Ciphers during the Reign of Queen Elizabeth I

Some aspects of cryptology during the reign of Queen Elizabeth I are described as far as can be known from publications readily available. Ciphers of Mary, Queen of Scots, are described in another article.

Wotton-Somerset Cipher (1548)

Nicholas Wotton served as ambassador in France intermittently under Henry VIII, Mary I, and Elizabeth I. The following shows a cipher used shortly before the Elizabethan age in a letter from Wotton to Protector Somerset dated 25 May 1548, printed in Secret Writing.

As was typical in the sixteenth century, the cipher is based on substitution of non-alphabetic symbols for each letter of the alphabet. To make codebreaking more difficult, each letter might be represented by more than one symbol. Some frequently occurring words (e.g., "and", "for", "the French King", "England") as well as double letter "ll" are assigned special symbols of their own.

Wotton used cipher in writing to Secretary Petre or the Queen in his embassy in Mary's reign.

When his predecessor Sir William Pickering (biography), suspected of involvement in Wyatt's Rebellion in early 1554, fled England to live openly in Paris, Wotton was so alarmed to propose to replace a cipher.

Because Pickering has long been in possession of the cipher used by Wotton, and is now here, begs him to consider whether there be any danger therein, and if so, to provide for it as he shall think good.
Dr. Wotton to Sir William Peter, Paris, 17 April 1554 (CSP, Foreign, Mary)

In case his letters should be intercepted, as is very probable, sends a new cipher for approval; if it is not liked, he will continue to use the present one.
Dr. Wotton to Sir William Petre, Paris, 9 May 1554 (CSP, Foreign, Mary)

Queen Elizabeth's Private Cipher (1560)

Early in her reign, Queen Elizabeth already used a private cipher, which appears to have been a relatively simple one. The details are not known to the present author.

Uses this cipher as stronger than the Queen's private cipher.
Throckmorton to Elizabeth I, Dreux, 24 June 1560 (CSP, Foreign, Elizabeth, iii)

The Queen appears to have kept her own cipher.

this, Sir, I could not write to her Majesty, because I would not trouble her with deciphering, and therefore I beseech you make her acquainted with this letter
Stafford to Walsingham, 4 April 1587 (CSP, Foreign, Elizabeth, xxi)

In a letter to the Queen dated 25 February 1588 mentioned below, Stafford, ambassador in Paris, wrote in Burghley's cipher from fear she might have lost her own. (CSP, Foreign, Elizabeth, xxi).

Nicholas Throckmorton's Ciphers (1559-1563)

Nicholas Throckmorton was ambassador in France from May 1559.

Add MS 35830 (BL) includes a letter partly in cipher to Throckmorton from Robert Jones, Clerk of the Privy Seal, London, 30 November 1560 (f.66). The interlinear decipherment allows reconstruction of the cipher (called "Throckmorton's Cipher 3" herein).

The same cipher can decipher the short ciphertext (of which the plaintext is obliterated) in a draft of a letter from Throckmorton to Elizabeth (ff.54-63) (the ciphertext is on f.62r; it reads something like: "it shall not be amis in myn opinion that you cause him to be adver/tised from the Earl of Arran hereof, which perhaps may work somewhat in him / Jamis Hamulton lieutnant to the Earl of Arran his band.")

It can also decipher many ciphertexts in Throckmorton's letters in Add MS 4136 (DECRYPT no.2982-no.3030). As it turned out, most of the ciphertexts in Add MS 4136 are an extract of ciphered segments. When I deciphered a sequence "marques d'Alboeuf and Martigues" in one letter, it allowed me to find the decipherment of full letters printed in Patrick Forbes (1740), A Full View Of The Public Transactions In the Riegn of Q. Elisabeth, p.254 (Google). Comparison of the ciphertext with the plaintext in print revealed many more symbols. (Since my work is far from exhaustive, I'm sure many more can still be found.)

After all, I reconstructed three ciphers used by Throckmorton.

Throckmorton's Cipher 1 (May-July 1559)

This was used in Throckmorton's letters to Elizabeth, secretary Cecil, or the lords of the Council in May to July 1559: DECRYPT no.2983 (30 May, 7 June), no.2984 (21 June), no.2985 (28 June), no.2986 (4 July), no.2987 (4 July), no.2988 (10 July), no.2990 (13 July), no.2992 (19 July).

This cipher had code symbols for many common words and names, but appears to have lacked symbols for some important words such as "the", "they", "there", "of", "with."

Throckmorton's Cipher 2

Another cipher was used in some of Throckmorton's letters to Elizabeth in July 1559: no.2990 (18 July, Forbes p.163), no.2994 (marked 27 July 1559 in MS, but 28 July 1559 in Forbes p.181).

This is the simplest of the three. It has only a few code symbols and no nulls. It is not clear how come such a simple cipher was used when he had a better cipher. Possibly, the cipher may have been compromised at this time. But if so, a reference to it should be found in the correspondence (as in the case from 1562 below).

Throckmorton's Cipher 3

This cipher was used in many letters to Elizabeth, Cecil, or the lords of the Council from the end of July 1559. It was used as late as 1563.

It seems the vocabulary grew from the first cipher. Its code symbols are based on the initial letter of the word represented. This facilitates its use, but is a weakness that might be exploited by codebreakers.

It has a symbol for "it may please your majesty", not a kind of vocabulary that enters many codes. This reminds me of an entry for "si je vous prie" in a letter used between Mary, Queen of Scots, and Castelnau de Mauvissiere, French ambassador in London (Lasry et al. (2023)).

It can be seen that many symbols are commonly used in the three ciphers. But in some cases of relatively infrequent symbols, the symbol may actually belong to an earlier cipher and was used by mistake after replacement of the cipher (The phenomenon is termed "cross-cipher contamination errors" in Lasry et al. (2023)).

According to a catalogue by the British Library, "Manuscripts collected by Thomas Birch (b. 1705, d.1766), D.D., and bequeathed by him to the British Museum, of which he was a Trustee from 1753 until his death ([1200-1799]) (Add MS 4101-4478)" (pdf), the full keys may be found on f.178, 178b, 180.

Unidentified Ciphers in Add MS 4136

In Add MS 4136, there remain two ciphers yet unidentified.

DECRYPT no.2988 Throckmorton to Elizabeth, 10 July 1559

The letter itself (not found in Forbes or CSP Foreign) can be deciphered with Throckmorton's Cipher 1, but the ciphertext in the margin accounting for about half of the page seems to be in a different, unknown cipher.

DECRYPT no.2989 Throckmorton to Cecil, 8 August 1559 can be deciphered with Throckmorton's Cipher 3 (the deciphered text is in Forbes p.195), but the same sheet includes a ciphertext from Mr John Wod to Secretary Cecil, 6 September 1568, which seems to be in a different, unknown cipher.

Cecil-Throckmorton Cipher (1559-1563) and Cecil-Smith Cipher (1562-1566)

William Cecil, Secretary of State, routinely used cipher with various correspondents.

Nicholas Throckmorton (an uncle of the conspirator Francis Throckmorton), ambassador in France from May 1559, was one of them. He occasionally had some intercepted letters deciphered by Somer (see below) and sent back the decipher after re-enciphering it in his own cipher.

In September 1562, he was caught in an action of the Admiral (see below) when travelling and lost everything including his cipher. In the end, the cipher was recovered but he recommended change of the cipher.

The writer has barely escaped with his life. Through the Prince he has recovered part of what he lost. He does not think his cipher fell into any man's hand, but it should be changed, and another sent by Cecil's next despatch.
Throckmorton to Cecil, 9 September 1562 (CSP, Foreign, Elizabeth, v)

Throckmorton wanted to be recalled and Sir Thomas Smith, was sent to France from 1562 to 1566. Smith used his own cipher. Smith's cipher, different from Throckmorton's, was delivered after his departure.

Has not received his cipher, which he should have before he leaves Dover.
Smith to Cecil, Sittingbourne, 21 September 1562 (CSP, Foreign, Elizabeth, v)

This day (22nd Sept.) at 7 a.m. received Smith's letter of yesterday that he had not the memorial or the cipher. On Sunday night they were delivered at his [Smith's] house in London.
Cecil to Smith, Hampton Court, 22 Septebmer 1562 (ibid.)

In December 1562, Throckmorton was present in the camp of the Protestant army under the Prince of Condé, when the latter was defeated by the Duke of Guise commanding the Catholic forces and was caught a prisoner. This time, the situation was more serious than before for Throckmorton. He not only lost his train and baggage but was placed under house arrest for some time. Notwithstanding, his letters of 6 and 13 January and 1 March 1563 to the Queen were partly enciphered.

Dudley-Throckmorton Cipher (1560)

Add MS 32091 (BL) includes a letter partly in cipher from Nicholas Throckmorton to Robert Dudley about his negotiations with the French court in Amboise, 22 May 1560 (f.180). Interlinear decipherment allows the following reconstruction.

Thomas Smith's Cipher (1563)

A small portion of Smith's letter in cipher (CSP) is printed in Rees' Cyclopaedia. While arabic numerals are used, they are merely part of symbols of the cipher alphabet. Numerical codes are not in use and frequently used words are instead represented by symbols, which often retain the initial letter of the words they represent. It appears symbols can be put in any orientation (e.g., those for "b", "c", "l"), as in the case for the Cecil-Norris cipher (1568) below.

(Notes added in October 2017: Davidsch's webpage presents a full cipher alphabet in his handwriting, which indicates dots are meaningful: "9" represents "p" but "9" with a dot to the right represents "s"; "10" is "p" but "10" with a dot is "s"; "6" with a dot is "r" but "6" with two dots is "u", etc. In this regard, he found some errors in dots in the transcription of Rees' Cyclopaedia. His webpage further has several portions of the original cipher, which shows an interesing nomenclature system of this cipher: a letter with one or two dots to the left, right, above, or below are used to represent words beginning with that letter. Thanks to him, I made corrections in the above image.)

Code Names

Code names for representing persons were widely used in the Elizabethan era, as detailed in Butler (p.132-133).

An elaborate code of 1563 in the hand of Cecil, includes "tout" (Queen Mother of France), "rien" (Charles IX), "balaams" (Neutrals), "petit" (Prince of Conde), "compère" (Constable Montmorency), "seul" (Coligny), "ensemble" (D'Andelot) and "courtisan" (Cardinal).

A cipher for Scotland in 1592 represents Sir Robert Melvin, the elder and the younger, as "Meshech" and "Kedar."

In 1592, Henry Winwood (a grandnephew of the above-mentioned Nicholas Wotton) travelling in Italy provided Lord Zouche, his correspondent, a cipher consisting of some code names: "The Frenchman" (Lord Darcy), "Monsieur du Plese" (Lord Treasurer), "The Master of the Vatican Library" (the Grand Duke). (Life and Letters of Sir Henry Wotton, Vol. I, p.291)

In 1596, Richard Douglas used code names taken from classical antiquity in writing to his uncle Archibald Douglas about Scottish affairs. (Daybell p.157)

Other examples will be mentioned below.

Chaloner's Cipher (1564)

A small portion of a letter in cipher (CSP) from Thomas Chaloner, ambassador in Spain, is printed in Rees' Cyclopaedia. This is similar to Smith's cipher above in that the symbol for "e" is placed in various orientations and that code symbols for "to" etc. carelessly remind of the initial letter of the referent.

Sadler's Ciphers

Add MS 33591 (BL) includes some letters partially in cipher in the correspondence of Sir Ralph Sadler (Wikipedia) from 1559. In August 1559, he was sent to Scotland to make an alliance with the Protestant lords opposing Mary of Guise, Regent of Scotland in behalf of Mary, Queen of Scots.

Cecil-Sadler-Croft Cipher 1

This is used in a letter from Cecil to Sadler and Sir James Croft (Add MS 33591, ff.69r-70v, 31 August 1559). Croft was made governor of Berwick upon Tweed by Elizabeth and supported the Scottish Protestants (Wikipedia) . The cipher can be reconstructed as follows.

Cecil-Sadler-Croft-Cipher 2

This is used in letters from Cecil and Sadler (and Croft) from September to October 1559 (Add MS 33591, ff. 102r-103v (only a few symbols; the identification relies on a single symbol of "circled 2"), ff. 106r-107v, ff. 137r-138v, ff. 170r-171v, ff. 176r-178v, ff. 216r-217v) and one letter from Eliabeth to Sadler and Croft (30 October 1559; ff. 246r-247v). At the end of the letter of 20 October (ff. 216-217), Cecil conveys some additional cipher symbols.

The cipher can be reconstructed as follows.

In the substitution table, some symbols are used with different orientations to represent the same plaintext letter. The nomenclature represents a word with a symbol derived from the initial letter with some diacritics. For example, "m" with two dots below represents "more", while "m" with an overbar represents "money." The substitution table includes graphical symbols as well as Arabic figures with dots. That is, dots are used both for letters and the nomenclature. This is better than reserving diacritics only for the nomenclature, a practice seen in many later ciphers. These characteristics are the same as with the Cecil-Smith Cipher above. It appears this form is Cecil's preference. On the other hand, Cecil's letters encipher only part of the text, which is not a good practice in terms of security.

This cipher also use code symbols made of numbers in a circle, numbers in a triangle, and capital letters in a square with an open botton side (like コ rotated 90 degrees).

The same cipher is used in letters from Sadler and Croft to Cecil in September 1559 (Cotton MS Caligula B X/1 (BL), f.41, f.45). These specimens will supply further symbols to the above reconstruction.

Randolph-Sadler-Croft Cipher

This is used in letters from Thomas Randolph, alias Thomas Barnabie, to Sadler and Croft from September 1559 (Add MS 33591, f.165; ff.209r-211v; ff.222r-232v, ff. 235r-238v; the last three are enclosed in a letter to Cecil).

The key is in ff. 166v-167v, titled "Randolph's Ciphre".

While Cecil's letters use cipher only for some short phrases, Randolph's letters are entirely in cipher.

The same cipher is also used in the correspondence between Randolph, Sadler, and Croft in Add MS 33592 (BL) from 1559-1560 (f.3, deciphered in f.4; ff.103-6 (enclosure), deciphered in f.108 (f.107 may look like an independent ciphertext, but the deciphered beginning "Thys present day 11 novem we depart from [Sterling?] towards / Sa[y?]ncte Androwes" follows the end of f.106v "procedyn[?][g?]s and intende to may[k?]e hym pay well for that he ys ryche" in the deciphered text (see 13th line on f.108v).); ff.113-116, deciphered in f.117; f.156 (Catalogue describes this as "Cipher", but I couldn't find cipher in this letter); f.240, deciphered in f.241; f.242, deciphered in f.243) and also in a letter from James Hamilton, 2nd Earl of Arran, 1st Duke of Chatelherault, Governor of Scotland (Wikipedia) and Lord James Stuart, 1st Earl of Moray to Sadler and Croft, St. Andrews, 30 November [1559] (f.158, deciphered in f.159; f.261, deciphered in f.262; f.265, deciphered in f.267).

On the first line on f.158, there is a wavy line over the symbol for "m" in "commendations", to double the letter as in cleartext. This could have been a crib for a codebreaker.

Cecil-Sadler/Randolph Cipher

Cotton MS Caligula C III (BL), no.186. 76. (f.197) is a "letter of intelligence concerning Q, mary's friends in Scotland, Verac, &c.; perhaps from Sadler or Randolph, to Ld. Burleigh." [1571] It has a few words in cipher, of which one word is deciphered (which I cannot read). The cipher seems different from Cecil-Sadler-Croft-Cipher 1, Cecil-Sadler-Croft-Cipher 2, and Randolph-Sadler-Croft Cipher used around 1560.


Cryptanalysis of intercepted letters in cipher was already routine in 1560s. (Accordingto Mattingly (p.215), Thomas Cromwell's experts had broken the cipher of Spanish ambassador Eustace Chapuys by 1535.)

John Somer [also spelled Sommer, Somers, Sommers, Summers] (1560s)

As early as 1560, one John Somer was active as a decipherer. He had served as secretary under Nicholas Wotton, ambassador in France, during the reign of Queen Mary (CSP, Foreign, Mary in passim). Apparently, after the accession of Elizabeth I, he continued his service for ambassadors Throckmorton and then Smith. (Not much is known about him. For historians' summary, see n.31 in Dubois-Nayt and Nachef (2020).)

In the spring of 1560, Throckmorton received from Secretary of State Cecil an intercepted letter in cipher addressed to Mary of Guise, mother and regent for Mary, Queen of Scots, from the Duke of Guise and the Cardinal of Lorraine (brothers of Mary of Guise) and had it deciphered by Somer (probably, SP53/23 no. 8). He rewrote the letter in his own cipher, with further disguise by intermeddling "divers English words", and returned it to Cecil (Throckmorton to Cecil, 6 April 1560 (CSP, Foreign Elizabeth ii); cf. Lord James Stewart to Norfolk, 18 March 1560 ibid.). Similar deciphering was reported on other occasions (Throckmorton to the Queen, 11 April 1560 and Throckmorton to Cecil, 12 April 1560 (ibid.), Throckmorton to the Queen, 25 April 1560ibid.), Throckmorton to Cecil, 7 June 1560, CSP, Foreign, Elizabeth, iii), Throckmorton to Sir William Petre, Blois, 7 June 1560 (Cecil Papers)). Putting the deciphered message into his own cipher is a precaution in order to prevent the enemy from finding out the fact of deciphering in case the letter is intercepted. Such a precaution appears to have been followed by Smith (Smith to Cecil, 12 March 1563, CSP, Foreign, Elizabeth, vi).

In April 1560, the Duke of Norfolk, who had been sent north for negotiations with the Scots, begged Cecil to send "an alphabet of the cipher which was lately deciphered by 'Sommer'" because recently intercepted letters to the dowager Mary of Guise from Leith (to where the French troops supporting the Dowager in Edinburgh against the Protestant forces had retreated in January) might be deciphered by the same alphabet. (Norfolk to Cecil, 21 April 1560 (Cecil Papers), Norfolk and his Council to Cecil, 21 April 1560 CSP, Foreign, Elizabeth ii)

When a French letter in cipher was intercepted in Scotland, Cecil thought of having Somer decipher it. (The extant extract of the letter is in Throckmorton's cipher.)

He [Cecil] sends an intercepted letter from a French secretary in the castle to the town. If Mr. Hampton can do nothing with it, it should be sent to Mr. Sommer. Cecil would have given 100l. to have had Somer here. Asks Mr. Hampton to take the care to send these letters to Throckmorton.
Cecil to William Petre, Edinburgh, 21 June 1560 (CSP, Foreign, Elizabeth, iii)

The death of the Queen Dowager on 11 June cleared a way to an agreement by a treaty on 5 July (Treaty of Edinburgh) that both the English and French troop leave Scotland.

Despite the precaution taken by Throckmorton, their deciphering activities could not go unnoticed. In May, Throckmorton had pointed out their "wonderful intelligence that the Queen Dowager has of the doings in England, as appears by her letters of the 1st May, who has got knowledge that her letter and the French have been deciphered, whereupon will follow an alteration of all their ciphers." (Throckmorton to Cecil, 22 May 1560, CSP, Foreign, Elizabeth iii) The "letters of the 1st May" mentioned would have been something similar to the following.

She [Queen Dowager] finds the cipher [with her brothers] very dangerous; for two days ago she was shown a translation into English, word for word, of the letter which she received on the 19th February,
Queen Dowager of Scotland to D'Oysel, 5 May 1560 (in Throckmorton's cipher) (CSP, Foreign, Elizabeth, iii)

Indeed, Somer soon had to tackle a new cipher.

Returns them the letter in cipher, deciphered, The characters are new and difficult. Notes in it a declaration of the French meaning for protracting of time, and no disposition in them to have fallen to appointment but by constraint; also the dangerous intelligence they have how their letters have been deciphered. Mr. Somers' great travail and good service declares itself worthy recompence. Prays that they may be endued with God's Holy Spirit.
Throckmorton to the Privy Council, 19 July 1560 (CSP, Foreign, Elizabeth, iii)

In 1569, Somer's activity was also known to the Spanish.

As to my letter, Cecil said he had it not, but they have really sent for one Somers to decipher it, which will not be an easy job....
De Spes to Philip II, 8 January 1569 (CSP, Simancas, p.96, 98)

He refused to return my packet, and these folks are getting a certain Somers to decipher the letters.
De Spes to the Duke of Alva, 10 January 1569 (CSP, Simancas, ii, p.99)

Occasionally, Somer directly wrote to Cecil in cipher (Somer to Cecil, 9 February 1563 CSP, Foreign, Elizabeth, vi). At the top of this letter, Somer wrote "Because it would be too much pain for you to decipher this yourself, I pray you that Mr. Allington may do it closely."

Deception (1560)

The intercepted French letter mentioned above, which was from a person in Edinburgh Castle and addressed to d'Oisel, representative of France, in Leith (Wikipedia), shows the French were not only aware of codebreaking by the English but also thought of taking advantage of it to plant deceptive information.

Because the enemy have the King's cipher, if D'Oysel thinks good to give any ciphered advertisement and let the same fall into their hands, they will not miss to decipher it, and finding therein the state of the place such as he pleases to make it, it may be somewhat beneficial to the negociation of the said Randan and the Bishop, who greatly desire to know truly for how long he yet has victuals.
Anonymous to d'Oysel, 18 June 1560 (CSP, Foreign, Elizabeth, iii)

The English, in turn, thought of using cipher for spreading false information among the French but in a different way. Wotton proposed to Cecil that a false letter be devised as written from the Duke of Norfolk and be carried so that "the bearer be taken by the French or French Scots" and that "to make it appear a true letter there may be another joined to it written in false cipher containing no matter at all." (Wotton to Cecil, 11 April 1560 (CSP, Foreign, Elizabeth, ii))

Ciphers with Foreign Allies

Ciphers from the French Huguenots (1562-1563)

The reign of Queen Elizabeth coincided with a series of religious wars in France between factions backed by powerful aristocratic houses. The Catholics were led by the House of Guise (including the Duke of Guise and his brother Cardinal of Lorraine, who were uncles of Mary, Queen of Scots, consort of the deceased brother Francis II of King Charles IX), while the Protestants were led by the House of Bourbon (in particular the Prince of Condé after the death in 1562 of his brother, Antoine of Navarre, father of Henri de Bourbon, later Henry IV) and Admiral Coligny. Although Catherine de' Medici, regent and mother of the boy king Charles IX, was a staunch catholic, she sought to take advantage of the Protestant party to counterbalance the overmighty Guises.

During the first war (1562-1563), the Huguenot leaders were allied with England.

Queen Elizabeth was offered a cipher from the Prince of Condé and the Admiral.

Sends herewith a cipher from the Prince and the Admiral, which is sent to her so they may hear from one another, of which they desire to be advertised by M. De La Haye.
Throckmorton to Elizabeth I, 15 October 1562 (CSP, Foreign, Elizabeth, v)

"The Queen's letter in cipher to Condé" is mentioned at least in Smith to Cecil, 24 November 1562 (CSP, Foreign, Elizabeth, v)

On the other hand, Smith could not receive one for some time.

Sir Nicholas said the Prince would let the writer have a cipher, and inform him to whom he may give and take advertisements from him.
Smith to Throckmorton, 10 December 1562 (CSP, Foreign, Elizabeth, v)
The Prince will not send his cipher to him by unknown messengers in these dangerous times, but hopes that he [Smith] will inform him by the writer.
Throckmorton to Smith, 14 December 1562 (CSP, Foreign, Elizabeth, v)

Smith also prepared a cipher himself for his correspondents of the Protestant party in France.

The writer has made a cipher between himself, D'Andelot, and Steward, that they may have intelligence from each other with less danger than this first was
Smith to Elizabeth I, 2 March 1563 (CSP, Foreign, Elizabeth, vi)

Sharing Cipher with German Princes (1569-1571; 1578, 1584)

Apparently, Henry Killigrew, who was sent to Heidelberg in 1569 to negotiate with the Elector Palatine cooperation for intervention in the civil wars in France, may have shared his cipher with the elector. When Walsingham, Secretary of State after Cecil, offered his services and desired to know his pleasure as to how he should communicate with him in January 1571, the elector proposed use of Killigrew's cipher.

Accepts and thanks him for his offers of assistance in preserving the mutual intelligence between himself and the Queen of England, and recommends that Killigrew's cipher should be used in their correspondence.
Elector Palatine to Walsingham, 14 February 1571 (CSP, Foreign, Elizabeth, ix)

Walsingham was given a cipher by Frederick Schwartz de Ruissingen, a servant of Gebhard Truchsess, who became Archbishop-Elector of Cologne in 1577 but triggered a war in 1588 by his conversion to the reformed faith and marriage with a Protestant woman (Wikipedia).

Desires to know if Walsingham still has the duplicate of the cipher which he sent to him at Antwerp six years ago, in which case he can write freely.
Frederick Schwartz De Ruissingen to Davison, The Hague, 18 December 1584 (CSP, Foreign, Elizabeth, xix)

In 1589, Schwartz suggested using the same cipher (Capt. Frederick Schwartz of Ruisingem to Walsingham, 9 January 1589 (CSP, Foreign, Elizabeth, xxiii)).

Cipher with Scotch Regent (1574, 1575)

England supported the Regent government of Scotland under boy king James VI, while his mother Mary, the deposed Queen of Scots was captive in England since 1568. The Earl of Morton, Regent of Scotland from 1572 to 1578 even shared a cipher for correspondence with Walsingham.

Cipher with the Prince of Orange (1577)

A cipher was also provided to the Prince of Orange, leader of the Dutch Revolt against the Spanish crown. After the rebellious and loyal provinces made an agreement in the Pacification of Ghent in 1576 to drive the mutinous Spanish troops out of the Netherlands, the Prince of Orange asked England's influence towards the departure of the Spaniards. In conveying that the Queen was "a good ally and neighbour," the Earl of Leicester provided the Prince of Orange with a cipher.

that they may the more freely correspond, he sends a cipher to be used as occasion shall require
Earl of Leicester to Prince of Orange, 7 March 1577 (CSP, Foreign, Elizabeth, iii)

Cipher from the King of Sweden

Queen Elizabeth appears to have been provided a cipher from the King of Sweden.

Her further pleasure is that you should thank Allard, servant to the King of Sweden for the offer of his service, and acquaint him with the mishap that has befallen her Majesty in losing the cipher he sent her, which by oversight of one of her maids was burnt among certain other waste papers; wherefore she desires another.
Walsingham to Sir Henry Cobham, 3 February 1583 (CSP, Foreign, Elizabeth, xvii)

Cecil-Norris Ciphers (1567-1570)

Henry Norris served as ambassador in France from the autumn of 1566 to August 1570. He used cipher in writing to William Cecil, Secretary of State, at least from 21 February 1567(CSP) to 25 July 1570(CSP). Cabala (1663) reproduces symbol ciphers used by Cecil in writing to Norris from 3 November 1567 (p.142) to 23 March 1570 (p.173).

By "a pleasant mistake of the editor" (Davys p.42), the "Postscript" to the letter of 27 September 1568 printed in Cabala (see the image below) is actually a decipherment of the passages in cipher. This allows us to identify the values of the symbols. The partially reconstructed cipher table is as follows.

It appears a symbol may be written in any orientation to encipher the same letter. Further, a single alphabetical letter is used to represent some proper names such as "A" representing "the Queen" and "x" representing "the Queen of Scots", while place names such as "Paris", "London", and "Callice" are all insignificant (Davys p.41). It appears abbreviation was also used in enciphering (see "of the" and "delivery" in the image below). The reconstructed cipher above allows us to identify some words such as "Monmorency" and "Sir Robert Stafford" in passages in cipher of the other letters.

It is noted that the first of these letters of 3 November 1567 (p.142) includes a passage "42 91 11 f Π", where "f" and "Π" are approximate letters for cipher symbols, but probably this does not represent a numerical cipher as was common in Italy but a coincidental occurrence of number-like symbols.

When d'Andelot, an ally for the English, was surprised and defeated on his way to the Prince of Condé, Norris recommended change of their cipher (Norris to Cecil, Paris, 25 September 1568, CSP, Foreign, Elizabeth, viii). Cecil's letter of 1 October 1568 (p.154; see also p.155, 161) refers to change of cipher. The new cipher also seems to use symbols rather than Arabic numerals.

Cryptanalysis in 1570s

Somer in 1570s

The decipherer Somer was still relied on in 1570s when letters concerning Mary, Queen of Scots were intercepted.

Mary had been deposed in 1567 in favor of her son residing in Stirling. While she lived as a captive in England, where she had sought protection, she still had supporters, including her ambassador in France, Bishop of Glasgow (Wikipedia). Early in 1573, the Castle of Edinburgh openly defied the new government in support of Mary and William Maitland of Lethington (Wikipedia) was one of the party. England backed the regency under the boy king (then seven) and assisted the government to reduce the Castle into surrender in May.

The intercepted letters of Mary's party were first sent to the court at Stirling for deciphering. When it did not succeed, one of the letters was forwarded to England to be attacked by Somer.

There be at Stirling, yet undeciphered, two letters from Lethington to the Bishop of Glasgow, and one to John Chisholm; .... If the King's master cannot decipher them, he trusts he shall have them to see what Mr. Somers can do with them.
H. Killigrew to Burghley, Edinburgh, 17 March 1573 (CSP, Foreign, Elizabeth, x)

The letters sent to Stirling to be unciphered are not come back.
H. Killigrew to Burghley and Leicester, Edinburgh, 4 April 1573 (CSP, Foreign, Elizabeth, x)

Sends a letter written in cipher by Lethington to the Bishop of Glasgow. If Mr. Somers can do anything with it he shall have the others. It is written in Chisholm's cipher, who is now in France, and bound homeward. If Verac have a cipher, they here would gladly have a copy of it,
H. Killigrew to Burghley and Leicester, Edinburgh, 7 April 1573 (CSP, Foreign, Elizabeth)

In the spring of 1577, Somer, now one of the Clerks of the Signet (CSP, Foreign, Elizabeth, xi), substituted for the Secretary Walsingham during his illness.

Cooperation with Allies

At about the same time, another, more renowned codebreaker, St Aldegonde, was active in the Netherlands and occasionally supplied deciphering to England (see another article). Wilson, ambassador in Flanders, wrote to Somer his appreciation of St Aldegonde's skill.

Is glad he is in the place of the Secretary now in the time of his sickness, and if he were joined with him would think the Queen had made a good choice. If St. Aldegonde had the original letters in cipher he sent to the Secretary, instead of the copies he made himself for him, he would easily explicate all things.
Wilson [ambassador in Flanders] to Summers, Brussels, 20 April 1577 (No.1400) (CSP, Foreign, Elizabeth)

Deciphering in England was relied upon by a foreign ally, Don Antonio (Wikipedia), claimant of the Portuguese throne since the crowning of Philip of Spain as King of Portugal in 1581.

Don Antonio was last night with me and gave me some letters in cipher from Bernardin de Mendoza to the Prince of Parma and La Motte, which he cannot decipher, and so wishes to be sent to you to be deciphered and shown to her Majesty, praying that then you would send them back, with what you have "picked out of them."
Stafford to Walsingham, 30 January 1584 (CSP, Foreign, Elizabeth, xviii)

Other Decipherers

There were others with deciphering skills.

One was Thomas Randolph, an English agent at the court of Scotland.

Has received certain ciphers out of Scotland, which he has sent to Mr. Randolph to be deciphered
Earl of Bedford to Cecil, Garendon, 23 June 1567 (CSP, Foreign, Elizabeth, viii)

Another was Knevet, recruited by Walsingham and sent to William Davison, an English agent in Flanders.

P.S. I send herewith certain letters which I intercepted this last week coming out of Spain, two of them being of some importance Mr. Knevet has taken some pains to decipher.
Davison to Walsingham, January 1578 (CSP, Foreign, Elizabeth)

Thomas Phelippes

Six months later, the ambassador Wilson mentioned a young talent in Paris.

I sent you this morning, by Mr. John Cobham, a letter written from la Motte to Don Bernardino. This afternoon I send, by the same messenger, a letter written in cipher, wherein may be matter of great moment, being well deciphered. If Sainte-Aldegonde cannot do it, nor Mr. Somers, I wish you would send it to your servant young Philips, who is with our ambassador at Paris. I do not write in cipher because of the faithfulness of this bearer,
Wilson to Walsingham, 30 June 1578 (CSP, Foreign, Elizabeth)

Thomas Phelippes is known for breaking the cipher of Mary, Queen of Scots during the Babington Plot in 1586.

Deciphers of Spanish letters in 1584 by an agent (Angel Angeliny) in the Low Countries (CSP, Foreign, Elizabeth, xviii, ibid.) as well as one of the Spanish ambassador in London, Mendoza, (ibid.) are in the hand of Phelippes.

Burghley and Walsingham


Drury (1569)

(Caligula C I, no.219, f.487): William Drury to Cecil, Berwick, 19 December 1569. Drury(Wikipedia) was in Scotland to closely observe the critical events when Mary, Queen of Scots, was held prisoner in Loch Leven Castle in 1567 and escaped in May 1568.

The key is reconstructed as follows.

Informant (1571)

(Caligula C III no.76, f.197): A few words in cipher. "A letter of intelligence concerning Q, mary's friends in Scotland, Verac, &c.; perhaps from Sadler or Randolph, to Ld. Burleigh. [1571]"

Coffer of Ciphers

Cecil, created Baron Burghley in 1571 and elevated to Lord High Treasurer in 1572, accumulated a "coffer of ciphers". In 1594, one secretary was asked to search the coffer for a cipher that Burghley had made himself for the Duc de Bouillion. (Daybell p.151)


A cipher used by Walsingham, secretary of state and spymaster, in 1574 in a letter to an unknown recipient (Folger Shakespeare Library) is similar to the Cecil-Norris cipher above.

More ciphertexts are found in letters related to Walsingham in Cotton Manuscript in the British Library.

Cotton MS Caligula C IV


(f.278) A few words in cipher, not deciphered. Walsingham to Killigrew, 30 July 1574, Woodstock.

(f.301) Regent of Scotland to Walsingham, 17 November 1574, Dalkeith. This is only a deciphered copy, but shows that Walsingham shared a cipher with the Regent of Scotland.

Cotton MS Caligula C VI


(f.83v) Bowes to Walsingham. Names are in cypher. 20 September 1580, Edinburgh.

(f.128) Walsingham to Randolph, 3 February 1581, Whitehall.

Partly in cipher, deciphered. Printed in William Robertson, The History of Scotland during the reigns of Queen Mary and of King James VI. (Google), p.86

The key is reconstructed as follows.

Cotton MS Caligula C VII


(f.196) Robert Bowes to (?)Walsingham, Edinburgh, 7 April 1583. A few words in cipher, not deciphered.

(f.299) Robert Bowes to (?)Walsingham, Edinburgh, St Johnstons, 31 July 1583. A few words in cipher, not deciphered.

Although the ciphertext is very short, the cipher seems to be a simple one (here is my transcription covering f.196 and f.299). If one can read the cleartext around the ciphertext, solution may not be difficult.

Bowes' letters are printed in The Correspondence of Robert Bowes (Google), which, however, does not include these letters. The volume records another instance of a short segment in cipher in a letter from Bowes to Burghley and Walsingham, 11 January 1581 (p.164; from Harleian MS 6999) as well as unidentified code numbers here and there ("98" on p.164, "223" on p.530 etc.).

Cotton MS Caligula C VIII


(f.95) William Davison to Walsingham. 27 July 1584. Partly in cipher, not deciphered. Davison (Wikipedia) was sent to Scotland and worked with Robert Bowes until September 1584.

Again, the cipher looks simple (here is my transcription).

(f.276) Edward Wotton to Walsingham, Edinburgh, 1 June 1585.

Wotton (Wikipedia) was sent to Scotland in May 1586 to undermine James Stewart, Earl of Arran.

Some portions in cipher. Both ciphertext and decipherment are eradicated, but partly supplied in a later hand. The cipher can be reconstructed as follows.

Add MS 32657 (BL) includes many letters between Walsingham and Wotton (1585). (Walsingham enciphered only a few words in these letters.) Only after I reconstructed the cipher as follows, I realized that it is the same as above.

Cotton MS Caligula B VIII

(f.251-252) (Bowes-Cecil?)

Catalogued as "67. Sir Robt. Bowes? to Secy Cecil? reporting the state of affairs in Scotland. 1583? 252." A few words are in cipher, not deciphered.

(f.286-299 & f.289) (Catholics)

Two cipher keys catalogued as "83."

The first is William Cotton's to Sir Francis Inglefield from Madrid and to D. Saunders, 7 June 1574.

This small code (nomenclature) is interesting in that words with the same initial letter are represented by similar symbols. For example, "A", "and", "all", "arme", etc. are represented by a plus(+)-like symbol with some additional stroke or circle.

The second, sent to Madrid, 12 August 1574, is a common cipher with a substitution alphabet and a short list of code symbols.

(f.290-293) (Bowes-Cecil?)

Catalogued as "84. Sir Robt. Bowes's report of his conferences and negociations to supplant Lenox. (partly in cypher.) 1580? 290.b".

Some words are in cipher, with interlinear decipherment. The key can be reconstructed as follows.

It appears symbols may be placed in different orientations to represent the same letter. This is a feature seen in other ciphers related to Cecil.


A letter mentioning "Monsieur de la Noues", "Mr Randolph", etc. A few words are in cipher, not deciphered.

(f.327-332) (Gifford-Thomas Throckmorton)

Catalogued as "102. Notes for a long dispatch from Dr Gifford, (seemingly in Flanders) to J. (T.? see below) Throckmorton at Rome; conveying intelligence about the Spaniards in that country. (partly in cypher, to which a key is subjoined fol.328 b.) 323."

The last page (f.332v) includes four substitution alphabets (Caesar cipher with different shifts) and some numerical codes. The body of the note includes only sporadic numerical codes, occasionally with interlined decipherment. Probably, this is a worksheet of a codebreaker (Phelippes?) for identifying the names represented by codes after the substitution parts have been deciphered.

The recipient looks like "T. Throckmorton" (f.332v), i.e., Thomas Throckmorton, a brother of Francis Throckmorton (DNB0).

The note "From D. Gifford to T. Throckmorton at Rome" on the last page is accompanied by a year, which looks like 1593 ("3" is not certain because of torn paper). Since Gilbert Gifford died in 1590, I wonder whether Phelippes was retrospectively working on an old intercepted letter.

Ambassadors in Paris

Amias Paulet [Poulet] (1576-1579)

Amias Paulet, appointed ambassador in France in 1576, reported to Burghley and Walsingham separately. He appears to have considered the cipher provided from Walsingham insufficient and asked Walsingham additional codes for some names. Afterwards, he recommended replacement of the whole cipher provided by Burghley.

It may please him to remember La Noüe is not in his cipher.
Amias Paulet to Walsingham, Paris, 12 October 1576 (CSP, Foreign, Elizabeth, xi)
It may please him to send him a cipher for the King of Spain, the Queen of Scots, some of the Princes of Germany, and some of the King's Council here.
Amias Paulet to Walsingham, Paris, 15 November 1576 (CSP, Foreign, Elizabeth, xi)
PS. I fear to commit anything to your Lordship's cipher, and therefore please provide me with a better. I have been bold to use it at present, because I do not think the time to be very dangerous.
Paulet to Burghley, Paris, 7 November 1577 (CSP, Foreign, Elizabeth, xii)

Sir Henry Cobham (1579-1583)

Change of cipher during Cobham's embassy in Paris is known (CSP, Foreign, Elizabeth, xvi).

Sir Edward Stafford (1583-1590)

Sir Edward Stafford, ambassador in France from October 1583, used different ciphers in reporting to Walsingham and Burghley (CSP, Foreign, Elizabeth, xviii). His alignment with Burghley rather than Walsingham caused complications of loyalties in Walsingham's intelligence network and even his letters were intercepted by Walsingham's agents (Wikipedia).

As with Paulet, he made additions to Walsingham's cipher.

I have sent you some names to add to your cipher which were forgotten.
Stafford to Walsingham, 13 February 1583/4 (CSP, Foreign, Elizabeth, xviii)

A small portion of Stafford's letter in cipher (CSP) is printed in Rees' Cyclopaedia.

In a letter of 25 February 1588 to the Queen, reporting a secret meeting with the King of France (Henry III), he said he wrote in Burghley's cipher from fear she might have lost her own. It was Walsingham, however, who inserted the decipher above each of the cipher words presumably for the Queen's viewing. (CSP, Foreign, Elizabeth, xxi).

A page from this letter is reproduced in Pryor (2003). (It is also found on the National Archives website.) It can be seen that the cipher includes numerical codes such as 66 (King of Navarre), 74 (Queen Mother), 77 (King of France), 79 (Queen Elizabeth), 100 (Spain), 109 (France), 111 (England) as well as non-alphabetic symbols to spell words and names and a special symbol for Pinard, French Secretary of State.

(According to Daybell, pp.156-157, Stafford's cipher with Burghley was polyalphabetical in that it allowed for three different options of alphabet. Stafford was also given a list of codes for more than 60 names of persons, place names, etc. Unlike others at the time, Stafford's code list employed a random sequence (a two-part code).)

Stafford used similar "cipher numbers" in writing to Walsingham (CSP, Foreign, Elizabeth, xviii). In the cipher, used at least in 1583, 74 stood for "the Duke of Guise" and 47 stood for "the King of Navarre." (CSP, Foreign, Elizabeth, xviii fn. 2)

Lord Cobham

Lord Cobham, brother of Sir Henry, also had separate ciphers with Burghley and Walsingham (CSP, Foreign, Elizabeth, xxi). Burghley provided a cipher in April 1588 (ibid.) and Cobham sent Walsingham one in June 1588 (ibid.)

Cobham was one of the peace commissioners sent in February 1588 to Flanders to negotiate a peace between England and Spain. England had been supporting the Dutch revolt against Spain by sending the Earl of Leicester as Governor-General but military fiascoes had led to an irreparable breach between the English and the Dutch by the end of 1587 (Wikipedia).

A list of code words for Lord Cobham, dated 25 May 1588, is described by Butler. The list contains several pages of substitution words which begin with the same letter as the first letter they stand for. For example, "thankful" substitutes for "traitorous"; "such" for "suborn"; and "weight" for "war." On the other hand, names are represented by just arbitrary words that may not begin with the first letter of word they represent. For example, "Beware" stands for the Pope; "Doubt" for the Emperor; "ferret" for Robert Parsons; "weasel" for William Creighton, a Scottish jesuit; "Anania" for Queen Mother of France; "Achitophel" for the Duke of Guise.

A variety of this cipher includes "visus" (Burghley), "oculus" (Lord High Admiral), "auditus" (Earl of Leicester), "aures" (Francis Drake), "olfactus" (Mr. Secretary), and "nares" (Lord Henry Seymour).

Henry Unton (1591-1592)

Henry Unton's cipher when he was English ambassador in France in 1591 was similar to Thomas Bodley's cipher in 1588 in that it consisted of alphabetical letters, figures, and arbitrary symbols (Daybell p.156).

George Gilpin (1584)

In 1584, Walsingham provided a cipher to George Gilpin, secretary of the Merchants Adventurers at Middelburg.

I received yours of the 14th by Mr. Edmond Yorke, with the cipher, which I will use as occasion requires.
Gilpin to Walsingham, 27 July 1584 (CSP, Foreign, Elizabeth, xviii)
On Friday was sevenight, I received your letters with the enclosures, which for five days I could not look at, nor will my memory yet serve to answer, especially that set down in cipher, which seems to differ from the cipher sent me, wherefore I pray to be more particularly informed thereof.
Gilpin to Walsingham, 9 August 1584 (CSP, Foreign, Elizabeth, xix)

The cipher employed numerical codes such as 30 (King), 50 (the Queen), 60 (England), 70 (France), 92 (Holland), 93 (Zeeland), 96 (troops), 200 (Count Maurice), 202 (the Admiral of Zeeland), 204 (Flushing), whereas the letter cipher consisted merely in "turning the alphabet the other way round" (CSP, Foreign, Elizabeth, ixi) (presumably meaning that "A" is enciphered as "Z", "B", as "Y", "C" as "X", etc.).

Ciphers for Thomas Bodley (1588, 1590)

Cipher of 1588

A cipher, dated 28 November 1588, for Thomas Bodley, is known (online). The diplomat, who may be better remembered today for reestablishing the Bodleian Library, Oxford, was sent as a minister to the Hague in 1588, where he stayed until 1596.

The letters of the alphabet are each assigned a symbol, including Arabic numerals 12-20. The letters "a", "e", and "p" are designated as nulls and other letters represent high-frequency words (e.g., "p" and "q" representing "the" and "that", respectively). Capital letters A-V represent country names and non-alphabetic symbols (including "30", "40", "50", and "70") represent personal names and titles. Towns in the Low Countries are represented by disguise names (e.g., "Paris" representing "Utrecht") or Arabic numerals 21-100 and 200.

Thus, Arabic numerals are used but only as one of a variety of symbols. Butler (p.133) also observes "numerals are freely used for proper names" during this age.

This cipher appears to have been used at least in a letter to Walsingham of 7 April 1589, which uses symbols for Morgan and Willoughby (DCB/001/HTML/0161/008). (According to Daybell p.158, this is an exception among more than his 1300 letters, almost none of which used cipher.)

Zodiac Cipher in 1590

On the other hand, apparently a cipher was not established with Burghley until late 1590, when Bodley asked Burghley to send one (DCB/001/HTML/0267/008, DCB/001/HTML/0270/008, DCB/001/HTML/0271/008).

According to Butler (p.131), a cipher sent to Bodley in 1590, written by Lord Burghley himself, used signs of the zodiac: Duke of Parma (Aries), Count Mansfeld (Taurus), Count Maurice (Gemini), States-General (Cancer), Council of State (Leo), Sir Francis Vere (Aquarius), and so on.

A code for an envoy in France in 1591 again used signs of the zodiac scheme(: Queen of England (Aries), King of Spain (Scorpio), Virgo (Normandy)) as well as days of the week(: French ambassador (Sunday), Duke of "Mercury" (Monday), soldiers (Tuesday), and victuals (Saturday)).

Pairing-Based Ciphers of Robert Cecil, Henry Neville, and Ralph Winwood

Neville-Cecil cipher

In 1599, Henry Neville was appointed ambassador to France. In May 1600, Neville went to Boulogne for negotiations with Spain. (Of the two allies for the Dutch struggle for independence from Spain, France had made peace with Spain in 1598 but England had not.) The talk was soon broken and Neville returned to England.

During his embassy in Paris, Neville used cipher in correspondence with Robert Cecil, son of Lord Burghley and now Secretary of State.

The cipher is based on pairing of letters (Davys p.42). It consists of four tables of pairing of letters and the letters "q", "x", "y", and "z" are reserved to indicate a table. When the "q" table is selected, for example, the letters "a" and "l" are paired and a plaintext letter "a" is enciphered as "l" and a plaintext letter "l" in turn is enciphered as "a". Change of tables may occur in the middle of a word. Thus, the following sequences both read "the Patriarch."

  thepa  triarch
  thepa  triarch

The following codes are also used.

a.100 the Queen
a.101 England/English
a.102 Ireland
a.120 the States
a.121 the Earl of Essex
b.102 Tyrone
6.120 the French King
6.122 Monsieur de Volleroy
c.100 the King of Spain
c.131 the Duke of Savoy
d.100 the Duke of Bouillon
f.150 the King of Scotland
f.154 the Ambassador of Scotland
f.158 the French ambassador
g.140 the Pope
g.142 the Spanish ambassador
   l.160 the Protestants
l.165 the Papists
m.173 Spain
m.175 Scotland
m.177 Rome *added as of 14 January 1559 OS (p.145)
o.194 Rochell
r.162 the Chancellor
r.163 the Friar *added as of 14 January 1559 OS (p.145)
r.165 the States Agent
u.205 war
u.206 Peace
w.200 Treaty of Peace
w.209 Charles Paget

Winwood-Neville-Cecil cipher

During Neville's absence, his assistant, Ralph Winwood, served as resident in Paris and later officially succeeded Neville in 1601.

Winwood used a cipher similar to the above, first with Neville and then with Cecil. One notable difference is use of "χ", "θ", and "6" as indicators of pairing tables, which allows letters "q", "x", "y", and "z" to be enciphered.

There appear to be two schemes for codes. One is numerical codes such as "105" (England), "124" (Spanish ambassador), "125" (ambassador of Florence), "126" (ambassador of Venice), "144" (the French King) and the other is substitution words such as "Health" (England), "Wisdom" (Spanish ambassador), "Advise" (ambassador of Florence), and "Respect" (ambassador of Venice).

Another Pairing Cipher (1588)

A cipher based on pairing appears to have been used in a letter from Henry Ogilvie, Laird of Powrie to Walsingham, written early in December 1588 (CSP, Foreign, Elizabeth, xxii).

Polyalphabetic Cipher (1595)

A letter in 1595 from Edward Wilton to the Earl of Essex used fourteen different ciphers. (Daybell p.157)

Henry Wotton (1603-1607)

In July 1604, Sir Henry Wotton, who was appointed ambassador to Venice by James I, sent a numerical cipher to Ralph Winwood, who had been sent to The Hague as agent in 1603. The ciphers provided by Wotton were of simple numerical ciphers that assign each vowel five figures and each consonant two. In the first cipher, U was represented by 5-9, O by 10-14, I by 15-19, E and A by 20-30. 31 and 32 represented B, 33 and 34 G, and the rest of the consonants had two figures each in regular succession. Higher numerals stood for individuals such as 180 (Philip III), 184 (the Pope), 148 (the Duke of Savoy), 160 (the Papal Nuncio), etc. Numerals below 5 were nulls. (Life and Letters of Sir Henry Wotton, Vol. I, p.319-329)

A cipher used in 1605-1607 between Wotton and Sir Charles Cornwallis, English ambassador to Spain, was similar to this. Numbers 6-30 represented vowels, each being assigned five figures, and numbers 31-66 represented consonants, each being assigned two figures. Numbers 67-111 were largely for names and places. Numbers 1-5 were nulls. It was prescribed that a line above a cipher figure represented doubling the letter it signifies and a line under a figure represented numbers per se (e.g., monetary amount). (Daybell p.156)

Another source says Wotton's cipher included 29 (war), 39 (England), 43 (Genoa), 55 (the Queen of Spain), 67 (ammunition) (James Westfall Thompson and Saul K. Padover, Secret Diplomacy, p.260).

Scotch Ciphers

Mary of Guise

Armel Dubois-Nayt and Valérie Nachef (2020), "Developing the Art of Secret Writing across Borders: The Journey of Marie de Guise’s Ciphers between France and Scotland", Études Épistémè (online) 37 (OpenEdition) presents four ciphers used in the correspondence of Mary of Guise in 1553-1560.

The 1553 Code

This is used in letters to Antoine de Noailles (25 August 1553, 6 November 1553), preserved in Archives du ministère des affaires étrangères Paris: Correspondence Politique, Angleterre, XII (hereinafter, AE).

The 1556 Code

This is used in a letter to Henry II of France, dated 8 December 1556 (BnF fr. 20457, f.313 Gallica).

The same volume includes a letter in cipher from Henry Cleutin (Mr d'Oysel) to the Duke of Guise, 30 March 1555 (f.299, f.300, f.330) with a plaintext, which is printed in Teulet, Papiers d'États relatifs à l'Écosse au XVIème siècle, Tome 1, p. 720. This allowed Dubois-Nayt and Nachef to reconstruct the table.

I found another undeciphered letter, which can be read with this cipher, in Add MS 33531 (BL), f.27. It is from Henri Clutin [Cleutin], Sieur d'Oysell, to Mary of Guise, Queen Regent of Scotland, dated 7 December [1559]. The beginning of the ciphertext reads "d'une partie des delliberations des seigneur de ceste compagnie sur sa ... preparer ...."

1559 Code

This is used in letters to Gilles de Noailles (19 August 1559, 2 January 1559 [1560 in modern calendar]). It appears this was also used in a letter for the King, which Mary asked Gilles de Noailles to recipher in his cipher with the King when forwarding to the King.

This cipher was broken by the English codebreaker John Somer, and the key is preserved in SP53/23 no.7.

1560 Code

SP53/23 no.8 is a cipher between Mary of Guise and Cardinal of Lorraine and Duke of Guise. Dubois-Nayt and Nachef considers this was used in a letter from Mary to her brothers dated 27 March 1560, of which a plaintext copy is in Cotton MS, Caligula B IX (BL), f. 93-95.

Moray-Wood Cipher (1568)

Add MS 32091 (BL) includes a letter partly in cipher from James Stewart, Earl of Moray and Regent of Scotland, to John Wood, Scottish ambassador in England. 13 July 1568 (f.213). Although the cipher seems simple, the short ciphertext is not deciphered. My transcription is here.

Figure Cipher

One interest in the study of ciphers of this period is in transition from arbitrary symbols to Arabic numerals. While exotic symbols may look enigmatic at a first glance, it is also difficult to handle for enciphering and deciphering (though the additional labour for writing such a symbol was much less than today, when our writing is limited by a computer keyboard). It would be difficult to manage more than a hundred such symbols, while one can use as many different figures as required. However mysterious symbols may look, the same security can be achieved more easily by figures.

In Italy, which was leading in cryptology, figure cipher was common in the mid-sixteenth century. The Spanish ciphers in the latter half of the sixteenth century still used a mixture of Arabic numerals, alphabetic letters, and arbitrary symbols to encipher letters of the alphabet (see another article) and it was in the late seventeenth century that figures replaced symbols (see another article).

Use of Figures in England

In the Elizabethan England, apparently, it was predominantly symbols rather than figures that were used for spelling letter by letter. For codes representing words or names, figures were beginning to be in common use, as exemplified by ciphers used by Sir Edward Stafford mentioned above. Other than these, a report by one Jacques Rossel in Antwerp to Walsingham in 30 November 1578 (CSP) includes ciphers 15 and 20, which are said to represent Count Bossu and Duke Casimir of the Palatinate (CSP). Audley Danett (biography), secretary to John Norris in command of the English troops in the Netherlands and a regular correspondent for Walsingham, also used a numerical cipher for representing names in 1582 (CSP, Foreign, Elizabeth, xvi). A letter from Lord Buckhurst (Thomas Sackville, sent to the Netherlands) to Walsingham dated 18 June 1587 used "40" for the Earl of Leicester (CSP).

A cipher which "for the most part consists of figures which run on without a break" and thus could not be deciphered completely is recorded. It is a letter from Francis Hartley (Gifford) to M. Wilsdon (Phelippes) enclosed in a letter from Stafford to Walsingham from January 1588 (CSP).

Numerical ciphers are said to have been already popular in the early seventeenth century. (Daybell p.156) Henry Wotton's ciphers with his fellow ambassadors were entirely numerical (Daybell p.157).

One definite piece of evidence of English figure ciphers for individual letters might be that of August 1619 used in Sir Isaac Wake's letter from Turin, Italy (Cabala p.392; Davys p.44). It is a regular assignment as follows.

Figures followed by an alphabetic letter are codes.

51.a. the King of England
93.a. the Bohemians
95.a. the Emperour Ferdinand
97.a. Germany
99. the King of the Romans

50.b. the Princes of the Union
51.b. the Prince Palatine
51.b.[sic] the Marquess Brandenbergh
54.b.[sic] the Marquess Auspach
56.b. Count Ernest Mansfelt
52.c. the Duke of Savoy
91.c. the Agent of England

The cipher used by the Duke of Buckingham in 1627 to communicate with France was also a numerical cipher. (Daybell p.156)


A.J. Butler (1901), 'Some Elizabethan Cipher-Books', Transactions of the Bibliographical Society, VI, pp.127-135 (Internet Archive)

John Davys, An Essay on the Art of Decyphering (1737)

Cabala, sive Scrinia Sacra: Mysteries of state and government (1663) (Internet Archive)

Calendar of State Papers (CSP), Foreign (British History Online)

Rees' Cyclopaedia, (Search Internet Archive, Vol. VIII (1819), Plates Vol. IV (1820))

Astle (1784), The Origin and Progress of Writing (Google), Plate facing p.176 seems to be the source of the article in Rees' Cyclopaedia.

Felix Pryor, Elizabeth I: her life in letters (2003)

The Diplomatic Correspondence of Thomas Bodley, 1585-1597 (online)

Memorials of affairs of state in the reigns of Q. Elizabeth and K. James I, vol.1, (Internet Archive)

Logan Pearsall Smith (1907), The Life and Letters of Sir Henry Wotton (Internet Archive)

James Daybell (2012), The Material Letter in Early Modern England

Secret Writing in the Public Records, Public Record Office (1974)

Garrett Mattingly (1955), Renaissance Diplomacy (Internet Archive) p.274 n.137

Ciphers in UK National Archives

Full treatment of the topic would require inspection of three volumes in the Public Record Office containing "some 180 to 200 cipher-codes or decipherments of intercepted despatches" belonging to this period (Butler p.209, probably referring to PRO SP106). PRO SP106 is divided into SP106/1-3 (Elizabeth I), 106/4 (James I), 106/5 (Charles I), 106/6 (Charles II), 106/7-8 (Anne to George II), 106/9 (George II), 106/10 (Italian and other ciphers etc.). (Samuli Kaislaniemi transcribed the tables of contents for SP106/1-3 (Elizabeth I) and SP106/4 (James I).)

SP 53 at the UK National Archives has subseries SP 53/22 and SP 53/23, which include "Ciphers, including those for papers seized at Chartley Castle on the discovery of the conspiracy in 1586 which were used, when deciphered, to implicate Mary and bring her to trial." SP 53/18/55 has the famous forged postscript of Mary's letter to Babington, and its key is in SP 12/193/54 (images are at Wikipedia).

John Somer's Book of Ciphers

SP53/23 in the National Archives includes a collection of ciphers broken by John Somer (see above). The following lists some twenty pages in the beginning of the collection. (The first page is a note attributing these to John Somer. So, "no. 1" is the second page.)

French ciphers in the 1550s

See another article for French ciphers during the reign of Henry II of France.

no. 1 (1554) Cipher between King Henry II of France and Antoine de Noailles (Wikipedia), his ambassador (1553-1556) in England

no. 2 (1557) Cipher between "Noailles the Prothonotary, then French ambassador in England" (François de Noailles) and d'Oisel (Wikipedia), French representative in Scotland

no. 3 (1557) Cipher between Henry II and d'Oisel

no. 4 (1557) Cipher between Sevre "French ambassador in Portugal" (cf. Wikipedia) and the Captain of Dieppe (?Monsieur de Fosse [Fors], search on Google)

no. 5 (1557) Cipher between the Lord of Lorne in Scotland and a French man

no. 6 (1557) Cipher between a French noble and one of Scotland

Ciphers of Mary of Guise, Queen Dowager of Scotland

no. 7 (1559) Cipher between Mary of Guise, Queen Dowager of Scotland, and "Noailles the Counsellour", Gilles de Noailles (Wikipedia), French ambassador to the Queen Dowager

This corresponds to the cipher of Table 1, as reconstrued in V. Nachef, J. Patarin, and A. Dubois-Nayt, "Mary of Guise's Enciphered Letters" in Ryan et al. (ed), The New Codebreakers: Essays Dedicated to David Kahn on the Occasion of His 85th Birthday (2016). It was used in Mary of Guise's three letters in 1559. (Their Table 1 is a cipher used in a letter of Mary of Guise to Antoine de Noaille in 1553.)

*Those deciphered during the reign of Queen Elizabeth are also given numbers of their own sequence. So "no. 7" is also given "no. 1".

no. 8 (1560) Cipher between the Queen Dowager and the Cardinal of Lorraine and Duke of Guise

Ciphers of Mary, Queen of Scots

no. 9 (1569) Cipher between the Duke of Châtellerault (Wikipedia), regent for Mary, Queen of Scots, and the Commendator of Kilwinning of Scotland (Wikipedia)

no. 10 (1571) Cipher between Mary, Queen of Scots, and "some of hers" in Scotland

no. 11 (1571) Cipher between Mary, Queen of Scots, and the Duke of Alva, Spanish lieutenant general in the Low Countries

no. 12 (1571) Cipher between Mary, Queen of Scots, and la Motte, French ambassador

no. 13 (1570) Cipher between Mary, Queen of Scots, and la Motte, French ambassador

no. 34 (1573) Cipher between Lethington [Liddington] (Wikipedia) and Grange (Wikipedia) and a secretary of theirs sent into France for aid a little before Edinburgh castle was besieged.

no. 14 (1570) Cipher between Mary, Queen of Scots and Lethington [Lidington]

no. 16 (1571) Cipher between Mary, Queen of Scots and Lethington [Lidington]

no. 17 (1571) Cipher between Mary, Queen of Scots and the Bishop of Glasgow, her ambassador in France

no. 18 (1571) Cipher between Mary, Queen of Scots and Verac, being in Scotland for the French king, and also used between la Motte, French ambassador, and Lethington in 1572

no. 19 (1571) Cipher between la Motte and Verac

no. 20 (1572) Cipher between la Motte and Verac

no. 21 (1571) Cipher between Mary, Queen of Scots and Lord Seton (Wikipedia), sent to the Duke of Alva for aid and money


Héder, M ; Megyesi, B. The DECODE Database of Historical Ciphers and Keys: Version 2. In: Dahlke, C; Megyesi, B (eds.) Proceedings of the 5th International Conference on Historical Cryptology HistoCrypt 2022. Linkoping, Sweden : LiU E-Press (2022) pp. 111-114. , 4 p. [pdf]

Megyesi Beáta, Esslinger Bernhard, Fornés Alicia, Kopal Nils, Láng Benedek, Lasry George, Leeuw Karl de, Pettersson Eva, Wacker Arno, Waldispühl Michelle. Decryption of historical manuscripts: the DECRYPT project. CRYPTOLOGIA 44 : 6 pp. 545-559. , 15 p. (2020) [link]

Megyesi, B., Blomqvist, N., and Pettersson, E. (2019) The DECODE Database: Collection of Historical Ciphers and Keys. In Proceedings of the 2nd International Conference on Historical Cryptology. HistoCrypt 2019, June 23-25, 2019, Mons, Belgium. NEALT Proceedings Series 37, Linköping Electronic Press. [pdf]

©2012 S.Tomokiyo
First posted on 17 March 2012. Last modified on 17 September 2023.
Articles on Historical Cryptography
inserted by FC2 system