The Beaufort Cipher

The Beaufort Cipher: Vigenère, Flipped

Introduction

The Vigenère cipher encrypts by adding a repeating keyword to the plaintext letter by letter. The Beaufort cipher, named after Sir Francis Beaufort (better known for the Beaufort wind scale), takes the same polyalphabetic idea and flips the arithmetic around: instead of adding, it subtracts the plaintext from the key. That one change gives Beaufort a property none of the other polyalphabetic ciphers in this series have. It’s its own inverse, so the exact same operation both encrypts and decrypts.

Table of Contents

• How the Beaufort Cipher Works
• Why Beaufort Is Its Own Inverse
• A Worked Example
• Beaufort vs. Vigenère vs. the “Variant Beaufort”
• Pros and Cons Analysis
• Cryptanalysis and Breaking the Beaufort Cipher
• Modern Relevance
• Python Implementation
• Limitations
• Conclusion
• FAQ
• References

How the Beaufort Cipher Works

Like Vigenère, Beaufort is a polyalphabetic substitution cipher: a repeating keyword determines a different shift for every letter of the plaintext. That defeats simple frequency analysis in a way none of the single-alphabet ciphers earlier in this series can. The difference is entirely in the formula:

Vigenère:  C = (P + K) mod 26
Beaufort:  C = (K - P) mod 26

Where P is the plaintext letter’s position, K is the repeating keyword letter’s position, and C is the resulting ciphertext letter’s position (A=0, …, Z=25). K - P can easily go negative (a small key letter minus a large plaintext letter, for instance). When it does, the mod 26 always wraps the result back into range by adding 26 until it’s positive. For example, 4 - 19 = -15, and -15 mod 26 = 11.

As with every cipher in this series, non-letter characters (spaces, punctuation, digits) are conventionally stripped from the message before encryption. The key stream only ever advances over letters, so punctuation contributes nothing to the arithmetic.

Interactive Visualizer

Try it above with keyword “LEMON”, the same keyword the Vigenère visualizer uses by default. That way, you can compare the two ciphers’ output directly on identical input.

Why Beaufort Is Its Own Inverse

This is Beaufort’s defining trait. Solve the encryption formula for P instead of C:

C = (K - P) mod 26
P = (K - C) mod 26

The equation for recovering P from C is algebraically identical to the equation for computing C from P. Both are just “subtract the other value from the key.” That means Beaufort needs no separate decryption procedure at all: running the exact same operation on ciphertext with the same key recovers the plaintext.

A quick concrete check, using the worked example below: its first ciphertext letter is L (11), encrypted under key letter L (11). Running the identical formula on it: P = (11 - 11) mod 26 = 0 → A. That’s exactly the plaintext letter (“ATTACKATDAWN” starts with A) that produced it in the first place.

This is the same involution property the Atbash cipher has, just extended to a full polyalphabetic cipher rather than a single fixed mapping. It’s why the visualizer above computes identically regardless of whether you click Encrypt or Decrypt. Both buttons run the same underlying K − P mod 26 operation on whatever text is in the input field.

A Worked Example

Encrypting “ATTACKATDAWN” with keyword “LEMON” (repeated to “LEMONLEMONLE”):

Plain (P)	A	T	T	A	C	K	A	T	D	A	W	N
Key (K)	L	E	M	O	N	L	E	M	O	N	L	E
Result	L	L	T	O	L	B	E	T	L	N	P	R

For the first letter: P=A (0), K=L (11), so C = (11 - 0) mod 26 = 11 → L. The second letter shows the modulo actually doing work: P=T (19), K=E (4), so C = (4 - 19) mod 26 = -15 mod 26 = 11 → L again. That’s a coincidence of this particular pair, not a pattern, and it matches the “L” already shown in the table.

“ATTACKATDAWN” → “LLTOLBETLNPR”

To decrypt, apply the identical process to “LLTOLBETLNPR” with the same keyword “LEMON”. No formula changes, no sign flips. It recovers “ATTACKATDAWN” exactly.

Beaufort vs. Vigenère vs. the “Variant Beaufort”

There are actually three closely related formulas worth distinguishing:

• Vigenère: C = (P + K) mod 26. Encryption adds; decryption (P = (C - K) mod 26) is a different formula.
• Beaufort: C = (K - P) mod 26. This is the classic, historically-named cipher, and self-reciprocal as shown above.
• “Variant Beaufort”: C = (P - K) mod 26. Despite the name, this is mathematically identical to Vigenère decryption used as an encryption step, and is not self-reciprocal.

For quick reference:

Cipher	Encryption formula	Decryption formula	Self-reciprocal?
Vigenère	C = (P + K) mod 26	P = (C - K) mod 26	No
Beaufort	C = (K - P) mod 26	P = (K - C) mod 26	Yes
Variant Beaufort	C = (P - K) mod 26	P = (C + K) mod 26	No

The genuine Beaufort cipher, K - P, is the one with the reciprocal property, and it’s the one this visualizer implements. The variant is a common point of confusion in cryptography references. It’s worth keeping the direction of subtraction straight: Beaufort subtracts the plaintext from the key, not the other way around.

Pros and Cons Analysis

Advantages	Disadvantages
Self-Reciprocal: A genuine practical convenience for hand or mechanical encryption: operators only need to learn and implement one procedure	Same Weaknesses as Vigenère: A repeating key of length n still produces n effectively-independent Caesar ciphers, all breakable by Kasiski examination and frequency analysis once the key length is found
Historically Used in Rotor Machines: The reciprocal property made Beaufort’s arithmetic a natural fit for mechanical cipher devices like the Hagelin M-209, which benefit from symmetric encrypt/decrypt wiring	No Additional Security over Vigenère: The keyspace and structural strength are essentially identical to Vigenère’s; the reciprocal property is a convenience, not a security improvement
Reinforces the Involution Concept: A second, more advanced example (after Atbash) of a cipher that’s its own inverse	Still Fully Broken by Modern Cryptanalysis: Automated Kasiski/frequency-analysis tools solve Beaufort ciphertexts as readily as Vigenère ones
Direct Educational Comparison to Vigenère: Seeing the same keyword produce different (but related) output on the same plaintext clarifies exactly what the sign flip changes	Easy to Confuse with the Variant Beaufort: The naming convention in cryptography literature is inconsistent enough to trip up implementers

Cryptanalysis and Breaking the Beaufort Cipher

Beaufort inherits Vigenère’s exact structural weakness: because the key repeats, the ciphertext is really just a set of interleaved Caesar-shifted alphabets, one per key position. The standard attack proceeds identically to attacking Vigenère:

1. Determine the key length using Kasiski examination or the Friedman/index-of-coincidence test. Kasiski works by looking for repeated ciphertext sequences and measuring the distances between them, since repeated distances tend to be multiples of the key length.
2. Split the ciphertext into groups, one per key position (every Nth letter, where N is the key length).
3. Frequency-analyze each group independently, since each is effectively a single-alphabet substitution: specifically, a Caesar-like shift, just computed via subtraction from the key rather than addition.

The only real change from breaking Vigenère is the sign in the final arithmetic step once a key letter is recovered. The overall difficulty and technique are otherwise the same. See the Vigenère cipher breaker guide on this site for the full walkthrough of this attack.

Modern Relevance

Beaufort has no role in modern security, but remains relevant for:

• Rotor machine history: its reciprocal arithmetic influenced the design of several mechanical cipher devices. A machine that encrypts and decrypts with identical wiring is simpler and cheaper to build. Concretely, a self-reciprocal cipher means an engineer only has to design, wire, and manufacture one mechanism. There’s no separate “decrypt mode” circuitry to add. And there’s no risk of a machine being wired correctly for encryption but incorrectly for decryption. They’re the same operation by construction.
• Teaching the involution concept at the polyalphabetic level, extending the idea introduced by Atbash into a full keyword-based cipher.
• A clear illustration that a convenient property (self-reciprocity) is not the same thing as a security property: Beaufort is exactly as breakable as Vigenère, just more convenient to operate by hand or machine.

Python Implementation

Beaufort’s self-reciprocal property means a single function handles both directions, there’s no separate decrypt path to write:

def beaufort_transform(text, keyword):
    """Self-reciprocal: call this once to encrypt, again with the same
    keyword to decrypt. Both directions run the identical K - P formula."""
    text = ''.join(c for c in text.upper() if c.isalpha())
    keyword = ''.join(c for c in keyword.upper() if c.isalpha())
    result = ''
    for i, char in enumerate(text):
        p = ord(char) - ord('A')
        k = ord(keyword[i % len(keyword)]) - ord('A')
        result += chr((k - p) % 26 + ord('A'))
    return result

if __name__ == "__main__":
    keyword = "LEMON"
    plaintext = "ATTACKATDAWN"

    ciphertext = beaufort_transform(plaintext, keyword)
    recovered = beaufort_transform(ciphertext, keyword)

    print(f"Plaintext:  {plaintext}")
    print(f"Ciphertext: {ciphertext}")
    print(f"Recovered:  {recovered}")

This reproduces the worked example above: ATTACKATDAWN → LLTOLBETLNPR → ATTACKATDAWN, calling beaufort_transform on the same keyword both times.

Limitations

This implementation is deliberately minimal:

• English letters only. Non-letter characters and case are stripped before the transform runs, so the original formatting isn’t recoverable from the output alone.
• No check for the “Variant Beaufort” mix-up. The function only implements the genuine K - P formula. Swapping the subtraction order (P - K) silently produces the non-reciprocal variant instead, with no warning.
• No key validation. An empty keyword raises a division-by-zero-style error the same way it would in the Vigenère implementation.
• Not intended for real security. This code exists to demonstrate the reciprocal arithmetic, not to protect anything; it’s exactly as breakable as the Vigenère cipher it’s built from.

Conclusion

The Beaufort cipher shows what happens when you flip a single sign in the Vigenère formula. The resulting cipher becomes its own inverse, a genuinely useful property for manual and mechanical cryptography. Yet it remains exactly as vulnerable to Kasiski examination and frequency analysis as the cipher it’s derived from. It’s a clean illustration that mathematical elegance (self-reciprocity) and cryptographic strength are two entirely separate qualities: a cipher can have one without the other.

FAQ

What is the Beaufort cipher?

A polyalphabetic substitution cipher that computes each ciphertext letter as C = (K - P) mod 26, where K is a repeating keyword letter and P is the plaintext letter. This is the reverse-subtraction relative to Vigenère’s C = (P + K) mod 26.

Why is Beaufort called “self-reciprocal”?

Because solving its formula for the plaintext gives back the exact same equation: P = (K - C) mod 26. Running the identical operation on ciphertext with the same key recovers the plaintext, so no separate decryption procedure is needed.

Is the Beaufort cipher more secure than Vigenère?

No. It has the identical keyspace and structural weaknesses. A repeating key still splits the ciphertext into independently-breakable Caesar shifts, vulnerable to the same Kasiski examination and frequency analysis techniques.

What’s the difference between Beaufort and the “Variant Beaufort”?

Beaufort computes C = (K - P) mod 26 and is self-reciprocal. The Variant Beaufort computes C = (P - K) mod 26. This is mathematically the same as Vigenère’s decryption formula used for encryption, and it is not self-reciprocal.

Where was the Beaufort cipher actually used?

Beyond hand ciphers, its reciprocal arithmetic was used in several mechanical rotor cipher machines, notably the Hagelin M-209, where a symmetric encrypt/decrypt mechanism simplified the machine’s design.

References

1. Wikipedia. “Beaufort cipher.” Available at: https://en.wikipedia.org/wiki/Beaufort_cipher

2. Practical Cryptography. “Beaufort Cipher.” Available at: http://practicalcryptography.com/ciphers/beaufort-cipher/

3. Singh, Simon. “The Code Book.” Doubleday, 1999.