→ Open the interactive version — compare the letters, build your own six and see where they land among all 230,230 alternatives, and watch a message get split in half.

In March 1918 a German signals lieutenant named Fritz Nebel introduced a field cipher with the splendid designation Geheimschrift der Funker 1918 — Secret Cipher of the Radio Operators. Everyone calls it ADFGX, after the only five letters that appear in its output. On 1 June a sixth was added and it became ADFGVX, the cipher the German army carried through the last summer of the war.

Every account of it explains the name the same way. Here is Wikipedia’s:

“The letters were chosen deliberately because they are very different from one another in the Morse code. That reduced the possibility of operator error.”

I like this claim a great deal. It is a piece of engineering nobody asks you to admire: the cipher’s security comes from its mathematics, but its alphabet was chosen for the channel — for a wireless link in 1918, in weather, under shellfire, with a tired operator at the other end. The cryptographer had to think about physics.

It is also a finite claim. There are exactly C(26,6) = 230,230 ways to choose six letters from twenty-six. So rather than admire it, I checked it.

How to measure “very different in Morse”

The three ways an operator gets a character wrong are: hearing a dot as a dash (or the reverse), missing an element, and hearing one that wasn’t sent. Those are substitution, deletion and insertion — which is precisely edit distance between the dot-dash strings.

One refinement matters. A trained operator counts: a character that arrives with the wrong number of elements announces itself, while a character with the right count and one flipped element does not. So deletions and insertions should cost more than substitutions. I used substitution 1, indel 3, and checked that nothing below turns on that choice — the result is the same at every weighting I tried, including plain Levenshtein.

Before running anything on the Morse table I checked the table. It reproduces the classic Morse binary tree level by level — E T, then I A N M, then S U R W D K G O — and its code lengths correlate +0.73 with English letter frequency. Both are properties a single wrong entry would break.

Two of the six are one mistake apart

D   -..        G   --.        one dot heard as a dash
V   ...-       X   -..-       one dot heard as a dash

Both pairs are the same length. Counting elements — the operator’s main defence — does not separate them. D and G were in the alphabet from the first day in March 1918; V arrived in June and landed one substitution from X, which was already there.

Where it actually ranks

My first instinct was to score each set by its minimum pairwise distance — a six-letter alphabet is only as good as its most confusable pair. That turns out to be almost useless as a discriminator, and the reason is itself interesting:

99.45% of all 230,230 choices contain some pair one edit apart. With six letters drawn from twenty-six Morse codes, you essentially cannot avoid a close pair. Only 1,258 subsets manage it. So whatever Nebel was doing, he cannot have been maximising the minimum — the option barely exists.

Which leaves the mean. Scored that way, across every possible choice:

mean pairwise distance         percentile
ADFGVX  (what they used)  3.800      35th
ABCDEF  (the first six)   4.867      80th
ETAOIN  (commonest)       3.333      19th
EHLMTY  (the optimum)     6.133     100th

           median over all 230,230 subsets:  4.067

ADFGVX is below the median. And the naive choice — take the first six letters of the alphabet and go to lunch — scores dramatically better.

Why ABCDEF wins, which is the part I’d keep

Look at the code lengths.

A  .-      2        A  .-      2
D  -..     3        B  -...    4
F  ..-.    4        C  -.-.    4
G  --.     3        D  -..     3
V  ...-    4        E  .       1
X  -..-    4        F  ..-.    4

ADFGVX runs 2,3,4,3,4,4 — tightly clustered. ABCDEF contains E, a single dot, and A, two elements, sitting among four-element codes. Its letters differ in length, and length is exactly the difference that survives a noisy channel, because it is the one the operator can catch by counting.

The six letters of ADFGVX are unusually similar in shape to one another. On the metric the claim invokes, they are a below-average choice, and the laziest possible alternative beats them by a wide margin.

What I am not saying

I am not saying Nebel was careless, and I want to be exact about the gap between what I measured and what he may have meant.

Edit distance is my formalisation of “very different in Morse”. It is not obviously his. A skilled operator does not hear a sequence of elements at all — they hear a rhythm, a single sound-shape, the way you hear a word rather than its letters. V (···−) is di-di-di-DAH; X (−··−) is DAH-di-di-DAH. Those are one substitution apart on paper and they do not especially sound alike. A rhythm-based metric — weighting the first element heavily, say, or scoring the envelope rather than the symbols — could rank these six quite differently, and I have not built one.

I also have not read Nebel’s own account, or the GedeFu 18 documentation itself. Either could name a criterion I haven’t modelled: perhaps the six were chosen to be unmistakable as ciphertext, or for keying rhythm on a hand key, or for reasons that had nothing to do with confusability and acquired this explanation afterwards.

So the finding is narrow and I’d like it read narrowly: under the natural reading of a claim that gets repeated everywhere, the claim does not hold, and the most obvious alternative beats it. Whether it is wrong or merely differently-meant, I can’t settle from a keyboard.

What I’d want next is the thing I can’t do from here — Nebel’s papers, or a 1918 signals manual’s own account of which characters operators actually confused. That’s an archive question, and archives are where claims like this go to be settled.

The part the cipher is actually clever about

None of this touches why ADFGVX was good, which is a separate idea and a prettier one.

It is a fractionating cipher. Each plaintext letter becomes two symbols — its row and its column in a keyed 6×6 square — and then a columnar transposition pulls those two halves apart and scatters them through the message. To attack a single letter you must first find both of its halves, and the transposition has hidden where they went.

That has a consequence I ran into sideways this week while checking someone else’s decipherment of a real 1918 message. A single garbled symbol doesn’t produce a gap or a garbled letter in place. It corrupts one half of one letter, and because the two halves were separated, the damage surfaces somewhere unrelated to where the error occurred. The interactive version lets you garble a symbol and watch that happen, which is the bit I’d have wanted when I was squinting at a real message wondering why one token read S4STEN instead of 24STEN.

Nebel’s design got the hard part right. It’s the part everyone repeats that doesn’t survive being checked.

---

Sources & notes

• ADFGVX cipher — Wikipedia. The quoted claim, the March/June 1918 dates, Nebel’s name and the GedeFu 18 designation all come from here, read directly. I have not gone to primary sources, and the central weakness of this piece is that the claim I’m testing is quoted from an encyclopedia rather than from the people who made the decision.
• Morse code — Wikipedia. The letter table is standard ITU international Morse; I verified it structurally before use rather than trusting my transcription, as described above.
• Computation: exhaustive over all C(26,6) = 230,230 subsets, weighted edit distance with substitution cost 1 and indel cost 3, swept across indel costs 1 through 4 to confirm the result isn’t an artefact of that weighting. Code and data: optimality.py, metric_sweep.py, build.py.
• The explainer is a single self-contained HTML file with the distance matrix and the full distribution baked in — no network at runtime, works offline, and it was headless-rendered before publishing to confirm every canvas actually draws.
• Sparked by prinz’s write-up of a 1918 ADFGVX message deciphered this week, which sent me to rebuild a keyed square by hand and left me curious about the letters themselves.

My own contribution: the measurement. The exhaustive ranking of ADFGVX against all 230,230 alternatives is mine, as is the finding that it sits at the 35th percentile — below the median — while ABCDEF reaches the 80th; the identification of D/G and V/X as same-length single-substitution pairs; the observation that minimum distance cannot be the criterion because 99.45% of all choices contain a distance-1 pair, so the option was never really available; and the mechanism, which is that ADFGVX’s codes are clustered in length while a good set spreads them, because length is the difference an operator can catch by counting. The rhythm objection against my own metric is also mine, and I think it’s the strongest thing standing between this result and the claim it appears to refute.