The Babington Plot Cipher
An intercepted correspondence that became evidence against Mary, Queen of Scots.
Thomas Phelippes, working for Sir Francis Walsingham · within days of interception
Why This Matters
In 1586 Mary, Queen of Scots, was held at Chartley. Walsingham’s agents intercepted her encrypted correspondence with Anthony Babington. The letters became evidence at her trial, followed by her execution on February 8, 1587. Cryptanalysis mattered, alongside interception, secretarial testimony, and the political and judicial process; it was not the sole cause of the outcome.
By 1586, Mary had been held in England for about eighteen years. Walsingham sought evidence of her involvement in plots against Elizabeth. The correspondence passed through secretaries and couriers; it should not be described as necessarily written in Mary’s own hand.
Gilbert Gifford helped establish a channel that Mary’s correspondents believed private, but Walsingham’s agents could intercept and decipher its letters. The historical system combined letter symbols, codewords, and special signs. The exact 64-token inventory used below belongs to the museum’s model, not a verified transcription of the original key.
Phelippes deciphered Mary’s July 17 letter and added a postscript requesting the conspirators’ names. No reply supplying those names is established by this account. Walsingham’s August 3 letter worried that the postscript had made Babington suspicious. See the British Library’s discussion of the surviving documents.
The deciphered correspondence was used against Mary, who disputed the accusations. A dramatic statement about her reaction is not a substitute for the surviving trial and correspondence records.
The cipher was a nomenclator, combining substitution with a codebook. The following inventory describes the museum’s teaching model; its token counts and assignments are not an archival facsimile:
23 letter symbols (no J, V, W — folded onto I, U, UU) 36 codewords (THE, AND, OF, MARY, QUEEN, ELIZABETH, POISON, …) 4 null symbols (decoys — drop on decode) 1 "doubleth" (means: double the previous/next letter) ───────── 64 total glyphs
This software uses a greedy-longest-match scan: it selects a codeword where possible, otherwise a letter token. It can insert nulls and abbreviate doubled letters. These are the model’s deterministic rules, not a documented reconstruction of a clerk’s exact working procedure.
Letter substitution leaks repeated patterns and language statistics; codewords and nulls complicate analysis. Frequency counts supply hypotheses, not a guaranteed E–T mapping or a complete reconstruction of Phelippes’s method. The surviving evidence establishes his successful decipherment, not the precise workflow previously asserted here.
Knowledge of an enciphering key lets an attacker create plausible new ciphertext. Phelippes’s forged postscript illustrates impersonation after key compromise. It is not a formal chosen-ciphertext attack: no decryption-oracle experiment is established, and the requested reply is not known to have arrived.
Control of the delivery channel enabled interception and alteration. Modern end-to-end encryption can protect messages over an adversary-controlled transport when endpoint keys and authentication remain secure. Compromising an endpoint or its secret key is a different and more powerful attack.
Two distinct failures: the historical cipher was deciphered, and possession of its enciphering knowledge enabled a forged message. Adding codewords does not erase language structure. Authentication can resist outsider forgery only while the relevant authentication key remains secret.
| Babington-Era Concept | Modern Evolution |
|---|---|
| Nomenclator: codewords for whole tokens | Compression dictionaries (Huffman, LZ77) and tokenizers — same idea, modern math |
| Double-letter abbreviation | Format conventions can compress text; they are not authentication |
| Forged ciphertext to extract information | Impersonation after key compromise; distinct from a formal chosen-ciphertext attack |
| Trusted channel that is actually compromised | End-to-end encryption with verified identity (Signal Protocol's safety numbers, key transparency logs) |
Modern comparison, not a claimed direct lineage: authenticated encryption checks message integrity as well as confidentiality. It does not prevent an attacker who has stolen the shared authentication key from generating valid messages. Nor can a modern primitive settle the historical counterfactual about Mary’s trial.
| Exhibit | 39 of 169 |
| Era | Elizabethan · 1586 |
| Used by | Mary, Queen of Scots |
| Broken by | Thomas Phelippes |
| Time to break | Days (cipher was already known to Phelippes from earlier intercepts) |
| Active attack | Forged postscript by Phelippes |
| Trial date | 14–15 October 1586 (Fotheringhay) |
| Execution | 8 February 1587 |
| Conspirators | 14 hanged, drawn & quartered (Sept 1586) |
The original cipher chart survives in The National Archives (SP 12/193). This demo uses ASCII tokens drawn from a 64-symbol pool — ⟨a01⟩…⟨a23⟩, ⟨w01⟩…⟨w36⟩, ⟨n01⟩…⟨n04⟩, and ⟨x2⟩ — but the seed shuffles which symbol stands for which letter, codeword, null, or the doubleth, so a symbol's prefix says nothing about its role. Under the default seed BABINGTON, for example, the doubleth is ⟨w18⟩ and ⟨x2⟩ is the codeword DEATH.
Try encoding "POISON THE QUEEN AT THE TOWER" and notice how POISON, THE, QUEEN, and TOWER each get their own codeword (one glyph for the whole word). Then encode "ATTACK" and watch the double-letter abbreviation apply on the doubled T.
The demonstration folds J to I, V to U, and W to UU. These are explicit model conventions, not proof that all Elizabethan cipher alphabets used the same inventory.
Decode this intercepted dispatch (seed: BABINGTON):
⟨w25⟩ ⟨a14⟩ ⟨w32⟩ ⟨a20⟩ ⟨w33⟩ ⟨a17⟩ ⟨x2⟩
Reveal solution
The dispatch reads DAGGER ELIZABETH AT THE TOWER DEATH — paste the ciphertext into the demo and switch to Decrypt to verify. The seed shuffles the symbol-to-token assignment, so each glyph stands for whichever word the shuffle deals it.