its hardened cousin, double transposition (run the whole process twice with two keywords), has long since fallen to modern cryptanalysis. For genuine confidentiality you want a vetted modern cipher like AES through a maintained library, not a hand-built grid.

What survives is the teaching and puzzle value. In a cryptography class it is the cleanest possible demonstration that a cipher can hide meaning purely by moving letters. In capture-the-flag competitions, a block of jumbled uppercase letters whose frequency profile looks like plain English is a strong hint that you are facing a transposition, and a single English word as the key. You try keyword lengths against the block, watch for the moment the output reads as a sentence, and you have both the key and the flag. The grid view is what makes hand-anagramming the column order tractable, since you can see exactly how the columns line up.

If transposition ciphers are new to you, it is worth comparing columnar against the simpler rail fence cipher, which zigzags text across a few horizontal rails and uses only the rail count as its key. Both reorder rather than replace, but columnar's keyword gives it a far larger key space and the option to be applied twice. Once you have seen the same letters land in different places under two different schemes, the idea that "scrambling is its own kind of encryption" stops being abstract and starts being something you can read straight off the grid.

---

Made by Toolora · Updated 2026-06-13