Cipher Puzzles for Your RPG Table: Which Code to Use and How to Make It Solvable

There's a trick every experienced Game Master learns eventually: information you read aloud takes fifteen seconds and is forgotten by next week. The same information handed over as a coded note takes twenty minutes, involves everyone at the table, and gets talked about for a year.

That's the entire case for cipher puzzles. You are not adding difficulty — you're converting a passive moment into an active one.

But ciphers fail more often than they land, and they fail for predictable reasons: the code was too hard, the key was never findable, or the puzzle became one player doing arithmetic while four others checked their phones. This guide is about avoiding all three.

The one rule that decides everything

The players solve the puzzle, not the characters.

This sounds obvious and it's constantly violated. A player rolling Intelligence to decode a note is doing a skill check. A player actually decoding the note is playing a game. Those are different activities and only one of them is memorable.

Which means the cipher has to be crackable by a person at a table with paper, a pen, and no cryptography background — under time pressure, while also trying to remember what their character is doing.

That single constraint eliminates most of the "serious" ciphers immediately, and it's why the list below is ordered by difficulty rather than by cleverness.

The starter tier: solvable in five minutes

Substitution alphabets are the best first puzzle in the hobby, and Pigpen is the classic. Letters become geometric symbols from a grid. It looks utterly alien on the page — which is the point, it feels like a lost language — and yet once players have the key it's pure lookup with no maths at all.

This is the cipher to use when you want the experience of decoding without any risk of the table stalling. It's also the best one for a group with kids at the table.

Morse code works beautifully whenever the fiction gives you a reason for a signal rather than a document: a knocking sound through a wall, a lantern flashing across a bay, a distress transmission. Half your players will recognise dots and dashes on sight, and the ones who don't get to be told by the ones who do — which is a good table moment in itself.

Roman numerals barely count as a cipher, and that's why they're useful. Carve them over a door, on a set of tombs, or as the combination on a lock. Nobody gets stuck, everyone feels clever, and it takes fifteen seconds of prep.

The main tier: a proper puzzle, still fair

The Caesar cipher is the workhorse. Every letter shifts by a fixed number: shift of three turns A into D. It's genuinely satisfying to break, because players can brute-force it — twenty-five possible shifts, and a table that tries a few will get there.

The design tip that makes it excellent: give them the shift number through the fiction rather than as a puzzle. "The abbot's third canticle" is a shift of three. A key with three teeth is a shift of three. Now the note isn't a maths problem — it's a reason to go find the abbot's book, which means the cipher generated an entire scene.

Atbash reverses the alphabet: A becomes Z, B becomes Y. There's nothing to guess once you know the rule, which makes it the right choice when you want the challenge to be realising what kind of cipher it is rather than doing the work. It has genuine ancient-world flavour too — it's a real historical cipher, which sells the tomb.

A1Z26 turns letters into their position in the alphabet: 1 for A, 2 for B. It's the cipher to use when the clue needs to look like numbers in the fiction — a ledger, a set of coordinates, a page of accounts that isn't accounts.

Binary and Base64 are the sci-fi and modern-horror options. In a cyberpunk game, a Base64 string on a recovered drive is exactly right, and it costs the players nothing but a lookup. Both are also the honest choice for a modern setting where a player would plausibly just paste it into a converter — let them. Realistic, and fast.

The heavy tier: use with care

Vigenère is a Caesar cipher where the shift changes with each letter according to a keyword. It's a genuinely strong cipher and it is not brute-forceable at a table.

Only use it when the keyword is the actual point of the adventure — the party spends the session learning the dead wizard's true name, and that name decodes the letter they found in session one. That's a great structure. Handing out a Vigenère text with no keyword is not a puzzle, it's a wall.

The same goes for Beaufort, Gronsfeld and the Vernam cipher: they're excellent when the key is the quest and poor when the code is the quest.

Themed alphabets, for when it should look like the setting

Sometimes you don't want the puzzle to look like cryptography — you want it to look like it belongs to the world.

Gallifreyan turns text into circular glyphs, which reads as alien technology rather than a code. The Sigils of the Other Side and the Signs of the Stranger do the same job for occult and paranormal settings — the note doesn't look encoded, it looks wrong, which is a different and better feeling at a horror table.

And Leetspeak exists for the modern game where the message is supposed to look like a forum post from someone who doesn't want to be searchable.

Planting the key fairly

A cipher with no findable key is a dead end, and dead ends are where sessions go to die. Three ways to plant one, in ascending order of elegance:

In the same handout. A margin note, a symbol at the top, a printed grid on the back. Guarantees the puzzle is solvable in the moment.
Somewhere they've already been. The key was on a wall in a room they visited two sessions ago. This is enormously satisfying if they took notes, and a disaster if they didn't — so use it with groups you know.
As the objective. The coded letter arrives in session one; the key is what session three is about. This is the best structure in the whole article, because the cipher stops being a puzzle and becomes the plot.

Always have a fallback. An NPC scholar who can be paid, a spell that translates, a second copy with a fragment already decoded. The fallback should cost something — time, money, a favour owed — so it's a choice rather than a rescue.

Keeping the whole table involved

The most common failure mode isn't difficulty. It's that decoding is a solo activity, and one player quietly does it while the rest wait.

Fixes that work:

Split the key. Three fragments in three places, so the puzzle can't start until the group pools what they have.
Put it on a clock. The tide comes in, the ritual completes, the guard returns in ten minutes. Pressure makes people collaborate instead of politely watching the one person with a pen.
Make the plaintext short. Eight words. Really. A long coded message is not eight times more fun than a short one — it's eight times more transcription. "THE PRIEST LIES BURIED BENEATH THE ALTAR" is a whole scene. Two paragraphs is homework.
Give the fast solver a job. If one player always cracks it first, hand them the role of reading it out and let the others act on it.

A worked example

Session one: the party finds a letter in a dead courier's boot. It's Caesar-shifted, and the seal on the envelope shows five stars.

Someone tries a shift of five within about a minute — the stars are the key, and the fiction gave it to them. The letter names a place and a date, both of which are wrong by exactly one day, because the courier was carrying a forgery.

Session three: they find the courier's real letter, and this one is Vigenère. The keyword is the name of the noble house they've spent two sessions investigating. It only decodes if they got the investigation right.

That's two ciphers doing two completely different jobs: the first is a five-minute delight that teaches the table that coded things are worth carrying around, and the second is the payoff for a plot. Neither is a wall, and neither is a skill check.

All the ciphers mentioned here are free and browser-based — Caesar, Vigenère, Atbash, Pigpen, Morse, binary, Base64 and the rest live in the RPG tools collection. Encode your plaintext, print it, and hand it over. And if you want the modern version of the same trick, a QR code on a handout delivers the clue straight to a player's phone.