Wadsworth Cipher
Thirty-three teeth against twenty-six. The mismatch was the whole idea — and it made this the better machine that history forgot.
Step through a message one letter at a time. Each step turns the inner disk until the next plaintext letter reaches the index mark at the top; the outer disk is geared to it, so it turns by the same number of teeth. Whatever outer symbol lands under the index is the ciphertext — the count of turns, read off a 33-position scale.
Honest limits. The surviving device is a physical object; this is a model of its arithmetic, not a replica of its handling. Two choices here are the museum's own and are not documented settings: the inner disk is mixed by a keyword, and both disks start at their first position. The sources describe the disks, the 26:33 gearing and the turns-as-ciphertext rule — not a key schedule or a starting convention.
Why This Matters
Charles Wheatstone's Cryptograph is the famous one — displayed, reproduced, written about. Wadsworth's device did the same job half a century earlier and did one thing distinctly better. Wheatstone geared 27 outer positions against 26 inner; Wadsworth geared 33 against 26. Both mismatches produce a cipher whose alphabet keeps advancing, but 33 and 26 share no common factor and sit far enough apart that a given plaintext letter must exhaust all thirty-three of its possible substitutions before any of them can recur. That is a deliberate piece of design, and it is the more thoughtful of the two.
Decius Wadsworth was a colonel in the United States Army's Ordnance Corps, and it was there, in 1817, that he produced the cipher device that carries his name. That is very nearly the whole of what can be said with confidence about it.
Louis Kruh's study of the device, the standard reference, is titled The Mystery of Colonel Decius Wadsworth's Cipher Device — and the word is doing real work. This exhibit makes no claim about where the device was carried, which dispatches it protected, or which office adopted it, because the record does not support one. It was a personal invention by a serving officer, and its operational history is obscure. Summaries elsewhere sometimes report that the design "was used until the end of the Second World War"; that sentence describes the long afterlife of geared and disk ciphers generally, not documented service by this device, and it is not repeated here.
What survives instead is the mechanism — and, unusually for this museum, the object. The device itself is engraved "Decius Wadsworth 1817". William F. Friedman came across it at the Hamden Historical Society in Connecticut in the 1940s and borrowed it for the Army Security Agency's museum; Friedman's own assessment was that it is the first modern disk cipher invented. The Hamden Historical Society still holds it, and it went on display at the National Cryptologic Museum in the summer of 2024.
That is worth dwelling on, because it is the opposite of the problem this museum keeps running into. Most disputed exhibits have a bibliography that does not quite attest the thing it is cited for. This one has a dated, engraved, physical artefact in a museum case.
It is a working progressive cipher machine built in 1817, at a moment when practically every cipher in field use was still pen, paper and a table.
Two disks, one inside the other, geared together so that neither can turn alone.
Outer disk: 33 positions
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
plus the digits 2 3 4 5 6 7 8
Inner disk: 26 positions
the letters only
Gearing: 26 : 33 (no common factor)
To encipher one letter:
1. Turn until the plaintext letter reaches the index
2. Count the teeth that went by (1 to 26 — never zero)
3. Send the outer symbol now standing at the index
The count is the message. "Turn until the letter comes up" means a repeated letter is not free: bringing T back round to T costs a full revolution of the inner disk, twenty-six teeth. And twenty-six teeth on a thirty-three-position outer ring does not return you to where you started. That single fact is the engine of the whole design.
Worked example — ATTACK, keyword WADSWORTH
The keyword lays out the inner disk as W A D S O R T H B C E F G I J K L M N P Q U V X Y Z. Both disks start at their first position.
| Plain | Inner position | Teeth turned | Outer lands on |
|---|---|---|---|
| A | 1 | 1 | B |
| T | 6 | 5 | G |
| T | 6 | 26 | 8 |
| A | 1 | 21 | U |
| C | 9 | 8 | 4 |
| K | 15 | 6 | B |
Ciphertext: BG8U4B. Look at the two Ts — G and 8. Look at the two As — B and U. Frequency analysis has nothing to count.
Note also the honest wrinkle: the final K also lands on B, colliding with the first A. The guarantee is per plaintext letter, not across the whole message — different letters may share a ciphertext symbol. And because one turn moves the outer disk by between 1 and 26 teeth, seven of its thirty-three positions are out of reach from wherever it currently stands — a different seven at every step.
Feed the letter A to the device forty times and, after the first, the outer disk advances twenty-six positions every time — a repeated letter always costs a full revolution of the inner disk. Because 26 and 33 are coprime, those advances walk every one of the thirty-three outer symbols before the sequence repeats — on the thirty-fourth A, not before. The disks themselves only return to their common starting alignment after 858 teeth, the least common multiple of 26 and 33.
In 2020 Thomas Kaeding published an automated attack covering this whole family of devices — what he calls "cipher clocks", the machines built from revolving hands or rotating concentric disks: Wheatstone's Cryptograph, Wadsworth's device, and the Urkryptografen. The key observation is structural. The action of a cipher clock factors: it is a stream cipher followed by a monoalphabetic substitution. Once you see it that way, the disk arrangement stops being an unbreakable physical secret and becomes an ordinary substitution sitting on top of a known, deterministic stream — and substitutions fall to search. Kaeding hill-climbs the substitution against a fitness measure of how well the result looks like the stream component alone, with no crib and no known plaintext.
The techniques are ones this museum covers in their own right: see hill climbing and simulated annealing. The lesson generalises past this device. A long period is not the same thing as a large search space. Wadsworth bought 858 teeth of non-repetition, and that defeats the pencil-and-paper cryptanalysis of his own century completely — but it never hid the fact that the machine's output is a fixed function of a small, searchable secret.
| Concept from Wadsworth's device | Modern evolution |
|---|---|
| Coprime disk sizes stretch the period to their least common multiple | Coprime LFSR lengths in stream-cipher combiners; the same trick, and the same insufficiency on its own |
| The keystream advances on its own, independent of what it encrypts | Synchronous stream ciphers: keystream generated from key and position, never from plaintext |
| Structure that factors into stream-then-substitution | Divide-and-conquer cryptanalysis: attack the components separately rather than the composition |
| Long period, small secret | Period is not entropy — security is bounded by keyspace, not by how long the output takes to repeat |
| Exhibit | 69 of 140 |
| Hall | VII — Mechanical Cipher Machines |
| Inventor | Col. Decius Wadsworth, U.S. Army Ordnance Corps |
| Year | 1817 |
| Outer disk | 33 positions — A–Z plus 2–8 |
| Inner disk | 26 positions — letters only |
| Gearing | 26:33 |
| Period | 858 teeth (lcm of 26 and 33) |
| Security | Broken |
| Broken By | Kaeding, ciphertext-only hill climbing (2020) |
Three devices in this hall turn disks against each other. They are listed here in date order, and in date order only:
| 1790s | Jefferson — 36 stacked wheels; unpublished, and it stayed in his papers until the 20th century |
| 1817 | Wadsworth — two geared disks, 26:33 |
| 1860s | Wheatstone — two geared hands on a clock face, 26:27 |
That is a sequence, not a lineage. The museum makes no claim that any of these inventors drew on an earlier one. Jefferson's wheel cipher was never published and lay unread for over a century, so a derivation from it in 1817 would need evidence that the sources here do not provide; Wheatstone's device is generally treated as an independent invention. Where later devices are demonstrably descended from earlier ones — as with Bazeries and the M-94 from Jefferson's wheel — this museum says so and cites it. Here it does not.
Every historical claim on this page traces to one of these four.
- Louis Kruh, "The Mystery of Colonel Decius Wadsworth's Cipher Device", Cryptologia, vol. 6, no. 3 (1982), pp. 238–247. DOI: 10.1080/0161-118291857037. The standard historical reference for the device. It is paywalled; the specific statements below are cited to the archival document in note 2, which this museum read directly.
- "Decius Wadsworth Disc Cipher", William F. Friedman collection, U.S. National Security Agency (declassified), item 41788379082740 — NSA scan, full text. Source for Wadsworth's rank and Ordnance service, the 1817 date, the 26-and-33 character sequences, the statement that it is not known whether the device was ever used, and that it antedates Wheatstone's by half a century.
- National Cryptologic Foundation, "Inventors' Day & the Wadsworth Cipher", Cryptologic Dates in History — NCF calendar entry. Source for the "Decius Wadsworth 1817" engraving, Friedman's discovery of the device at the Hamden Historical Society in the 1940s, his assessment of it as the first modern disk cipher, and its display at the National Cryptologic Museum in summer 2024.
- Thomas Kaeding, "Automated ciphertext-only attack on the Wheatstone Cryptograph and related devices", IACR Cryptology ePrint Archive, report 2020/1492 (2020). The cryptanalysis: the "cipher clock" family factors into a stream cipher followed by a monoalphabetic substitution, which a stochastic hill-climbing attack then breaks from ciphertext alone.
Not cited, and deliberately: the widely repeated claim that Wadsworth's device was "based on a 1790 design by Thomas Jefferson". No source above supports it, and Jefferson's wheel cipher was unpublished until the 20th century. See the chronology panel above.