“These hieroglyphics have evidently a meaning. If it is a purely arbitrary one it may be impossible for us to solve it. If, on the other hand, it is systematic, I have no doubt that we shall get to the bottom of it.”

Sherlock Holmes in The Adventure of the Dancing Men, written by Sir Arthur Conan Doyle, 1905

Introduction

In my previous post, I introduced the cipher puzzle mechanic. This mechanic is a great one to use in TTRPGs, since ciphers have a long history, and are therefore easy to incorporate into our narratives; and because even easy ciphers are a lot of fun. I also introduced a few well-known ciphers, the Caesar Shift cipher and the Pigpen cipher. Now I’m going to walk you through the steps of designing your own cipher puzzle for your game in detail. I’ll finish with descriptions of and ideas for two more sample ciphers, the Polybius Square and Morse Code.

Designing Ciphers

Designing a cipher for your game session is easy. Below are the steps that I follow in order. I’ll list them here, then expand on them one at a time:

1. Decide how the cipher fits into the story.
2. Create your cipher key.
3. Encode your message using your key.
4. Give the cipher to your players.
5. Watch your players solve the cipher.

Decide how the cipher fits into your story

The first step in making your cipher is figuring out how the cipher will fit into your story. The reason that this step should occur first is that it affects what kind of cipher you’ll want to use. Certain types of ciphers support one type of story more than another, so choosing the “right” cipher helps you keep your players engaged in the story.

The main distinction is between ciphers that will represent a deliberate attempt by someone to disguise a message in a known language, such as in a note passed between two conspirators, versus a cipher that will represent a foreign language of some sort, such as the ancient inscriptions in the gnomish warlord’s tomb. Ciphers like the Caesar shift are easy to present as the code used by a secret society, thieves’ guild, or other such group to protect their sensitive communications. However, you will have a harder time convincing your players that it is also the script of an ancient draconic nation. For that draconic language, you might want to look at a cipher that uses an alternate font (such as Neale Davidson’s incredible fantasy fonts at https://www.pixelsagas.com/). However, you might not want to use that same font for messages coordinating smuggling at the waterfront unless the smuggling gang is run by dragonborn.

This isn’t to say that you can’t use a Caesar shift cipher for the obscure language of a secret group of dwarven witches. Especially if your players are younger, such a simple cipher may be exactly what you need. Just make sure that your cipher supports your players’ immersion in the story.

You also want to think about whether you plan to give your players the cipher key at some point, or if you plan for them to solve the cipher via brute force, that is, via logic. This is not a binary choice; you can choose to give your players part of the cipher key, and hope that they can fill in the rest. However, different types of ciphers lend themselves to this process better than others. In a sequential cipher like a Caesar shift, you technically only need to know one letter-ciphertext pair, and you can easily solve the rest. A pigpen cipher, assuming that it is sequential, presents a similar opportunity. However, not every cipher type works that way, and if you choose a nonsequential cipher, you should likely plan to give your players more of the cipher key, or some other form of assistance, so that they have fun while solving the cipher.

Create your cipher key

The second step is creating your cipher key. You should do this before you try to encode your message, because it will make encoding much easier for you. This can be as simple as writing two columns, one for the symbols’ actual meaning and one for the cipher text. For certain existing ciphers, like Morse code or a pigpen cipher, you can even find and print out a key online. If you want to use an alternate font, you may have to install the font on your computer, type out two rows of letters using it, and then change the font of one of the rows to your desired cipher font.

What if your cipher isn’t written down? Many historical ciphers usually weren’t. For example, Morse code uses signal duration to encode a message. This could be represented in writing with dots and dashes; but more commonly, it was communicated by audio with short and long beeps. Some ciphers are primarily visual: Semaphore encoded messages using flags, and the Polybius Square cipher was allegedly created to allow communication via signal fires. In the realm of fiction, Arthur C. Clarke imagined an alien species in his Rendezvous with Rama book series that communicated with pulses of different colored lights. It would be relatively easy for you to design a substitution cipher using this principle (different brightnesses, different colors).

In that case, you still want to represent your cipher on a page as a series of symbols that correspond to letters. If you can’t, that’s a sign that it will be incredibly hard for your players to learn and document the cipher. And in that case, you may want to rethink your cipher concept, because your cipher may be anti-fun.

Encode your message using your key

Once you have your cipher key in hand, you can now create your encoded messages. First, write out the message that you plan to encode, then use your key to write the cipher either above or below it, character by character. This new, garbled message is your ciphertext. Then, transfer that ciphertext to another sheet of paper or document, so that you have a copy that has nothing but the encoded version on it. This is your cipher!

If your cipher is in a medium other than printed text, you may need to use other tools, such as recording or presentation software, to prepare your cipher.

Give the cipher to your players

How you will give the cipher to your players will depend on how you decided to incorporate it into your story. For example, if you have decided that this cipher will be an encoded note from a corrupt baron to his assassins, telling them where and when to attack the princess, then your players might find it in the gear of one of those assassins, or it might be brought to them by the disloyal messenger, who knows that the message is important but can’t read it. In that case, when the players “find” the message, you can hand them the crumpled piece of paper on which you wrote your ciphertext.

On the other hand, perhaps your cipher tells how to open a magical door in a dungeon. In that case, you might draw a simple picture of an archway and trace your cipher around its circumference. Then, when you tell your players that they see an archway carved into the wall, covered with runes, you can hand them the picture and say, “It looks like this!”

If your cipher isn’t written, you need to think a bit more carefully about this. For example, if your players observe that there are strange flashes of light on the deck of a supposedly legitimate merchant ship, how will you represent those flashes for them? You could write out the series of flashes as short/long, bright/weak, or whatever your cipher principle is, on paper. You could also suddenly pull out a flashlight and actually “flash” them the code! Or, you could record a timed presentation in presentation software such as Microsoft Powerpoint, or a video of the light sequence using a phone video camera.

Et cetera. What is important is that the way that you give the cipher to your players should support and reinforce the shared story.

Watch your players solve the cipher

Finally, the best part: Watching your players engage with the mystery that you’ve created through this puzzle!

In general, my experience has been that you want to give your players the cipher before you give them the cipher key. The reason for this is to create the tension that is part of our enjoyment of a story. If your players find the cipher key first, then less tension is created when they see the cipher; they know exactly how to translate it. On the other hand, if you first introduce the cipher, now you’ve posed a question to them: How will you find out what this means? Because they are engaged in the story with you, they will want to find out the answer; and when they do, that will release the tension and create enjoyment.

That said, this creates an interesting conflict at the game table. Your players will want to solve the cipher as soon as they get it, because their assumption is that solving it will reveal something fun or useful. The result is that most players will almost certainly try to crack the cipher via brute force as soon as they get it. If you don’t want them to solve it that way, the easiest solution is to just make it a more complex cipher. E.g., avoid using a Caesar shift more than once. I’ll discuss other ways to make even simple ciphers harder to crack in my next post.

Example: The Polybius Square Cipher

The Polybius Square cipher dates back at least to the Roman Empire. Ancient militaries struggled with the need to send complex messages over long distances, and the Polybius Square was one way to transform letters into a simple sequence of numbers. Messages could then be communicated with torches, which were easy to see from a long distance away.

A Polybius Square cipher creates a table with five rows and five columns, each labeled 1 through 5. Each letter is assigned to one of those twenty-five squares, with “I” and “J” normally sharing a square. Then, as long as both the sender and receiver have a copy of the same table, the letter can be communicated by writing the row and column number of that letter.

For example, Figure 1 shows a simple Polybius Square cipher starting with the letter “A” and continuing sequentially:

• 1,1 would signal “A” (row 1, column 1)
• 1,3 would signal “C” (row 1, column 3)
• 4,4 would signal “T” (row 4, column 4)

Et cetera. So, to write the message, “AMBUSH AHEAD,” the ciphertext would be:

1,1; 3,2; 1,2; 4,5; 4,3; 2,3; 1,1; 2,3; 1,5; 1,1; 1,4. 

The cipher table does not need to be sequential, of course. One method of complicating the cipher without being random is to start the sequence with a code word or phrase, and then input all of the remaining letters alphabetically after that. For example, Figure 2 shows a Polybius Square cipher encoded with the phrase “ORCS RULE.” The first letters in the square are O-R-C-S-U-L-E (R only appears the first time it is used), and then A-B-D-F (not C or E, because they have already been used). Then, all a person needs to know is the code word or phrase to recreate the cipher key table on their end and decipher the associated number sequence.

As suggested by its history, a Polybius Square cipher can be communicated with a variety of media. The number pairs can be communicated with torches or any other discrete objects. They can also be written down on paper, scratched into wood or metal, or otherwise communicated in writing. They could even be shared with some sort of sound, such as a ringing bell or firing rifle. If the cipher also involves a code word, that can be transmitted verbally or in writing, in advance or along with the message.

Additionally, there’s nothing that requires the headers of the table columns or rows to be numbers. You could replace the numbers in one or both with symbols, sounds, or words of any time. For example, if your rows were colors and your columns were symbols, a message might read “green leaf” instead of “1,1” for “A.” Such a cipher will be hard for your players to crack without knowing the appropriate order of values for the rows and columns.

Example: Morse Code

Morse code was initially invented by Samuel Morse in 1837 to allow messages to be sent via electrical signals. A user at one end would tap out a number sequence into a device, which would send an electrical signal to another device, which would in turn imprint that sequence into a strip of paper. Morse’ original version apparently only transmitted numbers; his expectation was that someone could then look that number in a codebook, perhaps like a Polybius square, to find its alphabetic value. Over the next decade, the cipher evolved both to add sequences for the individual letters and to remove the paper tape, becoming a primarily aural cipher.

As shown in Figure 3, letters and numbers In Morse code are communicated via a series of short and long pulses, called “dits” and “dahs,” or “dots” and “dashes,” respectively. In general, the more common a letter was, the fewer signals were needed to communicate it. Therefore, the letter “E” (the most common letter in English writing) is communicated with only one dit, while the rarely used letter “Q” requires four signals: two dahs, a dit, and another dah. Extra space is allotted between letters and words so that a listener can distinguish between the signals.

Like the Polybius Square cipher, Morse code can be used in a variety of contexts. It can be communicated with drum beats, musical notes, or taps on a window or dungeon cell bars. It can be hidden in writing, for example, along the border of a letter or map as a series of seemingly random scrawls, or as a few scratches or dabs of paint on the corner of a shipping crate full of illicit magical reagents. It can be communicated via flashes of light, such as from a hooded lantern on the deck of a ship or by reflecting a sunbeam off of a small mirror. But it can also be communicated in many other physical ways, such as knots woven into a rope or even the weave of a knitted cloak, or taps of a finger on a tabletop by a merchant’s son being held against his will. The hard part isn’t coming up with a way to disguise the code, the hard part is making sure that your players recognize it as a code when they see it!