Caesar Cipher_
Encode a message with any shift from 1 to 25, decode one when you know the shift — and solve it when you do not. There are only twenty-five keys, which is why this cipher is a puzzle rather than a lock.
Every other tool prints all twenty-five candidates and leaves you to read down the column. This one scores them: English letters occur at known rates, so the candidate whose letters look most like English is almost always the message. It names that shift, and it says how sure it is.
| Rank | Shift | Fit | Result |
|---|
- Input
- Any text, and a shift from 1 to 25 when you already know it.
- Output
- The shifted text. In Solve mode, the shift the message was enciphered with, plus every candidate ranked by its fit to English letter frequency.
- Processing
- Shifted and scored in this tab as you type. Nothing is uploaded.
- Limits
- Frequency analysis needs about 20 letters before it means anything. Below that the tool refuses to name a winner and shows the full list instead.
- Not encryption
- Twenty-five keys is not a key space. A program tries all of them faster than you can read this sentence, which is what the Solve button is doing.
How a shift cipher is broken in one step
The key space is the whole weakness
A shift cipher has exactly twenty-five useful keys, because a shift of twenty-six is no shift at all. That is not a large number in any sense — it is smaller than the number of cards in half a deck. Anyone holding enciphered text can apply all twenty-five shifts and read the one that turns into language, by hand, in a couple of minutes. No cleverness, no computer, no weakness in the arithmetic. The cipher is not badly implemented; it is doing exactly what it was designed to do, and what it was designed to do stopped being enough around the ninth century.
Frequency analysis picks the answer out of the twenty-five
Reading twenty-five candidates is tedious and unnecessary. English letters appear at stable rates — e around 12.7% of the time, t around 9%, z under a tenth of a percent — and a shift moves the whole distribution around the alphabet without changing its shape. So the correct candidate is the one whose letter distribution sits closest to English, measured here as a chi-squared distance. The tool computes that for all twenty-five, sorts them, and tells you which one won and by how much. Al-Kindi described the method in the ninth century and it has not needed improving since.
Where the method stops working, and the tool says so
Frequency analysis needs a distribution, and five letters do not have one. On a short string the scores land close together and the ranking is noise carrying a decimal point. Rather than name a winner it cannot justify, this page reports the letter count, refuses the verdict below about 20 letters, and shows all twenty-five rows so you can read them yourself. The same happens when the text is not English at all, or was never a shift cipher: the top candidates score within a few percent of each other, and the note says that is what a close finish means.
The shift you used and the shift that undoes it are different numbers
Encipher with a shift of three and you decipher with a shift of twenty-three, because the two must add to twenty-six. This trips people up constantly, and it is why so many implementations are confidently wrong by twenty-six-minus-N. The one exception is thirteen, which pairs with itself — that is the entire reason ROT13 needs no decode button, and it is a property of the number rather than of the cipher. This page reports both numbers every time so there is nothing to work out.
Encode with a key, or solve without one
- 01Pick a mode. Encode and Decode both need a shift; Solve does not, and hides the field.
- 02Type or paste the message. The wheel underneath shows what each letter becomes at the current shift, which is the paper version of the same thing.
- 03In Solve mode, read the verdict line first. It names the shift the message was enciphered with and how confident that is, and the ranked table underneath shows the reasoning.
- 04If it declines to name a shift, look at the letter count it reports — under about twenty letters there is not enough evidence, and the full list is there to read instead.
Four things people arrive holding
A puzzle with no key
A CTF string or a treasure-hunt clue, rotated by an unknown amount.
Solve
the shift, scored against English
A homework example
Shift three on a known phrase, to check your own working.
Attack at dawn
Dwwdfn dw gdzq
A classroom cipher wheel
Two paper discs, and the letter mapping they produce.
all 26 pairs at your shift
the wheel is this table, bent round
Text that was never enciphered
You are not sure the string is a cipher at all.
shift 0 as the best fit
it already looks like English
The shifts worth knowing by name
| Shift | Known as | Undone by | Why it comes up |
|---|---|---|---|
3 | Caesar's own | 23 | The shift Suetonius attributes to Julius Caesar. Every textbook uses it, so most examples you meet are this one |
13 | ROT13 | 13 | Half of twenty-six, so it undoes itself. The Usenet spoiler convention, and the only shift needing no decode step |
1 | — | 25 | The smallest real shift, and the one a puzzle uses when it wants to be found quickly |
25 | — | 1 | Equivalent to shifting back by one, which is why it looks almost like plaintext at a glance |
0 | Not a cipher | — | No shift at all. Reported by the solver when the text already looks like English, because that is a real answer |
Any shift and its inverse add to twenty-six. Thirteen is the only one that is its own inverse, and every other pair has two distinct numbers you have to keep straight.
Why this is a puzzle and not security
| Property | Caesar shift | What real encryption has |
|---|---|---|
| Key space | 25 keys | At least 2¹²⁸, so exhaustive search is not a strategy |
| Key | A number from 1 to 25 | A secret nobody can guess or enumerate |
| Letter frequency | Preserved exactly — only relabelled | Destroyed; ciphertext is indistinguishable from random |
| Broken by | Reading twenty-five lines | Nothing practical, which is the whole claim |
| Good for | Puzzles, spoilers, teaching | Protecting something |
This is not a criticism of the cipher — it is two thousand years old and it was never claiming otherwise. It is a warning about using it for anything you would mind a stranger reading.
Getting the shift right the first time
- Give the solver a full sentence if you can. Twenty letters is the floor, and a hundred is where it stops being close.
- If the solver refuses, encode a longer sample with the same shift and solve that instead — the shift is a property of the message, not of the sample.
- Remember the pair adds to twenty-six: 3 and 23, 5 and 21, 7 and 19. Only 13 pairs with itself.
- Numbers, punctuation, spaces and accented letters are never moved, so word lengths and shapes survive. That is a leak, and it is often how a puzzle is solved by eye before any tool is opened.
- A close finish between the top two usually means the text is not English. The method is language-specific, and the frequency table here is an English one.
- For the fixed-rotation family — ROT5 on digits, ROT18, ROT47 across printable ASCII — use the ROT13 page, which covers those variants.
Where a Caesar shift lets you down
It is not encryption and never was
There is no key worth the name — twenty-five possibilities is a list, not a key space, and the Solve button on this page walks the whole of it in less time than the page took to load. Anything you would mind a stranger reading needs real encryption, not a rotation.
The shape of the text survives untouched
Spaces, punctuation, capitals and word lengths are all preserved, so a one-letter word is a or I, and an apostrophe near the end of a word narrows it to a handful of possibilities. Puzzles are routinely solved from that alone, before any frequency analysis.
Frequency analysis is language-specific
The scoring here uses English letter frequencies. Enciphered French, German or Spanish will still be ranked, and the ranking will be less reliable — the top candidates score closer together, which the confidence reading reports as a weak result rather than hiding.
Decoding needs the inverse, not the same shift
A shift of 3 is undone by a shift of 23. Applying 3 twice gets you a shift of 6, further from the plaintext rather than back to it. Thirteen is the only shift where running it twice returns the original, and that is arithmetic rather than a feature of the cipher.
Non-Latin letters pass straight through
Cyrillic, Greek, CJK and accented Latin characters are left exactly as they are, because a 26-letter rotation has nothing to say about them. That is the honest behaviour, and it also means such text is not hidden at all.
What is shifted, and how the solver decides
- Alphabet
- The 26 unaccented Latin letters, upper and lower case, with case preserved. Everything else — digits, punctuation, accented letters, other scripts, emoji — is passed through untouched
- Shift range
- 1 to 25, clamped, with the field rewritten to the clamped value so it can never display one number and apply another
- Solving
- Chi-squared distance between the candidate’s letter distribution and English letter frequencies, computed for all 25 shifts plus the unshifted text, sorted best first
- Confidence
- The margin between the best candidate and the runner-up. A wide margin is reported as certain, a narrow one as weak — and a weak result is shown as weak rather than rounded up to an answer
- Refusal threshold
- Below 20 letters no winner is named at all. The threshold was chosen by testing, not by feel: below roughly twelve letters the ranking is a coin toss with a decimal point on it
- Shift reported
- The shift the message was ENCIPHERED with, with its inverse named separately in the same sentence. The two are trivially confusable and most of the wrong answers in this space are one confused for the other
- Scope
- The general shift cipher. The fixed rotations — ROT5, ROT18, ROT47 — and the Usenet convention live on the ROT13 page
- Network
- None from tool code. A test sweep calls every function this page uses with
fetchandXMLHttpRequestreplaced by stubs that throw, so a stray request fails the build instead of shipping. Disconnect from the network and the page still works.
Questions about the Caesar cipher
What is a Caesar cipher?
A substitution cipher that moves every letter the same number of places along the alphabet, wrapping round from Z to A. With a shift of three, A becomes D and Z becomes C. Suetonius records Julius Caesar using a shift of three for his correspondence, which is where the name comes from and why three is the number in every example.
How do I decode a Caesar cipher without the key?
Press Solve. There are only twenty-five keys, so every one can be tried — and rather than printing all twenty-five for you to read, this page scores each against English letter frequencies and names the one that fits best. It also reports how confident that is, because on a short string the scoring is not evidence.
How many possible Caesar ciphers are there?
Twenty-five useful ones. A shift of twenty-six returns every letter to itself, so it is the same as no cipher at all, and shifts above twenty-six repeat. That is the entire key space, and it is why the cipher is broken by anyone willing to read twenty-five lines.
Is the Caesar cipher the same as ROT13?
ROT13 is one Caesar cipher — the one with a shift of thirteen. Thirteen matters because it is half of twenty-six, which makes it pair with itself, so no decode step is needed. Every other shift needs its inverse to undo it.
What shift did Caesar actually use?
Three, according to Suetonius, who describes the substitution in his life of the emperor. His nephew Augustus is recorded using a shift of one, without the wrap — so AA stood for X rather than the alphabet turning over, which is a different and slightly worse scheme.
Why does the solver refuse to answer sometimes?
Because there are not enough letters for the method to mean anything. Frequency analysis compares a distribution against English, and a five-letter string has no distribution — the scores land close together and the winner is arbitrary. Below about 20 letters the tool says so and lists all twenty-five candidates instead of picking one it cannot justify.
Is a Caesar cipher secure?
No, and it has not been since roughly the ninth century, when al-Kindi wrote down frequency analysis. Twenty-five keys can be searched by hand. It is a fine puzzle, a fine way to hide a spoiler from a passing glance, and a good way to teach what a cipher is — and it is not protection for anything.
Is anything I type here sent to a server?
The work is JavaScript running in this tab. Every function it calls is covered by a test that stubs fetch and XMLHttpRequest to throw, so a request that slipped in would break the build rather than reach a server — and you can confirm it for yourself by disconnecting and carrying on.