Pinning this permanently. If you're doing research on this board and you don't know your ciphers, you're not equipped. This thread is the reference. Read it first. Ask questions after.
I'll cover the ones you'll actually run into. Not an exhaustive textbook — a practical guide for the work we do here.
— VK
ROT13
Every letter shifted 13 positions forward in the alphabet. A becomes N. B becomes O. Apply it twice and you're back where you started. It's its own inverse. No key required. Used for casual obfuscation: hiding spoilers, burying metadata, sneaking text into source code where it won't be immediately read. If something looks garbled but roughly the right length, try this first. Takes ten seconds. No excuse not to.
Caesar Cipher
Like ROT13 but the shift is variable. ROT13 is just Caesar with a shift of 13. The shift amount is the key. Without the key you try all 25. Usually faster than it sounds — wrong shifts produce obvious nonsense. Common in beginner-level puzzles. If you see ROT13 and it doesn't yield anything, try other shift values before moving on.
Atbash
Reverses the alphabet. A becomes Z, B becomes Y, and so on. Ancient Hebrew cipher. Shows up occasionally in puzzles with religious, occult, or historical theming. Like ROT13: symmetric, no key, try it fast and move on if it doesn't resolve.
Base64
Not a cipher. An encoding format. Converts binary or text data to a string of letters, numbers, plus signs, forward slashes, and usually trailing equals signs. The equals signs are your first tell. One or two at the end of a string almost always means Base64. It's longer than the original. It uses only characters from a specific 64-character set.
Critically: Base64 is not encryption. It's obfuscation. Anyone can decode it. It's used to hide things in plain sight, not to protect them. Decode it and then check if the result needs further processing — Base64 wrapping another cipher is common.
Vigenère Cipher
Polyalphabetic substitution. Each letter in the plaintext gets shifted by the corresponding letter of a repeating keyword. If the key is four letters long, the first letter shifts by the first key letter, the second by the second, the third by the third, the fourth by the fourth, the fifth by the first again. Repeat. This is what makes frequency analysis harder. The same letter in the plaintext maps to different ciphertext letters depending on position.
You need the key. Without it you're guessing, which is possible but slow. The key is always somewhere. Look for it before you start brute-forcing.
Non-alphabetic characters usually pass through unchanged. Numbers, punctuation, spaces — those are often preserved as-is.
Morse Code
Dots and dashes. Each letter is a unique combination. Spaces between letters; forward slashes or longer spaces between words. You'll encounter this in audio recordings more than in text — slow the audio down, mark each tone, then decode manually or paste into a decoder. The most common mistake is rushing the audio extraction. One missed dot ruins the whole word. Take your time on the audio side; the decoding is easy once the extraction is accurate.
Steganography
Not a cipher — a hiding technique. Information concealed inside other information. Text hidden in an image's pixel data. Audio hidden in another audio file. A message hidden in the first letter of every line. A pattern hidden in the spacing between words. This is the one that requires the most intuition because it doesn't announce itself. You're not decoding. You're noticing. The spectrogram thread covers the audio version in detail. For image steg, start with StegSolve (free, Java-based). For text, read carefully and look for acrostics, every-other-word patterns, formatting inconsistencies.
Chaining
Real puzzles chain methods. Base64 decodes to Vigenère ciphertext. Vigenère decodes to coordinates. Coordinates lead to a page with a steganographic image. The image contains Morse. The Morse decodes to a passphrase. Don't stop when you get something that looks like output. Ask if the output is another input.
The key is somewhere. It was put there deliberately. That's not a platitude. It's architectural. The person who built the puzzle had to put the key somewhere accessible or the puzzle is unsolvable. Find the chain first, then find the keys.
The interactive toolkit is at /toolkit/. Base64, ROT13, Vigenère, and Morse. All browser-based, nothing sent anywhere. Use it.
This thread stays open for questions and additions. — VK
◆ "The truth isn't hidden. It's just that most people aren't looking."