Null Cipher
Published 29 Sep 2026 · · 7 min read
A null cipher does not disguise a letter — it hides which letters are the message. Every character in the transmitted text is a perfectly ordinary character. Only the positions are secret, and an attacker who does not know the rule has no ciphertext to attack at all, only a letter about the weather.
- Era
- Medieval
- Type
- Substitution
- Key space
- carrier text + position rule
- Level
- Field
IPhenomenon
Here is a cover sentence: THE WEATHER HOLDS FAIR AND THE LOOM KEEPS ITS OWN COUNSEL ALL OF THE LONG DAY.
Read every fifth letter from the start and you get W H D A H K T N A H G A — which is not a message, because this cover was not written to carry one. But suppose the rule is read every fifth letter backwards from the end, or read the last letter of each word, or the acrostic rule read the first letter of each line.
The bench writes nulls in the simplest mechanical form: the plaintext letters are dropped into position N of each block of N characters, and the gaps are filled from a fixed carrier sentence.
| Rule | Where the message hides | Detectability |
|---|---|---|
| every Nth character | mechanical, easy to automate | low, if the cover reads naturally |
| first letter of each sentence | acrostic | very low |
| last letter of each word | word-final | low |
| Nth word of each sentence | word-level | lowest |
The word-level variants are the strongest, because normal prose has highly variable word lengths and sentence lengths, and variation is camouflage. A mechanical every-fifth-character rule makes the cover text stilted — and stilted prose is itself a signal.
IIKey space
The key is a pair: the carrier text plus the position rule. Neither alone is sufficient, and both are chosen freely, which means the theoretical space is unbounded.
That is an unusual property in this collection. Almost every other cipher here has a keyspace you can write as a number. The null cipher's keyspace is the number of sentences a person could plausibly write — which is not a number anyone can search, and also not a number anyone can administer.
Unbounded keyspace is not the same as strong cryptography. If your rule is memorable, it is guessable; if it is not memorable, you will not remember it under pressure.
The historical compromise, used by prisoners of war and by agents in occupied territory, was to use a rule that is not a secret at all: the text that happens to be in front of you. A passage from a book both parties own is enough.
IIIEnciphering
- Write the plaintext and strip it to letters.
- Choose the stride N — the distance between message letters.
- For each plaintext letter, take a block of N characters and place the letter at the final position of the block.
- Fill the preceding N-1 positions with ordinary words or letters drawn from a carrier text.
- Read the whole thing aloud. If it sounds like a person wrote it, keep it; if it sounds like a machine, rewrite the filler.
- Send only the cover. Never send the rule through the same channel.
IVDeciphering
- You must already know the rule. No amount of analysis recovers it from a single message, because there is no ciphertext in the cryptographic sense — there is only prose.
- Apply the position rule mechanically: take every Nth character, or the first letter of each sentence, or the last letter of each word.
- Write the extracted letters in order and re-split them into words using context.
- Watch for the sender inserting an extra filler letter to break an awkward run — good cover text is rarely perfectly regular, and the receiver is expected to cope.
- If the extraction yields nothing readable, try the same rule anchored at the end instead of the start, and try reversing the result. Both are common.
VWeakness
Statistical detection of the carrier. Running text is not uniform. A mechanical every-Nth rule distorts the cover's own letter distribution, and a chi-square test against normal language will flag a suspiciously flat or suspiciously regular passage.
The rule is small. There are only so many plausible “every Nth character” and acrostic conventions, and a trained analyst tests all of them in an afternoon, on every intercepted document, automatically.
Traffic analysis beats content analysis. Even an unbroken null cipher reveals who wrote to whom, when, and how long the letter was. In an intelligence context that is frequently enough.
It is fragile under pressure. The whole scheme depends on producing natural-looking prose in a hurry. Under interrogation or time pressure, cover text becomes mechanical, and mechanical text is exactly what the detector is looking for.
VIPractice
Ciphertext
THEWL ATHEO HOLDO FAIRM NDTHS OLDBK ASSLE OMKEE PSITP OWNCS UNSEE INTHC LOWLR TROOE WHILT THEPS
Hint: Stride of five: read the last character of each five-letter block.
Reveal the answer
Plaintext
LOOMS KEEP SECRETS
·History note
Null ciphers appear in the ancient world as acrostics — Hebrew psalm 119 is built on an alphabetic acrostic — and their military use is documented from the Renaissance onward. A famous twentieth-century case is the message sent from a German prisoner-of-war camp to his family in 1942, in which the first letter of each word of an innocuous letter spelled out a complaint that was subsequently confirmed; the camp censor passed it. During the Second World War, the British censorship service ran routine checks for acrostic and every-Nth patterns on prisoner mail in both directions, which tells you both how common the technique was and how well understood its detection was.
·Further reading
Null ciphers are the direct ancestor of steganography — hiding the existence of a message rather than its content. Modern steganography embeds data in the least significant bits of an image or in the timing jitter of network packets, and it inherits exactly the same weakness profile: the capacity is small, the rule is short, and the statistical signature is detectable if anyone looks.
The distinction is worth fixing in place: cryptography makes a message unreadable, steganography makes it unnoticed. Real systems use both, and neither one alone is a security strategy.
Next on the loom: book-cipher — a secret that is not a rule but a shared object.
+Weave into
Book Cipher
A book cipher replaces the alphabet with a book. Every letter is written as a position — page, line, word…
Nomenclator
A nomenclator is half cipher, half dictionary. It substitutes letters as usual but also assigns its own…
Cardan Grille
Girolamo Cardano's grille is a sheet of stiff paper with holes cut in it. Lay it over a blank page, write…