The simplest encryption you can write yourself is a Caesar cipher (shift each letter by a fixed amount) or an XOR cipher (combine each byte with a key byte). Both take under ten lines of Python, and both are good for learning and useless for protecting real data. Below are working implementations, a demonstration of how quickly each breaks, and the short, correct way to encrypt something for real.<\/p>\n
Encryption turns plaintext<\/strong> into ciphertext<\/strong> using an algorithm and a key<\/strong>; decryption reverses it with the key. With symmetric<\/strong> encryption the same key does both jobs. With asymmetric<\/strong> encryption (RSA, elliptic curves) there is a public key to encrypt and a private key to decrypt. Everything here is symmetric. Two other things get confused with encryption: encoding<\/strong> (Base64, hex), which is reversible by anyone and uses no key, and hashing<\/strong> (SHA-256), which is one-way.<\/p>\n Each letter moves a fixed number of places along the alphabet, wrapping from Z to A. The shift is the key. Julius Caesar is reported to have used a shift of 3.<\/p>\n Output:<\/p>\n Three details matter. The There are only 25 useful keys, so an attacker tries them all:<\/p>\n Among the 25 lines, shift 3 prints XOR ( Output:<\/p>\n Work with XOR is secure in exactly one case: the one-time pad<\/strong>, where the key is truly random, as long as the message, and never used twice. Base64 turns bytes into text made of 64 safe characters. It is used to put binary data into JSON, URLs or emails. Anyone can reverse it:<\/p>\n Storing a password or token as Base64 is the same as storing it in plain text. This mistake appears in real code reviews and security reports.<\/p>\n Use a well-reviewed library with a high-level interface. In Python the A wrong key, or a modified token, raises Good exercises: write a Caesar cracker that picks the most plausible shift by letter frequency, extend the XOR cipher to recover a repeating key from a known phrase, or implement the Vigen\u00e8re cipher and then break it. Caesar-style problems also appear in coding interviews as string manipulation. The Python lessons on accessing characters<\/a> and string immutability<\/a> cover what you need, and our overview of string algorithms<\/a> goes further. For real systems, read the documentation of the Write a Caesar cipher and XOR cipher in Python, see why both are easy to break, and learn what to use instead (Fernet\/AES) for real data.<\/p>\n","protected":false},"author":1,"featured_media":6896,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[],"class_list":["post-6897","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-problem-solving"],"_links":{"self":[{"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/posts\/6897"}],"collection":[{"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/comments?post=6897"}],"version-history":[{"count":1,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/posts\/6897\/revisions"}],"predecessor-version":[{"id":8708,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/posts\/6897\/revisions\/8708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/media\/6896"}],"wp:attachment":[{"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/media?parent=6897"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/categories?post=6897"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/algocademy.com\/blog\/wp-json\/wp\/v2\/tags?post=6897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}The Caesar cipher<\/h2>\n
def caesar(text, shift):\n out = []\n for ch in text:\n if ch.isascii() and ch.isalpha():\n base = ord(\"A\") if ch.isupper() else ord(\"a\")\n out.append(chr((ord(ch) - base + shift) % 26 + base))\n else:\n out.append(ch) # keep digits, spaces, punctuation\n return \"\".join(out)\n\nsecret = caesar(\"Meet me at noon, Cafe 9!\", 3)\nprint(secret)\nprint(caesar(secret, -3))<\/code><\/pre>\nPhhw ph dw qrrq, Fdih 9!\nMeet me at noon, Cafe 9!<\/code><\/pre>\n% 26<\/code> handles wrap-around, and Python’s %<\/code> returns a non-negative result for a positive modulus, so a negative shift also works and decryption is just encryption with -shift<\/code>. The ch.isascii()<\/code> check matters because \"\u00e9\".isalpha()<\/code> is true in Python, and without the check an accented letter would be mapped to garbage. And case is preserved by choosing the base letter per character.<\/p>\nWhy it is broken<\/h3>\n
for k in range(1, 26):\n print(k, caesar(\"Khoor, Zruog!\", -k))<\/code><\/pre>\nHello, World!<\/code>, and a human or a dictionary check spots it at once. Even if the key were unknown and the text long, letter frequencies give it away, because “e” stays the most common letter, just relabeled.<\/p>\nXOR cipher<\/h2>\n
^<\/code>) has the property (a ^ k) ^ k == a<\/code>. So the same function encrypts and decrypts. Repeat the key to cover the message length:<\/p>\ndef xor_bytes(data: bytes, key: bytes) -> bytes:\n return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))\n\nmsg = \"XOR is symmetric, caf\u00e9!\".encode(\"utf-8\")\nkey = b\"SECRET\"\nenc = xor_bytes(msg, key)\nprint(enc.hex())\nprint(xor_bytes(enc, key).decode(\"utf-8\"))<\/code><\/pre>\n0b0a11722c2773363a3f283127372a31697430242591ec75\nXOR is symmetric, caf\u00e9!<\/code><\/pre>\nbytes<\/code>, not strings, and show ciphertext as hex or Base64. A common mistake (and a bug in many tutorials) is to call .decode()<\/code> on the XOR result: the output bytes are arbitrary and usually are not valid UTF-8, so decoding raises UnicodeDecodeError<\/code> or corrupts the data.<\/p>\nWhy it is broken<\/h3>\n
\n
xor_bytes(enc[:6], msg[:6])<\/code> prints b'SECRET'<\/code>.<\/li>\nsecrets.token_bytes(len(msg))<\/code> gives a suitable key, but you have to share a key as big as the data safely, so it is rarely practical. Real stream ciphers such as ChaCha20 use a short key to generate a long keystream that does not repeat, and they add authentication.<\/p>\nBase64 is not encryption<\/h2>\n
import base64\ns = base64.b64encode(b\"hello\").decode()\nprint(s, base64.b64decode(s)) # aGVsbG8= b'hello'<\/code><\/pre>\nWhat to use for real data<\/h2>\n
cryptography<\/code> package (install with pip install cryptography<\/code>) offers Fernet, which handles the algorithm choice (AES-128-CBC with an HMAC), random initialization vectors and tamper detection for you:<\/p>\nfrom cryptography.fernet import Fernet\n\nkey = Fernet.generate_key() # store this securely, not in your repo\nf = Fernet(key)\ntoken = f.encrypt(b\"my secret\")\nprint(f.decrypt(token)) # b'my secret'\n\ntry:\n Fernet(Fernet.generate_key()).decrypt(token) # wrong key\nexcept Exception as e:\n print(type(e).__name__) # InvalidToken<\/code><\/pre>\nInvalidToken<\/code> instead of returning garbage. That integrity check is what the toy ciphers lack. For other cases:<\/p>\n\n
hashlib.scrypt<\/code> is in the standard library).<\/li>\nsecrets<\/code> or os.urandom<\/code>, never random<\/code>.<\/li>\nRules worth remembering<\/h2>\n
\n
Practice<\/h2>\n
cryptography<\/code> library before writing any code.<\/p>\n","protected":false},"excerpt":{"rendered":"