Cardano Grille 1550 · steganography by template
A pierced card and an innocuous-looking letter: the recipient overlays an identical grille and reads the secret through the holes.
Why This Matters
Cardano's grille is the second of his great cryptographic ideas — the first being the autokey. He proposed it in De Subtilitate (1550) as a method any literate person could use without algebra: cut a piece of stiff card with windows in irregular positions, write your secret one letter at a time through the windows onto the page beneath, then lift the grille away and fill the surrounding space with plausible-sounding prose.
Variants and descendants of the grille remained in active espionage use into the twentieth century. The turning grille — a square card rotated through four positions to fill an N×N grid completely — was used by the German Army in the early years of WWI for tactical traffic, and broken by French and British analysts within months.
The grille is a square card of side N with holes punched at agreed-upon positions. Sender and receiver each have an identical card. To encrypt:
- Place the grille over a blank N×N grid.
- Write the secret letter-by-letter through the holes.
- Lift the grille; fill the remaining cells with plausible filler (a poem, a shopping list, a love letter).
To decrypt, the recipient places their grille over the received grid in the same orientation and reads the letters visible through the holes.
The demo on this page uses a key of the form size:idx,idx,idx,… — the grid side length followed by the zero-based positions of the holes. The default 5:0,3,7,12,19,21,24 places six holes in a 5×5 grid.
There is essentially no algorithm — the security rests entirely on the secrecy of the physical card. Once the card is photographed, copied, or stolen, every past and future message becomes readable.
Convincing filler text is hard. A trained censor reading thousands of letters notices stilted phrasing, awkward grammar, and the distinctive cadence of grille-fill — and flags suspicious correspondence for closer inspection.
For a 5×5 grid with 6 holes there are only C(25,6) ≈ 177,000 possible grille patterns. Try each, accept the one whose extracted letters spell English. The turning-grille variant raises the count enough to need cleverer tooling, but not enough to resist a determined cryptanalytic bureau.
The Cardano grille is the cleanest historical example of steganography as distinct from cryptography: the goal is not to make the message unreadable, but to make the message invisible. Modern steganography (LSB embedding in images, DNS-tunnel exfiltration, Cicada 3301's OutGuess puzzles) is methodologically a direct descendant.
The strategic lesson is also unchanged: stego buys you traffic-analysis resistance, not confidentiality. Anyone who suspects the channel and acquires the carrier method reads everything. Best practice today is to encrypt first and steganographically hide the ciphertext — belt and braces.
| Origin | Girolamo Cardano, Italy |
| Year | 1550 (De Subtilitate) |
| Key Type | The grille pattern (positions of the holes) |
| Family | Steganography / hidden-text transposition |
| Modern Lesson | Hiding a message ≠ encrypting a message |