A stream cipher you run by hand with an ordinary deck of 52 cards plus two jokers — the order of the deck is the key. Schneier built it so a field agent could carry strong cryptography as nothing more suspicious than a deck of cards. It was thought secure for years; it has since been shown detectable — not broken open, but its keystream carries patterns a cryptanalyst can spot as non-random, and it has been set aside for practical use.
Solitaire is an output-feedback stream cipher. The deck generates a keystream — one number from 1 to 26 for each letter of your message. To encrypt, add each keystream number to the matching plaintext letter, modulo 26. To decrypt, subtract. Encryption and decryption use the same procedure; only the add/subtract differs.
Every card has a value. Using bridge suit order — clubs 1–13, diamonds 14–26, hearts 27–39, spades 40–52 — each of the 52 cards is a number, and either joker counts as 53. When a card is read out as a keystream letter, only 1–26 is needed, so its value is taken modulo 26 (so the 2 of hearts, value 28, gives keystream 2 → the letter B).
The whole secret is the starting order of the deck. Sender and receiver must begin from decks in the exact same order. Everything else about the algorithm is public.
"Keying" means agreeing on that starting order. Schneier gives three ways.
Where ~95 bits comes from. A newspaper bridge diagram deals all 52 cards into four hands of 13. Count the distinct deals — the multinomial 52! / (13!)4 — then read its size in bits as log₂.
So a single bridge deal carries about 95 bits of entropy — if the column is chosen unpredictably. Two caveats. The column is printed in public, so the real secret is not those 95 bits but your private rule for which column. And it is less than the 52! ≈ 226-bit keyspace of a freely shuffled deck, because a bridge diagram only fixes which hand each card sits in — not the order within a hand, nor where the two jokers go.
What a "bit" is. A bit is one yes/no answer — a single coin flip, a binary 1 or 0. One bit tells two things apart. The rule that runs everything here: n bits name 2n possibilities, so every added bit doubles the count.
Each step doubles the one above it (8 bits is a byte — 256 values — the most familiar landmark). The jump from 4 to 10 bits, 16 up to 1,024, shows how fast doubling runs away; by 95 bits the count is astronomical. Taking log₂ is just reading this backwards: "how many bits name this many possibilities."
What that buys against brute force. At a trillion guesses per second, trying every 95.4-bit possibility takes about 1.7 billion years — the expected hit landing near 850 million. For a second yardstick, point the single fastest computer on Earth at it: LineShine, the TOP500 #1 as of June 2026, runs at 2.198 exaflops — about 2.2 million times that trillion-per-second rate — yet even pretending each operation were a whole guess it still needs roughly 773 years to exhaust the space; a real guess costs thousands of operations, pushing that back into the millions of years.
Where ~1.4 bits per letter comes from. This is Shannon's estimate of the entropy of written English — how much genuinely new information a letter carries once redundancy is counted out. After "the quick brown f", the next letter is almost surely "o", so it tells you almost nothing.
That figure sets passphrase length. To match a freely shuffled deck (~226 bits) you would need about 160 characters of English; even the recommended 64–80 is only ~90–110 bits. A short, memorable phrase carries almost nothing — which is why it is a weak key no matter how good the rest of the cipher is.
Ideally, one key, one message — reusing a key lets two ciphertexts be subtracted to strip the key. For practial use, you could create a shared pre-agreed rule to remix the key after each message, but that does not address the issue of key reuse.
How long, really — and why brute force is the wrong question. Every figure above assumes an attacker must defeat the bridge column's full ~95 bits. But brute force attacks the key — the starting deck order — not the algorithm, which is public. So the real time to break a message depends entirely on how much genuine entropy went into keying the deck, and it ranges from instant to longer than the universe. (Testing one candidate key takes a realistic ~10,000 operations.)
All times are on the same machine, LineShine. Two worlds: a strong key is effectively never — a full shuffle is log₂(54!) ≈ 237 bits, and 1049 years is about 1039 times the age of the universe, which is just the math's honest way of writing "never." A weak key falls in seconds to months (on one laptop core the two weak rows are still only ~45 minutes and ~4 months) — the cipher's strength collapses to the key's.
But brute force is the wrong question. A huge keyspace does not make a cipher secure; what matters is whether its output is indistinguishable from random, and Solitaire's keystream measurably is not (section 05). That leak — and a reused key — are the real doors, not the brute-force wall.
Each keystream number costs five operations on the deck. Read the steps here, then watch them run on the live deck in the bench below — Step one letter at a time, or Run the whole message. Jokers are gold (★A / ★B) and both count as 53.
Convert the output card to its keystream letter (value mod 26 → A–Z), then add it to the next plaintext letter to encrypt, or subtract it from the next ciphertext letter to decrypt — wrapping the alphabet, so A+A=B and Z is the do-nothing letter.
Card values — you need these for the count cut and the output. Using bridge suit order:
To read a card out as a keystream letter, take its value modulo 26 → 1–26 → A–Z: the 2♥ (value 28) gives 2 → B; the 5♠ (value 44) gives 18 → R. Setup: mark one joker A and the other B (say a small star and a big one). Both count as 53, but A moves down one and B moves down two — so they must be told apart.
Type a passphrase to key the deck, then press Run to play the cipher across your message, or Step one letter at a time. The deck shows the top card and the struck card it points to, and the line below spells out the keystream-plus-letter arithmetic for every character.
A sound keystream should look like fair dice: two values in a row should match about 1 in 26 of the time (0.0385). In 1999 Paul Crowley measured Solitaire's and found matches near 1 in 22.5 (0.0444). Generate a stream here and watch the same bias show up on your own machine.
What the bias actually gives an attacker. A stream cipher hides your message by adding a keystream to it: ciphertext = plaintext + key. If that keystream were truly random the result would be a one-time pad — unbreakable, because the ciphertext would reveal nothing. The bias is the crack in exactly that. When two keystream values in a row come out equal — which Solitaire does too often — subtracting the two ciphertext letters cancels the key and leaks a raw fact about the plaintext.
Worked leak. Take the commonest English pair, TH (T=20, H=8), landing where the keystream repeats — say the value 9 twice:
The attacker computes c₂ − c₁ = 14 straight off the ciphertext — and that equals p₂ − p₁, because the two equal keys cancelled. They now know the second letter is 14 past the first without the key; "14 apart" plus "most common digram" points at TH.
Why this is slow, not a magic decoder. The catch: nobody tells the attacker which pairs were repeats. For a true repeat, c₂ − c₁ equals the plaintext difference; for an ordinary pair it equals that plus keystream noise. The bias only means about 1 pair in 22.5 carries the real signal instead of 1 in 26 — a faint skew that surfaces only from a large pile of ciphertext, never from one "CQ." And here is the part most accounts blur: that the keystream is distinguishable from random is the whole finding — it is what disqualifies Solitaire as a serious cipher. It is not a way to read your message. No known procedure turns the bias into plaintext at any volume; leaked information is not a decryption. Section 06 puts that in its place.
1 · Brute force — not the weakness. The keyspace is enormous (section 02). A well-keyed deck is unbreakable by brute force essentially forever, on any hardware.
2 · The keystream bias — the real cryptographic flaw, and the subtle one. Crowley (1999) showed the output is not random: when the top card repeats a value across two rounds (about 1 in 51), the output repeats ~34% of the time, pulling the match rate to 1/22.5. That makes Solitaire broken by definition — a keystream that fails the most basic randomness test cannot be called secure, and the bias lives in the algorithm, so every key inherits it. But — and this is the point most accounts blur — being distinguishable from random is not the same as being readable. The leak is tiny (Shiu 2019: ~0.0005 bits per character, about one page leaking a single bit), and no known method turns it into your plaintext at any volume.
3 · The non-reversibility — structural, and secondary. Crowley also showed the deck-advance is not one-to-one: one found edge case esists where a joker on the top and a joker on the bottom both move to second place, so two deck states collapse into one. It sounds alarming but does not stop you decrypting — you never reverse the deck; both sides run the same forward keying and one side subtracts instead of adds. What it breaks is Schneier's argument that the keystream is uniform, and it is part of why the bias exists.
4 · The operational flaws — how it actually gets broken. Not cryptography, but this is what reads your mail. Key reuse is a cliff at message number two: two ciphertexts under one key subtract to c₁ − c₂ = p₁ − p₂, the key gone, the pair pried apart by English structure — total and instant, no statistics, no waiting. A weak key falls at message number one: a short passphrase carries so little entropy that its small keyspace brute-forces in minutes. Add no recovery from a single hand-slip and an evening to encrypt a long note, and these — not the bias — are why Solitaire stays off the field.
The lesson worth keeping. A cipher's security has almost nothing to do with the size of its keyspace once that keyspace is big enough; it is about whether the output is indistinguishable from random. Solitaire is broken by definition (the bias), essentially never broken by brute force (the keyspace), and actually broken in the field only by a reused or weak key.
The honest coda: nobody has clearly done better with cards alone. Crowley's own follow-up, Mirdek, he calls "very insecure." Shiu's 2019 fixes cost the one thing that justified a card cipher — that a person can do it at a table. That is the open problem: enough internal state to resist a computer, few enough steps for a human. The modern answer that trades the deck for a grid of tiles is LC4 — the next leaf in this book.
sources reviewed · Schneier — algorithm, keying, test vectors · Crowley — the keystream bias · Crowley — Mirdek · Programming Praxis — worked implementation · Shiu 2019 — Analysis of Solitaire