How does the Atbash cipher actually work?

Atbash mirrors the alphabet around its centre. Pair the first letter with the last, the second with the second to last, and so on: A↔Z, B↔Y, C↔X, D↔W … until M↔N meet in the middle. To transform a letter you find it on one side of the pair and write the letter on the other side. So the word abc, letter by letter, becomes zyx. There is no shift amount and no key to choose, which is what separates it from Caesar style ciphers.

Why does the same button both encode and decode?

Because the Atbash mapping is its own inverse, also called self-reciprocal. If A maps to Z, then Z maps right back to A using the very same rule, so there is no separate decode direction. Running any message through Atbash twice returns the original text. Try it here: type Hello and you get Svool, press Use output as input, and Svool turns back into Hello. That is why this tool has one operation instead of an encode and a decode mode.

What is the difference between Atbash and Caesar or ROT13?

Caesar and ROT13 slide every letter forward by a fixed number of positions, so A might become D with a shift of three, and ROT13 is the specific shift of 13. Atbash does not slide at all, it reflects: the alphabet is read backwards, so A pairs with Z and the distance each letter moves is different. ROT13 is also self-inverse but only by coincidence of 13 being half of 26, whereas Atbash is self-inverse by its mirror nature regardless of alphabet length.

Is the Atbash cipher secure for hiding real secrets?

No, and it was never meant to be. There is exactly one possible mapping, so there is nothing to brute force and no key to keep private. Anyone who recognizes that a message is Atbash decodes it on sight, and frequency analysis or a single guessed word gives it away even to someone who has never heard of it. Treat it as a puzzle, a CTF warm up, an escape room clue, or a way to teach how substitution ciphers work, not as protection for passwords or private data.

What characters does this tool change, and what does it leave alone?

Only the 26 Latin letters A to Z are mirrored, and case is kept, so an uppercase G becomes an uppercase T and a lowercase g becomes a lowercase t. Everything else is passed straight through: the digits 0 to 9, spaces, line breaks, punctuation like commas and exclamation marks, accented letters such as é, Chinese and other CJK characters, and emoji. For example Hello, World 2026! becomes Svool, Dliow 2026! with the comma, space, digits and exclamation mark in their original places.

Solve a CTF or crypto challenge string

You are staring at a CTF flag that looks scrambled but the usual ROT13 does not read. Paste it here: if the cleartext pops out, the challenge was Atbash all along. Because the mapping is fixed there is no key to grind through, so this is the second thing to try after ROT13 when a string is clearly a simple substitution. Drop the whole flag in, copy the decoded text, and move on to the next stage.

Build or solve an escape-room or puzzle-hunt clue

Designing a room and want a clue that players can crack with a pencil and the alphabet written forwards and backwards? Atbash is perfect: no key card, no number to find, just the mirror. Encode the location of the next key here, print the ciphertext on a card, and players who line up A with Z read it out by hand. Share the URL with a co-designer and the exact clue reopens.

Teach how substitution ciphers work in class

Atbash is the cleanest first example for a lesson on classical cryptography because there is nothing to parameterise. Show students that abc becomes zyx, have them run zyx back through and watch it return to abc, and the idea of a self-inverse mapping lands without algebra. Pair it with the Caesar and ROT13 tools to contrast a mirror against a shift in the same session.

Read a historical or biblical Atbash reference

Atbash shows up in old texts, most famously as a way certain Hebrew names were written in scripture, and puzzle setters still reuse the trick in crosswords and alternate-reality games. When you hit a word that a footnote says is Atbash, type it in, read the plain form, and keep your place in the text instead of mirroring letters by hand on scratch paper.

Atbash Cipher Encoder and Decoder

Mirror the alphabet, A↔Z B↔Y, no key, self-reciprocal so the same button encodes and decodes, browser-only

Runs locally
Category Encoding & Crypto
Best for Checking small payloads, tokens, hashes, and encoded values quickly.

Atbash cipher. Each letter maps to its mirror in the alphabet: A↔Z, B↔Y, C↔X … M↔N. There is no key, and the mapping is its own inverse — the same operation encodes and decodes, so running it twice gives back the original. Case is kept; digits, spaces, punctuation and non-Latin text pass through untouched.

Self-inverse: encode and decode are one and the same. Press “Use output as input” to verify it round-trips.

Input0 chars

Output0 chars

Mirrored text appears here.

What this tool does

Free Atbash cipher encoder and decoder that runs entirely in your browser. Atbash is one of the oldest substitution ciphers: it replaces every letter with its mirror in the alphabet, so A becomes Z, B becomes Y, C becomes X, all the way to M and N swapping in the middle. There is no key and nothing to configure. The mapping is its own inverse, which means encoding and decoding are exactly the same operation, and running a message through twice returns the original. Type or paste any text and the mirrored result updates live; case is preserved, while digits, spaces, punctuation, CJK and every other non-Latin character pass through untouched. This is a classical and CTF teaching tool rather than real encryption, since a single fixed mapping is read instantly by anyone who spots the pattern. One-click copy and a shareable URL reopen the exact text you were working on. Nothing is uploaded, logged, or sent anywhere.

Tool details

Input: Text; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: Shareable URL state; Key settings are encoded in the URL so another person can reopen the same setup.
Performance budget: Initial JS <= 9 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Encoding & Crypto · Student; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How Atbash Cipher fits into your work

Use it for quick browser-side encoding, decoding, hashing, token checks, and share-safe transformations.

Encoding jobs

Checking small payloads, tokens, hashes, and encoded values quickly.
Preparing values for APIs, URLs, docs, or support tickets.
Avoiding account-based tools when the input might be sensitive.

Encoding checks

Do not paste live secrets unless you are comfortable with local browser handling.
Confirm whether the operation is reversible before sharing the result.
For hashes, compare the exact algorithm and casing expected by the receiver.

Good next steps

These links move the current task into a more complete workflow.

Real-world use cases

Solve a CTF or crypto challenge string
You are staring at a CTF flag that looks scrambled but the usual ROT13 does not read. Paste it here: if the cleartext pops out, the challenge was Atbash all along. Because the mapping is fixed there is no key to grind through, so this is the second thing to try after ROT13 when a string is clearly a simple substitution. Drop the whole flag in, copy the decoded text, and move on to the next stage.
Build or solve an escape-room or puzzle-hunt clue
Designing a room and want a clue that players can crack with a pencil and the alphabet written forwards and backwards? Atbash is perfect: no key card, no number to find, just the mirror. Encode the location of the next key here, print the ciphertext on a card, and players who line up A with Z read it out by hand. Share the URL with a co-designer and the exact clue reopens.
Teach how substitution ciphers work in class
Atbash is the cleanest first example for a lesson on classical cryptography because there is nothing to parameterise. Show students that abc becomes zyx, have them run zyx back through and watch it return to abc, and the idea of a self-inverse mapping lands without algebra. Pair it with the Caesar and ROT13 tools to contrast a mirror against a shift in the same session.
Read a historical or biblical Atbash reference
Atbash shows up in old texts, most famously as a way certain Hebrew names were written in scripture, and puzzle setters still reuse the trick in crosswords and alternate-reality games. When you hit a word that a footnote says is Atbash, type it in, read the plain form, and keep your place in the text instead of mirroring letters by hand on scratch paper.

Common pitfalls

Expecting Atbash to keep secrets safe. It has a single fixed mapping with no key, so anyone who recognizes the pattern reads it instantly. Use it for puzzles and teaching, never for passwords, tokens or anything that has to stay private.
Confusing it with Caesar or ROT13 and looking for a shift number. Atbash does not shift by any amount, it mirrors, so A always pairs with Z. If you try to decode it by sliding letters you will get nonsense. There is nothing to set here because there is no key.
Assuming digits, spaces or non-Latin characters get transformed. Only the letters A to Z change; numbers, punctuation, spaces and CJK text are left exactly where they are. If your output still shows the original digits, that is correct behaviour, not a bug.

Privacy

The entire mirror substitution runs as plain JavaScript inside your browser tab. Your text is never uploaded, logged, or sent to any server, and there is no record of what you encoded. The one caveat: the shareable URL puts your input in the query string, so a link pasted into chat will record that text in the recipient server access log. Atbash is trivially reversible by design, so never put a real secret here in the first place; for anything sensitive, use the copy button and paste the text instead of sharing the URL.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Browse all tools for this role

Atbash Cipher Encoder and Decoder

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How Atbash Cipher fits into your work

Encoding jobs

Encoding checks

Good next steps

Real-world use cases

Solve a CTF or crypto challenge string

Build or solve an escape-room or puzzle-hunt clue

Teach how substitution ciphers work in class

Read a historical or biblical Atbash reference

Common pitfalls

Privacy

FAQ

Base64 Encoder & Decoder

Caesar Cipher Encoder & Decoder

ROT13 Encoder & Decoder

Vigenère Cipher Encoder / Decoder

Morse Code Translator

AES Text Encryptor

Affine Cipher Encoder & Decoder

Bacon Cipher Encoder & Decoder

Base32 / Base58 Encoder & Decoder

Base62 Encoder & Decoder

Base64 Block Deduplicator

Base64 Block Extractor