The Bifid Cipher

The Bifid Cipher: Scrambling the Coordinates Themselves

Introduction

The Polybius square converts each letter into a row/column coordinate pair, but on its own that’s just a disguised monoalphabetic substitution. Every letter still maps to one fixed pair, every time. So frequency analysis works exactly as well against the coordinate pairs as it does against plain ciphertext letters. Félix Delastelle’s Bifid cipher, published in 1901, fixes this by doing something genuinely different. It doesn’t just convert letters to coordinates; it scrambles the coordinates themselves across the whole message before converting back to letters. The result is a cipher where a single plaintext letter’s fate depends on every other letter’s position in the message. That’s a real leap in sophistication beyond simple substitution.

Table of Contents

• How the Bifid Cipher Works
• A Worked Example: Encryption
• Decryption: Reversing the Scramble
• Why This Defeats Simple Frequency Analysis
• Pros and Cons Analysis
• Cryptanalysis and Breaking the Bifid Cipher
• Beyond Bifid: The Trifid Cipher
• Modern Relevance
• Python Implementation
• Limitations
• Conclusion
• FAQ
• References

How the Bifid Cipher Works

Bifid starts exactly like the Polybius square: a 5×5 grid (optionally keyed, I and J sharing a cell) gives every letter a row and column coordinate. From there, encryption proceeds in two distinct steps:

1. Fractionate: for every letter in the message, look up its (row, column) pair. Write down all the row values first, then all the column values, as one long combined sequence.
2. Recombine: read that combined sequence back off two numbers at a time, starting from the beginning. Each new pair of numbers is treated as a fresh (row, column) coordinate, but now referring to a completely different position than any original letter’s coordinate. Look that up in the grid to produce the ciphertext letter.

In real historical use, Bifid was almost always run with a keyed square (built from a keyword exactly like a keyed Polybius square) and a fixed period: encrypting the message in short, separately-fractionated chunks rather than as one continuous block. The unkeyed, whole-message version worked through below is the cleanest way to see the mechanism. But it isn’t how the cipher was typically deployed in practice. See Cryptanalysis below for why the period matters.

Interactive Visualizer

Try it above. Watch the coordinate stream fill in for each letter (all rows, then all columns), then watch it get re-read two numbers at a time to produce the scrambled ciphertext.

A Worked Example: Encryption

Using the standard unkeyed grid (A-Z in order, I and J sharing a cell) and plaintext “HELLO”:

    1  2  3  4  5
1   A  B  C  D  E
2   F  G  H  I  K
3   L  M  N  O  P
4   Q  R  S  T  U
5   V  W  X  Y  Z

(I and J share row 2, column 4 in this grid, exactly as in the unkeyed Polybius square covered earlier in this series.)

Letter	Row	Column
H	2	3
E	1	5
L	3	1
L	3	1
O	3	4

Writing all rows, then all columns, gives the combined stream: 2 1 3 3 3 3 5 1 1 4

Reading that stream two numbers at a time gives five new coordinate pairs: (2,1), (3,3), (3,3), (5,1), (1,4). Looking each of these up in the grid:

• (2,1) → F
• (3,3) → N
• (3,3) → N
• (5,1) → V
• (1,4) → D

“HELLO” → “FNNVD”

Notice something striking: the two L’s in “HELLO” (identical letters, identical coordinates) encrypt to the same ciphertext letter here. That’s not guaranteed in general, though. The recombination step mixes coordinates from different original letters together. So two identical plaintext letters at different positions in a longer message will often encrypt to different ciphertext letters. That’s unlike a plain substitution cipher, where identical letters always encrypt identically.

For a visible example of that, take a slightly longer message: “LOYAL” has an L at position 0 and another at position 4, five letters apart. Fractionating and recombining the whole five-letter block mixes each L’s coordinates with different neighboring letters’ coordinates, depending on where in the combined stream they land. So the two L’s, despite being identical plaintext letters, end up encrypted to two different ciphertext letters. (Try it in the visualizer above: enter “LOYAL” and encrypt it to see this directly.) As with every cipher in this series, non-letter characters (spaces, punctuation, digits) are conventionally stripped out before fractionation begins; only letters contribute to the coordinate stream.

Decryption: Reversing the Scramble

Decryption undoes both steps in reverse order:

1. Extract: for every ciphertext letter, look up its (row, column) pair and write them down interleaved, one letter’s full pair at a time: row, column, row, column, and so on.
2. Split: that interleaved stream is exactly the same length as the original combined stream. Split it exactly in half. The first half becomes the plaintext letters’ row values (in order); the second half becomes their column values (in order).
3. Recombine: pair up the first half’s i-th value with the second half’s i-th value, and look that coordinate up in the grid to recover plaintext letter i.

Applying this to “FNNVD”: extracting each letter’s coordinates and interleaving them reproduces the exact stream 2 1 3 3 3 3 5 1 1 4, the same stream produced during encryption. Splitting it in half gives rows [2,1,3,3,3] and columns [3,5,1,1,4], and pairing them back up recovers H, E, L, L, O exactly.

Walking through the first two recovered letters concretely: the first row/column pair after splitting is (row=2, column=3). That’s the first entry of the rows half paired with the first entry of the columns half. It looks up to H in the grid, exactly the first letter of “HELLO.” The second pair is (row=1, column=5), which looks up to E, the second letter. The remaining three pairs, (3,1), (3,1), and (3,4), recover L, L, and O the same way.

Why This Defeats Simple Frequency Analysis

A plain Polybius square is just a monoalphabetic substitution wearing a coordinate-pair disguise: E always becomes “15”, so counting the most frequent digit pair in the ciphertext instantly reveals E. Bifid breaks this completely. A letter’s row gets separated from its column and mixed together with other letters’ rows and columns before being re-paired. So no single ciphertext letter corresponds to one fixed plaintext letter. The same plaintext letter can produce different ciphertext letters depending on its position and its neighbors, and the same ciphertext letter can arise from different plaintext letters. This property, called fractionation, is why Bifid resisted casual cryptanalysis far longer than simple substitution or even Playfair-style digraph ciphers.

Pros and Cons Analysis

Advantages	Disadvantages
Defeats Single-Letter Frequency Analysis: No fixed one-to-one mapping between plaintext and ciphertext letters exists	Complex to Perform by Hand: Requires carefully tracking two full passes over the message, a real step up in manual effort from any single-grid cipher
Genuine Diffusion: Changing one plaintext letter near the start of a long message can affect the coordinates recombined near the end, spreading influence across the ciphertext	Whole-Message Coupling Can Be a Weakness Too: Very long messages processed as one block create statistical regularities that specialized attacks can exploit; real usage typically splits messages into shorter “periods”
A Real Conceptual Leap: Introduces the fractionation principle that underlies stronger classical ciphers, including ADFGVX	Still Ultimately a Classical Cipher: No protection whatsoever against modern computational cryptanalysis
Historically Well-Regarded: Considered one of the strongest hand ciphers of its era, genuinely difficult for period cryptanalysts to break without modern computing	Error-Prone to Compute Manually: A single misplaced coordinate during the lengthy manual process corrupts the rest of the decryption

Cryptanalysis and Breaking the Bifid Cipher

Bifid resists naive frequency analysis, but it isn’t unbreakable, even by hand-era standards. Cryptanalysts developed specialized techniques exploiting the fact that:

• Digraph and trigraph statistics still leak through, in a more diffuse form, since the underlying letters and their approximate neighborhoods still influence the coordinate stream.
• Longer messages processed without splitting into shorter blocks (a technique called using a “period”) create more exploitable statistical regularities than shorter, period-limited blocks. This is why real-world Bifid usage typically encrypts a message in short chunks rather than as one giant block, deliberately limiting how far fractionation’s influence can spread. Recovering an unknown period is itself a statistical exercise. Analysts commonly look at how often specific letter-pairs recur at a distance of roughly half the candidate period apart. That’s exactly the separation at which the fractionation-and-recombination arithmetic tends to reintroduce detectable bigram regularities. This works without needing to fully break the cipher just to estimate that one parameter.
• Known or partial plaintext, combined with the constraint that recovered coordinates must form a valid, consistent grid, can allow systematic reconstruction of both the key square and the message.

None of this makes Bifid weak by the standards of its time. It remained a serious, respected hand cipher well into the 20th century, but it offers no security whatsoever against modern automated cryptanalysis.

Beyond Bifid: The Trifid Cipher

Delastelle didn’t stop at two dimensions. His Trifid cipher extends the same fractionation idea to a 3×3×3 cube of 27 cells (enough for the alphabet plus one extra symbol), giving each letter three coordinates instead of two. The combine-and-re-split process works the same way, just with three interleaved coordinate streams instead of two. That spreads each letter’s influence even further and makes the cipher correspondingly more resistant to the cryptanalysis techniques that eventually chip away at Bifid. The core insight is identical; Trifid simply adds one more dimension to fractionate across.

Modern Relevance

Bifid has no role in modern security, but its influence is genuine:

• Introduced fractionation as a serious cryptographic technique, directly inspiring later field ciphers like ADFGVX, which combines Polybius-style fractionation with columnar transposition.
• Remains a popular recreational and puzzle-hunt cipher today, prized specifically because it resists casual, naive attack attempts far better than simpler classical ciphers.
• Serves as a genuine conceptual bridge toward the modern cryptographic principle of diffusion: spreading the influence of each plaintext bit across many ciphertext bits, which Claude Shannon would later formalize as one of the two pillars (alongside confusion) of secure cipher design.

Python Implementation

The fractionate-then-recombine idea translates directly into two list operations: split each letter’s coordinates apart, then zip them back together at a different offset:

ALPHABET = 'ABCDEFGHIKLMNOPQRSTUVWXYZ'  # 25 letters, J merged into I

def generate_square(key):
    key = key.upper().replace('J', 'I')
    key = ''.join(c for c in key if c.isalpha())
    square = []
    seen = set()
    for char in key + ALPHABET:
        if char not in seen:
            seen.add(char)
            square.append(char)
    return square

def find_position(square, char):
    if char == 'J':
        char = 'I'
    return divmod(square.index(char), 5)

def bifid_encrypt(text, square):
    text = text.upper().replace('J', 'I')
    text = ''.join(c for c in text if c.isalpha())
    positions = [find_position(square, c) for c in text]
    rows = [r for r, c in positions]
    cols = [c for r, c in positions]
    stream = rows + cols  # all rows first, then all columns
    result = ''
    for i in range(0, len(stream), 2):
        r, c = stream[i], stream[i + 1]
        result += square[r * 5 + c]
    return result

def bifid_decrypt(ciphertext, square):
    positions = [find_position(square, c) for c in ciphertext]
    stream = []
    for r, c in positions:
        stream.append(r)
        stream.append(c)  # interleaved this time, not grouped by letter
    half = len(stream) // 2
    rows, cols = stream[:half], stream[half:]
    result = ''
    for r, c in zip(rows, cols):
        result += square[r * 5 + c]
    return result

if __name__ == "__main__":
    square = generate_square("")  # unkeyed grid, matching the worked example above
    plaintext = "HELLO"

    ciphertext = bifid_encrypt(plaintext, square)
    recovered = bifid_decrypt(ciphertext, square)

    print(f"Plaintext:  {plaintext}")
    print(f"Ciphertext: {ciphertext}")
    print(f"Recovered:  {recovered}")

This reproduces the worked example above exactly: HELLO → FNNVD → HELLO. The two Ls happen to encrypt to the same letter here, matching the coincidence noted earlier in this article; trying "LOYAL" through the same functions instead produces two different ciphertext letters for its two Ls.

Limitations

This implementation covers the mechanism described above, not a historically faithful deployment:

• No period support. As the Cryptanalysis section explains, real Bifid usage splits messages into short, separately-fractionated chunks. This code always fractionates the entire message as one block, the simpler (and, per that section, more attackable) whole-message version.
• English letters only, formatting is lost. Spaces, punctuation, and case are stripped before fractionation begins, same as the visualizer.
• No keyword validation. generate_square will accept any string, including one with no letters at all, and just falls back to the plain alphabet without warning.
• Not intended for real security. As the Modern Relevance section notes, Bifid was a genuinely strong hand cipher in its era, but it offers no protection against modern computational cryptanalysis, regardless of implementation quality.

Conclusion

The Bifid cipher marks a real turning point in this series: every cipher covered so far has been some form of substitution or transposition, but Bifid is neither purely one nor the other. It fractionates letters into coordinates, scrambles those coordinates together across the whole message, and reassembles them into new letters. That combination gives it genuine resistance to the frequency analysis techniques that break every simpler cipher in this collection. It also directly foreshadows the diffusion principle at the heart of modern cipher design.

FAQ

What is the Bifid cipher?

A fractionating cipher, invented by Félix Delastelle, that converts each letter to a Polybius-square coordinate pair, writes all the rows followed by all the columns as one combined stream, then re-reads that stream two numbers at a time to produce new coordinates for the ciphertext letters.

How is Bifid different from a plain Polybius square?

A plain Polybius square just converts letters to coordinates with no further scrambling. It’s a monoalphabetic substitution in disguise. Bifid adds a genuine scrambling step (fractionation) that mixes coordinates from different letters together before converting back to letters, so there’s no fixed one-to-one letter mapping to exploit.

Why doesn’t frequency analysis work well against Bifid?

Because a plaintext letter’s ciphertext depends on its position and its neighbors’ coordinates, not just its own identity. The same plaintext letter can produce different ciphertext letters in different contexts, breaking the fixed correspondence that frequency analysis relies on.

Is the Bifid cipher secure?

Not by modern standards; no classical cipher is. But it was genuinely one of the stronger hand ciphers of its era, resisting naive cryptanalysis far better than simple substitution or single-grid digraph ciphers like Playfair.

What’s the relationship between Bifid and Trifid?

Both were invented by Félix Delastelle and use the same fractionation principle. Bifid uses a 2D 5×5 grid (two coordinates per letter); Trifid extends this to a 3D 3×3×3 cube (three coordinates per letter), spreading each letter’s influence even further and increasing resistance to cryptanalysis.

References

1. Wikipedia. “Bifid cipher.” Available at: https://en.wikipedia.org/wiki/Bifid_cipher

2. Practical Cryptography. “Bifid Cipher.” Available at: http://practicalcryptography.com/ciphers/bifid-cipher/

3. Singh, Simon. “The Code Book.” Doubleday, 1999.