Deciphering messages from a Bill Cipher terminal

Responses from this ARG are not always plaintext. A terminal that belongs to a character whose entire gimmick is hidden information will hide information, and the Gravity Falls franchise has always used classical, breakable methods rather than anything modern. This guide is the practical version of the ciphers page on our companion reference, aimed specifically at strings you find inside a terminal response.

Start by identifying the shape of the string

Before choosing a method, classify what you are looking at. A run of letters with no spaces is probably Caesar, Atbash, or substitution. Letters with gaps or hyphens, or letters that stop at ten, are probably A1Z26. Two-digit pairs are probably a Polybius square. Letters mixed with digits and an a-f set is hexadecimal, which is a number base rather than a cipher. Longer texts with repeating character patterns are likely Vigenere or a keyword substitution.

The five methods that matter

Caesar shift. Every letter moves a fixed number of positions, wrapping around. Test all 25 shifts before concluding anything, because the useful shift is often not 3. The franchise uses minus-3 in the 2016 Cipher Hunt announcement, and shifting a string three places backward is usually the first thing worth trying.

Atbash. The alphabet maps onto itself, A to Z through M to N. It is its own inverse, so applying it twice returns the original, which makes it the fastest cipher to rule in or out. The Cipher Hunt's first clue combined a minus-3 Caesar pass with Atbash, which is the useful lesson: the show stacks methods, so a failed Caesar does not mean a failed decode.

A1Z26. Letters become alphabet positions. BILL is 2-9-12-12. If a string is mostly two-digit groups, this is almost certainly it.

Polybius square. A 5 by 5 alphabet grid, one letter per cell, encoded as row-column pairs. This is the method that solved the 2016 hunt's final clue, where fans read branches and knots in the background of the statue image as coordinate pairs, worked out which variant of the square was in use, and narrowed the result by assuming the answer was a place name ending in OR. That "assume a plausible shape for the answer" technique is the single most useful habit for Polybius, because the keyspace is small and the constraint does the work.

Hexadecimal. Not a cipher. Convert to decimal and the numbers often turn out to be coordinates, which is exactly how the sixth Cipher Hunt clue worked: a crude drawing of a Bill Cipher beside hexadecimal values that converted into a location. Hex is worth checking on any string containing digits and letters a through f, because it is frequently used to make plain numbers look like noise.

Two habits that keep you honest

Decode, do not transcribe. If you cannot reproduce the message from the raw string using a method you can name, you do not have the answer. Most bad "ARG code lists" online are transcriptions of a fan's guess, and once one is copied the original reasoning is gone.

Expect nothing sometimes. The franchise includes joke strings, deliberately undecodable filler, and red herrings, because a machine that answers everything would be less interesting than one that does not. Silence is a valid result. A decode that produces grammatical English about the show is almost always the right one; a decode that produces a long string of unrelated dictionary words is almost always the wrong one.

Keeping notes

Record the exact input you typed, the exact response, and the method you tried, with the date. The terminal is open-ended and the site is unfinished, so responses change as the artefact is updated, and a note without its input is not reproducible. The sources page explains why we publish our own verification method but not other people's unverified command lists.