Vigenère Cipher vs Autokey Cipher: Why Repeating the Key Changes Everything

Repeating-key Vigenère and plaintext autokey can begin with the same word, use the same A=0 through Z=25 arithmetic, and encrypt the same plaintext.

They stop behaving like the same cipher as soon as that starting word is exhausted.

Take:

Starting word:
RAVEN

Plaintext:
SENDTHEPACKAGEBEFORENOON

Repeating-key Vigenère extends RAVEN by cycling it:

RAVENRAVENRAVENRAVENRAVE

Plaintext autokey extends the same five-letter primer with earlier plaintext:

RAVENSENDTHEPACKAGEBEFOR

The first five positions are therefore identical.

After position 5, the keystreams diverge.

The verified ciphertexts are:

Repeating-key Vigenère:
JEIHGYEKEPBABIOVFJVREOJR

Plaintext autokey:
JEIHGZICDVREVEDOFUVFRTCE

That one design decision—repeat the key, or feed plaintext into the key—changes the cipher’s periodicity, its most natural cryptanalytic attacks, its decryption state, and its response to transmission errors.

University of Central Florida cryptography notes make the historical motivation explicit: repetition in Vigenère enables periodic analysis, while autokey was introduced to prevent the same key letter from encrypting every fixed-distance plaintext position.

If you simply need standard Vigenère encoding or decoding, use the Vigenère Cipher Decoder and Encoder. This page compares the two keystream designs rather than teaching either one from scratch.

The arithmetic is the same

Both schemes in this comparison use:

A = 0
B = 1
...
Z = 25

and encryption:

Cᵢ = (Pᵢ + Kᵢ) mod 26

The difference is how Kᵢ is generated.

For a repeating key of length r:

Kᵢ = keyword[i mod r]

For plaintext autokey:

Kᵢ = primerᵢ

during the primer, then:

Kᵢ = Pᵢ₋ᵣ

after the primer.

So the comparison is not:

different alphabet
different addition rule
different modulus

It is:

same arithmetic
different keystream generator

That makes the cryptanalytic consequences easier to isolate.

The first r positions are identical

With:

RAVEN

both schemes begin with exactly the same five shifts.

Plaintext:

S E N D T

Key:

R A V E N

therefore encrypts to:

J E I H G

in both systems.

The ciphertext prefixes match:

JEIHG

That is expected.

Nothing distinguishes repeating-key Vigenère from plaintext autokey until the initial word has been consumed.

At position 6, the rules split.

Position 6 is the first decisive difference

The plaintext at position 6 is:

H

Repeating-key Vigenère

The keyword cycles back to its first symbol:

R

So:

H = 7
R = 17

7 + 17 = 24
→ Y

Plaintext autokey

The keystream now takes plaintext position 1:

S

So:

H = 7
S = 18

7 + 18 = 25
→ Z

That creates the first ciphertext difference:

repeating key: Y
autokey:       Z

Every later difference follows from the two different keystream rules.

Complete side-by-side example

For the full message:

Plaintext:
SENDTHEPACKAGEBEFORENOON

the two key streams are:

Repeating:
RAVENRAVENRAVENRAVENRAVE

Autokey:
RAVENSENDTHEPACKAGEBEFOR

and the outputs are:

Repeating-key ciphertext:
JEIHGYEKEPBABIOVFJVREOJR

Autokey ciphertext:
JEIHGZICDVREVEDOFUVFRTCE

Both decrypt back to:

SENDTHEPACKAGEBEFORENOON

when the correct scheme and starting word are used.

The same visible word RAVEN is therefore not enough to identify the cipher.

A decoder must know whether RAVEN is:

a repeating keyword

or:

an autokey primer

Repeating-key Vigenère creates an exact short period

For a five-letter keyword:

RAVEN

the keystream satisfies:

Kᵢ = Kᵢ₊₅

for every position where both sides exist.

In a 600-letter controlled example, there are:

595

pairs separated by five positions.

For repeating-key Vigenère, all:

595 / 595

match.

That is:

100%

keystream equality at lag 5.

This is not a statistical tendency.

It is built into the construction.

The same shift sequence returns every five letters.

Plaintext autokey has a delay, not a repeating keyword period

With a five-letter primer, plaintext autokey does not satisfy:

Kᵢ = Kᵢ₊₅

as a rule.

After the primer:

K₆ = P₁
K₇ = P₂
K₈ = P₃
...

and five positions later:

K₁₁ = P₆
K₁₂ = P₇
...

Whether those letters happen to match depends on the plaintext.

In the same 600-letter controlled sample, only:

39 / 595

lag-5 autokey symbols match, or:

6.6%

The exact five-character cycle has disappeared.

The primer still creates a five-position feedback delay, but that is not the same thing as a five-position repeating keystream.

Why that difference matters to classical period attacks

A repeating-key Vigenère ciphertext can be split by keyword position.

For a five-letter key:

column 1:
positions 1, 6, 11, 16, ...

column 2:
positions 2, 7, 12, 17, ...

...

Every letter in column 1 was shifted by the same key letter.

Every letter in column 2 was shifted by another fixed key letter.

Once the period is known, each column becomes a Caesar-shift problem.

That is why tools such as:

• Kasiski examination;
• average-column Index of Coincidence;
• Friedman estimation;
• autocorrelation;

are naturally associated with repeating-key Vigenère.

The site’s key-length methods comparison benchmarks exactly that repeating-period problem.

Plaintext autokey breaks the fixed-column assumption after the primer.

The same column number no longer guarantees the same shift.

A 600-letter IC test shows the structural difference

The same verified 600-letter English plaintext was encrypted twice with starting word RAVEN:

scheme 1:
repeating-key Vigenère

scheme 2:
plaintext autokey

Candidate periods 2 through 15 were scored with average-column IC.

The strongest repeating-key results were:

The five-letter structure and its multiples rise strongly.

For plaintext autokey, the strongest values were:

The autokey result does not produce the same clean period-5 signature.

This is one controlled sample, not a universal performance theorem.

Its purpose is to demonstrate that a method designed to detect a fixed repeating shift schedule is looking for structure that plaintext autokey deliberately removes.

Autokey does not become pattern-free

Removing a short repeating keyword does not turn the keystream into random data.

For plaintext autokey:

most later key symbols are plaintext symbols

Natural language is structured.

It contains:

• nonuniform letter frequencies;
• common digrams and trigrams;
• recurring words;
• grammatical constraints;
• predictable phrases.

So the autokey keystream inherits language structure.

The dedicated Vigenère Autokey Cipher guide explains the feedback mechanism in detail.

The important comparison here is that autokey trades:

obvious short keyword repetition

for:

message-derived statistical structure

It removes one weakness without creating independent random key material.

Decryption is stateless for the repeated keyword, but stateful for plaintext autokey

For ordinary repeating-key Vigenère, the receiver can determine the key symbol at any position directly from:

position mod keyword length

If position 18 uses the third character of RAVEN, that fact does not depend on what happened at positions 1 through 17.

Plaintext autokey is different.

After the primer, decrypting position i requires plaintext recovered at:

i - r

The receiver must preserve earlier plaintext because that plaintext becomes later key material.

This gives the two schemes different decoding dependencies:

The modular subtraction is the same.

The information needed to choose the subtraction shift is not.

The same ciphertext error behaves differently

The short controlled example also changes ciphertext position 8 by one letter.

Under repeating-key Vigenère, only plaintext position:

8

is wrong.

The other positions remain correct.

That happens because each ciphertext position is decrypted independently once the repeating keyword is known.

For plaintext autokey, the wrong plaintext positions are:

8, 13, 18, 23

The first error at position 8 later becomes key material at:

8 + 5 = 13

The corrupted plaintext at position 13 becomes key material at:

18

and that result feeds:

23

The difference is therefore:

Repeating key:
one altered ciphertext symbol
→ one altered plaintext symbol

Plaintext autokey:
one altered ciphertext symbol
→ initial plaintext error
→ later feedback-chain errors

That is a direct consequence of the keystream design.

Error propagation is not the same as cryptographic strength

A cipher that spreads an error across multiple plaintext positions is not automatically more secure.

Error propagation describes how decoding responds to altered or damaged ciphertext.

Security asks different questions:

• What information leaks?
• How difficult is key recovery?
• What attacks exploit structure?
• How does known plaintext affect the system?
• Can an attacker modify ciphertext predictably?

Plaintext feedback creates dependencies, but those dependencies can themselves become useful cryptanalytic relationships.

So the error behavior should be treated as an operational property, not a security score.

Known plaintext interacts differently with the two schemes

For standard additive Vigenère:

Kᵢ = Cᵢ - Pᵢ mod 26

Known plaintext reveals the keystream values at the corresponding positions.

Repeating-key Vigenère

If enough known positions reveal the repeating keyword, those few shifts explain the rest of the message.

A recovered five-letter keyword can be repeated indefinitely.

Plaintext autokey

Known plaintext after the primer can also reveal key values, but those later values are constrained by earlier plaintext:

Kᵢ = Pᵢ₋ᵣ

The analyst is dealing with a feedback relation rather than one repeating word.

The site’s known-plaintext attack guide covers the basic C-P relationship. The important distinction here is what the recovered keystream values mean under each design.

The keyword length means something different

For repeated Vigenère, keyword length is:

the keystream period

assuming the written keyword has no shorter fundamental repetition.

For plaintext autokey, primer length is:

the feedback delay

It tells us how far later a plaintext character is reused as key material.

Those are not equivalent properties.

With RAVEN:

Repeating key:
period = 5

Plaintext autokey:
feedback delay = 5

Writing both as simply:

key length = 5

hides the most important structural distinction.

Messages shorter than the starting word are a special case

Suppose the message is only:

MEET

and the starting word is:

RAVEN

Both schemes use only:

RAVE

because the message ends before either:

the repeating keyword cycles

or:

autokey plaintext feedback begins

So the ciphertext is identical.

The schemes become distinguishable only when:

message length > starting-word length

This edge case explains why very short examples can fail to illustrate the difference between the two constructions.

Repeating a longer keyword reduces evidence per column but preserves periodicity

A common response to repeating-key Vigenère weakness is:

use a longer keyword

That can make classical column recovery harder because each shift receives fewer ciphertext letters.

For a 600-letter message:

period 5:
about 120 letters per column

period 20:
about 30 letters per column

But the structural rule remains:

Kᵢ = Kᵢ₊ᵣ

Autokey changes the rule instead of merely increasing r.

This is why the distinction is qualitative, not just:

short key versus long key

Autokey still should not be treated as modern secure encryption

Plaintext autokey is historically interesting because it addresses the most obvious weakness of a repeating keyword.

It is still a classical cipher.

Its generated keystream is derived from language rather than from a modern pseudorandom keystream generator.

It provides no modern authentication mechanism.

Its security should not be compared with contemporary authenticated encryption merely because it avoids a short period.

The useful comparison is historical and structural:

repeating Vigenère:
simple, periodic, vulnerable to period-based decomposition

plaintext autokey:
nonrepeating keyword extension, feedback-dependent, still language-structured

Neither should be used to protect sensitive modern data.

Implementation mistakes can accidentally turn one scheme into the other

A plaintext-autokey implementation can silently become repeating Vigenère if it does this:

key_symbol = primer[i % len(primer)]

for every message position.

That line guarantees repetition.

A correct plaintext-autokey decryptor instead uses:

primer symbol

only while:

i < primer length

then uses plaintext recovered:

primer length positions earlier

This is why known-answer vectors matter.

A round-trip test alone may not catch the mistake if encryption and decryption both implement the same wrong repeating rule.

A minimal conformance comparison

Using:

Plaintext:
SENDTHEPACKAGEBEFORENOON

Starting word:
RAVEN

an implementation should produce:

These values are sufficient to catch several common implementation confusions.

The site’s verified Vigenère test vectors provide the broader testing philosophy for standard implementations.

What changes for cryptanalysis

The practical attack model changes from:

Repeating-key Vigenère
↓
find a period
↓
split by period
↓
recover one fixed Caesar shift per column

to something closer to:

Plaintext autokey
↓
identify or hypothesize primer length
↓
recover enough early plaintext/primer information
↓
use plaintext-feedback constraints
↓
extend and verify the solution sequentially

That does not mean every autokey attack follows one recipe.

It means the fixed-column model that makes repeating-key Vigenère convenient to attack is no longer the exact generative model.

The analyst has to exploit different structure.

The practical difference in one sentence

Repeating-key Vigenère says:

after the keyword ends, start the keyword again

Plaintext autokey says:

after the primer ends, start using the plaintext

Everything else in this comparison follows from that decision.

With the same starting word RAVEN and the same plaintext, the first five ciphertext letters match because the first five shifts match.

After that:

RAVENR...

and:

RAVENS...

are different keystreams.

The repeating scheme preserves a fixed period that classical attacks can isolate.

The autokey scheme removes that short repeated period, but replaces it with plaintext feedback and language-derived structure.

That is why the two ciphers can share the same Vigenère arithmetic while behaving so differently in analysis and decryption.

---

Written by Marcus Hale

Editorially reviewed by VigenereDecoder.com editorial team