Scytale — Bench tool
Published 5 Sep 2026 ·
The scytale does not rename letters — it shuffles them. Wind a strip of leather around a wooden staff, write across the turns, unwind. The letters are all still there, in plain sight, in the wrong order. Every transposition cipher for the next two thousand years is a refinement of this one move.
- Era
- Antiquity
- Type
- Transposition
- Key space
- staff diameter
- Level
- Starter
IWhat this tool does
Take the plaintext and write it in rows of n letters, where n is the number of faces on the staff. Then read it off in columns instead of rows.
With n = 4 and the message LOOM KEEPS ITS OWN COUNSEL:
| L | O | O | M |
| K | E | E | P |
| S | I | T | S |
| O | W | N | C |
| O | U | N | S |
| E | L |
Reading down each column and left to right gives LKSOOE OEITWUL OETNN MPSCS — every letter is still present, and not one of them means what it used to.
The crucial difference from Caesar: letter frequencies are unchanged. The count of E in the ciphertext is exactly the count of E in the plaintext. Only the positions were attacked.
IIThe key
The key is the diameter of the staff — a piece of wood, not a number. That is charming and impractical in equal measure.
Because the diameter is continuous in principle, the effective key space is the set of divisors of the message length. For a 60-letter message, the divisors are 1, 2, 3, 4, 5, 6, 10, 12, 15, 20, 30, 60; discard 1 and 60 (they are the identity) and 10 remain. That is under three and a half bits — smaller than the Caesar space.
Worse, the attacker does not need to guess. Each plausible diameter produces a candidate plaintext, and language is instantly recognisable. Fifteen guesses is a coffee break.
This is the recurring lesson of transposition: the keyspace is not the number of physical objects, it is the number of distinctions those objects can make about this particular message.
IIIWhat it will not protect
Historical ciphers are for study and recreation and are not suitable for protecting real information. The full analysis is in the cipher entry.
Read the full entry, with deciphering steps and weakness analysis →