Three secret codes you can actually write to your friends

There's a particular satisfaction to passing a note that looks like noise to everyone else and makes perfect sense to exactly one person. It doesn't require an app or a special device. You just need a system, and someone on the other end who knows the same system.

Three codes have been doing this job for centuries. None of them are hard to learn. All of them still work.

The Pigpen cipher: writing in shapes

The Pigpen cipher turns every letter into a geometric fragment. The idea is simple: draw two tic-tac-toe grids, one normal and one rotated 45 degrees into an X shape. Fit the 26 letters of the alphabet into those grids, two letters per cell. The code for any letter is the shape of that letter's "pen" in the grid, with a dot added if it's the second of the two letters in a cell.

So A lives in the top-left pen of the first grid (the corner that looks like an open square bracket, rotated). B shares that same pen, but gets a dot. C is in the top-center pen, D gets a dot, and so on. When you write a coded message, you draw the pen shapes, not the letters themselves.

The result looks like alien hieroglyphics. Most people seeing a Pigpen message for the first time genuinely cannot tell it's a code at all. It reads as doodling, or a child's invented alphabet, or some kind of technical diagram. That's the whole point: the message doesn't look like a message.

The Pigpen cipher was a favorite of Masonic lodges in the 18th century, which is part of why it keeps turning up in puzzle hunts, escape rooms, and ARGs. It's a terrible cipher for keeping secrets from a determined codebreaker. A single known plaintext breaks it instantly. But for passing a note to your friend at the table next to you? It works perfectly.

To get started, look up a Pigpen alphabet chart (any image search will find one) and copy it out. Both you and your friend need the same chart. From there, practice writing a short phrase until reading the shapes becomes fast. Once you can write it without looking at the chart, you're set.

The Caesar cipher: shifting the alphabet

Julius Caesar used this one. The principle is pure and old: shift every letter of the alphabet forward by a fixed number of positions. If your shift is 3, A becomes D, B becomes E, C becomes F, and so on. The word CAT becomes FDW. At the end of the alphabet you wrap around, so X becomes A, Y becomes B, Z becomes C.

The number you choose is the key. Both you and your friend agree on it ahead of time, and you never write it in the message. A shift of 3 is the classical Caesar version. A shift of 13 is called ROT13, and it has a nice property: encoding and decoding are identical operations, since 13 is exactly half of 26. Apply it twice and you're back to the original.

Writing it out is easiest with two alphabet strips. Write the alphabet across a piece of paper, then write it again underneath, shifted by your agreed number. To encode, find the plain letter on the top row and write the cipher letter from the row below it. To decode, go the other direction. After a few messages you won't need the strip anymore.

One thing to know: a Caesar cipher is easy to break if someone knows to look for it, because the letter frequencies of English still show up in the ciphertext. E is the most common letter, and whatever the ciphertext letter is that appears most often, that's probably E. But for notes between friends who trust each other, frequency analysis is beside the point. The barrier isn't mathematical; it's just that no one else knows to try.

The book code: a shared library

Book codes are the most satisfying to use, and the most work to set up. The idea: you and your friend each own the exact same edition of the same book. Every word in your message is referenced by three numbers: page, line, word. To encode "meet" you find the word "meet" somewhere in the book and write down where it lives. The message becomes a list of coordinates.

The book itself is the key. Without it, the numbers mean nothing. And unlike a cipher, there's no frequency pattern to analyze, because you're referencing existing words in a real text, not substituting letters one-for-one.

The practical challenge is finding common words. Articles ("the", "a"), prepositions ("in", "at", "on"), and names are fine. But if your message uses a word that doesn't appear in the book, you're stuck. Some book-code users work around this by spelling out hard words letter by letter, referencing individual letters in the text instead of whole words. That's slow, but it works.

For friends who want to try it, a paperback novel from a used bookstore is the traditional choice: cheap, obscure enough that no one will guess the key, and dense enough to find most words. Buy two identical copies, or split one apart (an old, falling-apart copy) and give your friend half. The edition matters, since different printings paginate differently.

The modern version: a message inside a photo

All three methods above share the same structure: a code exists that you can write on paper and hand to someone, and understanding it requires knowing the system. They're fun. They've been fun for a long time.

The modern equivalent has a different property: the message isn't written in code at all. It's hidden inside a perfectly ordinary-looking photo. Someone who doesn't know to look at the photo differently just sees a photo. Nothing to decode. Nothing that even looks like a secret.

GhostCode does this through a feature called Pixel Ghosting, which is a form of steganography, the practice of hiding information inside an ordinary-looking carrier. You write your message in the app, set a Key (a word or phrase you share separately with your friend), and the app produces a JPEG that looks completely normal. Your friend opens the same app, imports the photo, enters the Key, and reads the message. Everyone else who sees the photo sees nothing.

The Key travels separately from the photo, the same way the book travels separately from the coordinates in a book code. That's the piece that makes it work: the message and the means to read it don't go through the same channel. You could text the photo and tell your friend the Key in person, or the reverse. It's the same underlying logic as invisible ink, applied to the pixels of a photo instead of paper.

GhostCode also supports QR codes, a Self-Destruct timer that makes a message unreadable after a set time, and a Failsafe option that lets you show harmless content if someone presses you for a key. Those are for situations where the bar is higher than passing notes at lunch. The basic case, Pixel Ghosting with a Key your friend already knows, is about as simple as the Caesar cipher to use, and the result is indistinguishable from any other photo.

Questions people ask

What's the easiest secret code to start with?

The Caesar cipher. You can write it out with pencil and paper in about two minutes, and once you've memorized the shift, you don't need any materials at all. The Pigpen cipher takes a little longer to get fluent with because you're learning a new symbol set, not just shifting what you already know. Book codes are the most setup but the hardest to break without the key.

Can my friend decode my message without knowing the system?

No, and that's the whole point. The system is the key. Your friend needs to know whether you're using Pigpen, Caesar (and which shift), or a book code (and which book and edition) before they can read anything. Agree on the method out of band, meaning in person or through a channel the message isn't going through. Don't write the key in the message itself.

Are these actually secure?

Not against someone who wants to break them. Pigpen and Caesar ciphers are trivial for a cryptographer, and book codes have practical limits. These are social codes: they keep a note private in the context of everyday life, not against a dedicated attacker. For genuine message privacy between two people, something like GhostCode is more appropriate, because the recipient needs both the app and a Key you shared separately, which is a much higher bar than recognizing a symbol set.

Does the recipient need the same app to read a GhostCode message?

Yes. GhostCode is a closed loop: the sender encodes in the app, the recipient decodes in the app. The photo itself looks normal to anyone without the app. That's the trade-off compared to pen-and-paper codes, which anyone can decode once they know the system. With GhostCode, knowing the Key isn't enough without the app; knowing the app isn't enough without the Key.