Enigma Simulator & Breaker
Encrypt and decrypt with a simulated Enigma M3, or recover an unknown key from ciphertext alone using a rotor, ring and plugboard search — entirely in your browser.
Machine
Left
Middle
Right
Message
- Letters
- 0
- Rotor windows
- —
Enigma is reciprocal: keying the ciphertext with the same settings decrypts it.
Ciphertext
- Letters
- 0
Load an example
The third example carries ten plug pairs — the quick search cannot touch it. It loads the crib attack in Advanced mode, which recovers the key regardless.
What you already know
Anything you can tell the search narrows the space it has to rank — and, as the table below the fold shows, ring settings are worth far more than the rotor order. Leave a box unchecked to search for it.
Left
Middle
Right
Known-plaintext attack (crib)
A crib is a word or phrase you expect the plaintext to contain, such as a routine phrase an operator kept sending. It is the only thing that reliably beats a full ten-pair plugboard: the search deduces the key from the crib instead of scoring how the decryption reads, so the plugboard costs it nothing. A known position is far quicker than trying everywhere the crib could sit.
Thorough search
This climbs a plugboard for every rotor setting instead of a shortlist, which is where the estimate above comes from. The tab has to stay open and the machine awake until it finishes — closing the tab or reloading the page loses the work — and on a short message it may still come back with nothing.
The search covers the standard M3: rotors I–V in any order, either reflector, any ring setting and start position. The plugboard is the hard part. Messages sent without plug pairs come out almost every time, and a handful of pairs usually does, but the ten pairs the Wehrmacht used from 1939 hide a key well enough that finding it takes hours of computation rather than seconds. More ciphertext always helps.
How to use these options
What the quick search manages, by plug pairs
This is the whole story of the tool. A letter only survives a plugboard-blind decryption if the plugboard misses it on the way in and on the way out, so with k pairs steckered only ((26−2k)/26)² of the message comes through unmolested — 100% at zero pairs, 59% at three, 38% at five, and 5% at ten. The index of coincidence the quick search ranks on is a pairs statistic, so its signal falls with roughly the square of that. At ten pairs there is nothing left to rank.
| Plug pairs | Messages recovered | Typical time |
|---|---|---|
| 0 | 92% | ~5s |
| 3 | 89% | ~5s |
| 5 | 61% | ~6s |
| 8 | 3% | ~6s |
| 10 | 0% | — |
What telling it what you know is worth
Figures below are for ten plug pairs unless stated. Ring settings are worth far more than the rotor order: they cut the search enough that the ranking is no longer noise. Knowing everything but the plugboard needs no search at all — it just climbs the plugs.
| You know | 8 pairs | 10 pairs | Time |
|---|---|---|---|
| Nothing | 3% | 0% | ~6s |
| Rotor order | 42% | 0% | ~3s |
| Rotor order + ring settings | 96% | 58% | ~1s |
| Everything but the plugboard | always | always | instant |
The crib attack
Deduction, not statistics. Assume one letter's plug, follow the consequences round the loops the crib makes, and see whether they contradict themselves. A wrong rotor setting contradicts every assumption at once, which is why the plugboard costs the deduction nothing — ten plug pairs, nothing else known, a 180-letter message recovered whole from a 25-letter crib.
Longer cribs are better, because a longer menu closes more loops and loops are what let the deduction rule settings out. A known position is much faster than searching every place the crib could sit. And if the tool says the crib cannot sit anywhere, the guess is simply wrong — try another.
Thorough mode
Climbs a plugboard for every rotor setting instead of a shortlist, because at eight or ten pairs the quick ranking is noise and there is nothing to be clever with. It costs roughly 0.2 ms per setting; a completely unconstrained search is around 55 million settings, so hours — constraints cut that down fast. It can still fail to find the key on a short message. It also runs the quick search alongside and keeps whichever result reads better, so asking for more work can never return a worse answer.
Result
Run a break to see the recovered key and plaintext here.
- Rotors
- —
- Reflector
- —
- Ring settings
- —
- Start positions
- —
- Plugboard
- —
- Index of coincidence
- —
The left ring can't be recovered from ciphertext alone — any ring setting paired with the matching start position gives the same text — so the key shown is an equivalent one.