Using the Hill tool
Type in the Key matrix box and the cipher rebuilds as you type. Four values make a 2x2 and nine make a 3x3, and they can be digits from 0 to 25 or letters where A is 0. GYBNQKURP and 6 24 1 13 16 10 20 17 15 are the same key.
Swap the boxes to decode with the same matrix. Not every matrix can be undone, and when one can't the tool says so and names the determinant rather than handing back nonsense.
Blocks, not letters
The text is cut into blocks as wide as the matrix. Each block becomes a column of numbers, gets multiplied by the matrix, and every result is reduced modulo 26 back into a letter.
A 3x3 key means every output letter depends on three input letters at once. Change one letter of the plaintext and three letters of the ciphertext move. That's what defeats the frequency counting that breaks Caesar and affine, because no single ciphertext letter stands for a single plaintext one.
Blocks have to be full, so a short tail is padded with X. Decoding gives the padding back, and you trim it yourself.
Why some keys are rejected
Decoding multiplies by the matrix inverse, worked out modulo 26 rather than over the real numbers. That inverse exists only when the determinant shares no factor with 26.
26 is 2 times 13, so a determinant that is even, or a multiple of 13, or zero, has no inverse and the key is a one-way door. It's the same restriction the affine cipher runs into with its multiplier, for the same arithmetic reason.
The tool checks before it encodes. A key you can't decode with is worse than an error message.
Lester Hill, 1929
Lester S. Hill published it in The American Mathematical Monthly in June 1929, under the title "Cryptography in an Algebraic Alphabet". It was the first cipher to work on more than three symbols at a time with linear algebra, and the first to treat a message as a vector.
He also built the hardware. Hill and Louis Weisner patented a mechanical device in 1929 that did the matrix arithmetic with gears, because doing a 6x6 multiplication modulo 26 by hand is slower than the message is worth. Almost nobody bought one.
It was never really used. The US government encrypted three-letter radio call signs with it and little else, and the reason is that the cipher collapses against a known-plaintext attack. Guess or learn nine plaintext letters and their ciphertext, and you solve for the whole 3x3 key with school algebra. Hill's cipher is taught everywhere and was trusted nowhere.
Related conversions
Playfair had the same goal 75 years earlier, enciphering pairs of letters so that single-letter frequencies say nothing, and it does it with a grid rather than arithmetic.
Affine is the one-letter version of the same idea, multiplying and adding modulo 26. Hill is that formula with a matrix in place of the multiplier.
Questions
What is the Hill cipher?
A cipher from 1929 that treats blocks of letters as vectors and multiplies them by a key matrix modulo 26. It was the first to apply linear algebra to encryption.
Why won't my key work?
Its determinant shares a factor with 26, so the matrix has no inverse modulo 26 and the message could never be decoded. Change one value and try again.
How do I write the key?
Four values for a 2x2 or nine for a 3x3, read left to right along each row. Digits from 0 to 25, or letters where A is 0 and Z is 25.
How is the Hill cipher broken?
With known plaintext. If you know nine plaintext letters and the ciphertext they produced, a 3x3 key falls out of a system of linear equations.