Caesar Cipher: Why 'Find the E' Is the Weak Way to Break It

CipherSpec card

Name

Caesar cipher (also called a shift cipher)Source: Wikipedia, "Caesar cipher"

Type

Monoalphabetic substitution: every letter moves the same number of places along the alphabetSource: Wikipedia, "Caesar cipher"

Era

1st century BC; Julius Caesar was assassinated in 44 BCSource: Encyclopaedia Britannica, 11th ed. (1911), "Caesar, Gaius Julius"

Inventor or user

Used by Julius Caesar (shift of 3) and Augustus (shift of 1), according to SuetoniusSource: Suetonius, Divus Iulius 56 and Divus Augustus 88

Broken

No record of how, or whether, anyone broke it in Caesar's time. The earliest known description of frequency analysis is al-Kindi's, 9th centurySource: Wikipedia, "Caesar cipher" and "Frequency analysis"

Strength against frequency attack

Very weak. In the test on this page, 20 letters of ciphertext were enough to recover the key in 95.4% of 10,000 messagesSource: this page's test

caesar-cipher-spec.csv the values on this card, as CSV

Top: letter shares in Pride and Prejudice (537,128 letters). Bottom: the Sherlock Holmes stories (431,119 letters) after a Caesar shift of 3. The whole profile slides three places to the right.

A Caesar cipher replaces each letter with the one a fixed number of places further along the alphabet. Every letter changes, but the pattern of letter counts does not, and given enough text, that pattern hands over the key. Julius Caesar used a shift of three, so his A became D, his B became E, and so on through the alphabet.

With only 25 useful shifts, anyone could try them all, but counting letters points straight at the likely key. The quickest counting shortcut, finding the most common ciphertext letter and assuming it stands for E, is also the weakest. In this page's test on 10,000 messages of 20 letters each, that shortcut recovered the key 30% of the time, while comparing all 26 letter counts at once recovered it 95% of the time.

How does the Caesar cipher work?

Write out the alphabet, and underneath it write the alphabet again, starting at D and wrapping A, B and C onto the end. To encipher, find each plain letter on the top row and copy the letter directly below it. To decipher, work from the bottom row back up, which amounts to shifting every letter three places back.

Plain:  ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher: DEFGHIJKLMNOPQRSTUVWXYZABC

Letters at the end wrap around to the start, so X becomes A, Y becomes B and Z becomes C. In arithmetic terms, number the letters from A = 0 to Z = 25, add the shift, and keep the remainder after dividing by 26. For Y, that means 24 + 3 = 27, which leaves a remainder of 1, the number for B.

A Caesar wheel set to a shift of 3. Each plain letter on the outer ring sits over its cipher letter on the inner ring; X, Y and Z wrap to A, B and C.

Shift the wheel three places and look at a real sentence: Suetonius describing Caesar's own letters, in J. C. Rolfe's 1913 translation.

Plain:  If he had anything confidential to say, he wrote it in cipher, that is,
        by so changing the order of the letters of the alphabet, that not a word
        could be made out.
Cipher: Li kh kdg dqbwklqj frqilghqwldo wr vdb, kh zurwh lw lq flskhu, wkdw lv,
        eb vr fkdqjlqj wkh rughu ri wkh ohwwhuv ri wkh doskdehw, wkdw qrw d zrug
        frxog eh pdgh rxw.

The first letters step through like this: I (8) + 3 = 11, which is L; F (5) + 3 = 8, which is I; H (7) + 3 = 10, which is K.

Every ciphertext on this page was produced or checked by a program, and the same code reproduces published examples, including the "THE QUICK BROWN FOX" line in the Wikipedia entry on the cipher. It also matches that entry's shift-4 example, in which "exxegoexsrgi" decodes to "attackatonce," and, for a shift of 13, the rot_13 codec built into Python.

What did Julius Caesar actually write?

The account comes from the Roman writer Suetonius, in section 56 of his Life of Julius Caesar. Caesar wrote confidential letters "in cipher," and a reader who wanted to decode them "must substitute the fourth letter of the alphabet, namely D, for A, and so with the others," which describes a shift of three. Suetonius says that Caesar used the method; he does not say that Caesar invented it.

The opening of Suetonius's Lives of the Caesars, which begins with Julius Caesar, in a late-12th-century manuscript, British Library Egerton 3055. The cipher passage, section 56, comes later in that life.

In section 88 of the Life of Augustus, Suetonius also describes the version Augustus used. Augustus wrote "B for A, C for B, and the rest of the letters on the same principle, using AA for X," a shift of one with a special rule at the end of the alphabet.

Retelling vs. the text

Retelling: Augustus wrote AA in place of Z. The English Wikipedia entry on the Caesar cipher says this, as read on 2026-10-07.

The text: The Latin says pro X autem duplex A, a double A for X, and Rolfe's 1913 translation follows it. In the classical Latin alphabet, X was the last of 21 native letters; Y and Z were placed after it in the 1st century BC for Greek loanwords. Suetonius gives no reason for the rule.

How well the cipher protected Caesar's correspondence is unknown, because there is no record of how anyone in his day solved simple substitution ciphers, if anyone did.

Generated illustration

A writing tablet, tied and sealed. Suetonius says Caesar wrote confidential letters "in cipher," read by putting D for A "and so with the others."

How do you break a Caesar cipher without the key?

Two attacks work without the key. The first is brute force. A 26-letter alphabet allows 25 useful shifts, because a shift of 26 puts every letter back where it started, so you can try all 25 and keep the one that reads as English.

The first four words of the Suetonius sentence, enciphered with a shift of 3, then undone with each of the 25 shifts. Only one row reads as English.

The second way needs no knowledge of words, only counting. The earliest known description of this method, frequency analysis, comes from al-Kindi (born around 800, died in the early 870s), a scholar who worked in Baghdad. His recipe, in paraphrase, was to take a different text in the same language, about a sheet long, then count its letters and rank them. Next, rank the symbols in the ciphertext the same way and match the two lists in order.

That recipe applies to a Caesar cipher because the shift preserves each letter's count and changes only its name. In the chart at the top of this page, the tallest bar in ordinary English is E; after a shift of three, the tallest bar is H, and every other bar has moved the same three places. Call this profile the language's frequency fingerprint: the cipher relabels it but does not blur it.

Breaking this cipher requires no flash of insight, only a tally sheet and patience.

Is the most common letter always E?

In long English text, it usually is. In Pride and Prejudice, E accounts for 12.9% of all letters, about one letter in eight, while T comes second at 8.7%, about one in twelve. The Holmes stories put E at 12.3%. Larger tables, including German and French, are on the letter frequency page.

Short messages behave differently. The Suetonius sentence above contains 126 letters, and its most common letter is T, which appears 17 times, while E appears only 14. A solver who assumed that the top ciphertext letter, W, stood for E would undo a shift of 18 and get TQSPSLOLYJ, which is not English.

That is not a quirk of one sentence. For this page, a program drew 10,000 random 100-letter stretches from the Holmes stories, and E came out on top in 60% of them, with ties split evenly. T led in about 13%, A in about 9% and O in about 8%.

Which letter is most common in each of 10,000 random 100-letter stretches of the Holmes stories, with tied letters sharing the credit. E leads in about six stretches out of ten.

Think of a short message as a noisy copy of the language's letter counts: the signal is still there, but any single count is easy to knock over.

How many letters does it take to break a Caesar cipher?

The stronger attack uses all 26 counts at once, scored here with the chi-squared statistic:

1. For each of the 26 possible shifts, undo the shift and count the letters in the result.
2. For each letter, square the difference between that count and the count you would expect from ordinary English text of the same length, then divide by the expected count.
3. Add up all 26 results. The shift with the lowest total is the best candidate.

On the Suetonius sentence, the correct shift of 3 scores 15.5. The runner-up, a shift of 22, scores 347.8, more than 20 times higher. The full table of 26 scores is in caesar-cipher-worked-example.csv.

Chi-squared score for each of the 26 ways to undo the shift on the Suetonius sentence, against the Pride and Prejudice counts. The lowest score, 15.5 at shift 3, is the key.

Share of 10,000 random messages per length where each method recovered the shift. Reference counts from Pride and Prejudice; messages cut from The Adventures of Sherlock Holmes.

Letters of ciphertext	"Most common letter is E" found the key	All 26 counts (chi-squared) found the key
5	15.5%	47.4%
10	22.1%	78.3%
20	30.2%	95.4%
30	36.4%	99.3%
50	45.4%	10,000 of 10,000
100	60.2%	10,000 of 10,000
200	76.7%	10,000 of 10,000
500	92.7%	10,000 of 10,000
1,000	98.7%	10,000 of 10,000

At 20 letters, the full comparison was right about three times as often as the E guess. The E guess rests on one letter, whichever is on top, and ignores the pattern of the other 25, while the chi-squared score combines all 26, so one letter running unusually high or low moves it less.

How the test worked

• Reference counts: Jane Austen, Pride and Prejudice (Project Gutenberg eBook #1342), 537,128 letters from Chapter I to the last line, leaving out the preface and illustration captions of the 1894 edition that the file reproduces. This plays the role of al-Kindi's different text in the same language.
• Messages: random stretches of Arthur Conan Doyle, The Adventures of Sherlock Holmes (eBook #1661), 431,119 letters from the first story's title to the last line. Each stretch received a random shift from 1 to 25.
• Letters: A to Z, with upper and lower case merged and accented letters counted as their base letter (é as e), as on the letter frequency page. Spaces, punctuation and digits were removed.
• Trials: 10,000 per length, with a fixed random seed. When letters tied for most common, or shifts tied for the lowest chi-squared score, each tied guess received equal partial credit. At this sample size, each percentage carries a sampling margin of at most about one percentage point either way (95% confidence).
• Check: swapping the two books' roles (Holmes as the reference, Pride and Prejudice as the messages, 4,000 trials per length) moved the chi-squared results by up to about 3.5 points (91.9% instead of 95.4% at 20 letters) and the E-guess results by up to about 10 points (70.7% instead of 60.2% at 100 letters). The full comparison stayed well ahead at all five lengths checked, from 10 to 100 letters.

These results were measured on ordinary English prose under a single fixed shift; other kinds of text were not tested.

Reading works on even shorter messages: the Wikipedia entry on the cipher, citing a cryptography textbook, says that in practice the key can almost certainly be found with at least six letters of ciphertext. In rare cases more text is needed: RIVER shifted nine places becomes ARENA, so a five-letter message can decode two different ways.

Does the attack work as well in German and French?

On short messages, both attacks found the key more often in German and French than in English, and comparing all 26 counts still beat the E guess. At 20 letters, taking the top letter as E found the key in 53.7% of German messages and 50.7% of French ones, against 30.2% in English. Comparing all 26 counts found it in 98.6% and 99.1%, against 95.4%.

The test repeated the English one, 10,000 random messages per length, with books from the letter frequency page. German used Theodor Fontane's Effi Briest (Project Gutenberg eBook #5323) for the reference counts and Franz Kafka's Die Verwandlung (#22367) for the messages. French used Jules Verne's Vingt mille lieues sous les mers (#5097) and Gustave Flaubert's Madame Bovary (#14155). Accented letters were merged into A to Z, so ä counts as a, ß as ss and é as e, and every language has the same 25 shifts.

Share of 10,000 messages per length where each method found the key, in English, German and French. The E guess improves most in German and French.

In these books, E is a larger share of the letters: 15.6% in Effi Briest and 17.1% in Vingt mille lieues sous les mers, compared with 12.9% in Pride and Prejudice. The E guess works only when E is the most common letter of the message, or tied for it. At 100 letters it found the key 94.7% of the time in German and 90.4% in French, against 60.2% in English. These rates describe six books, each message under one fixed shift; other books will give somewhat different numbers.

Where did the Caesar shift turn up later?

ROT13 is a Caesar cipher with a shift of 13. Because 26 is exactly twice 13, the same operation both encodes and decodes. In the early 1980s, Usenet users ran jokes and spoilers through it. Shifting "Gb trg gb gur bgure fvqr!" by 13 places, for example, produces "To get to the other side!"

A shift of 13 on a 26-letter wheel: A sits over N and N over A, so the same step hides a message and reveals it again.

The method also sits inside more complex ciphers: the Vigenère cipher applies a Caesar shift to every letter but takes each letter's shift from a repeating keyword.

Frequently asked questions

What is the key in a Caesar cipher?

The key is the size of the shift, meaning how many places each letter moves. Julius Caesar's key was 3, so A became D. With 26 letters there are 25 useful keys, since a shift of 26 returns every letter to its starting place. Anyone who knows the method can test all 25 by hand, or use letter counts to go straight to the most likely one.

Is ROT13 the same as a Caesar cipher?

Yes. ROT13 is the Caesar cipher with a fixed shift of 13. Because the alphabet has 26 letters, two shifts of 13 bring every letter back to its starting place, so one operation both hides and reveals the text. Usenet users were using it in the early 1980s to hide joke punchlines and spoilers, not to protect secrets.

How short can a Caesar cipher message be and still be broken?

It depends on the method. In a 10,000-message test on English prose, comparing all 26 letter counts with normal English recovered the shift in 95% of 20-letter messages and in all 10,000 messages at each tested length from 50 letters up. Guessing that the most common letter is E worked only 30% of the time at 20 letters. Reading all 25 decryptions works on even shorter messages.

Counting stops working this easily once the shift can change from letter to letter, which is the idea behind the Vigenère cipher, the next page to decode.

Sources

1. 1

   Suetonius, The Life of Julius Caesar, section 56.6, trans. J. C. Rolfe (Loeb Classical Library, 1913; public domain), LacusCurtius, ed. Bill Thayer.

   https://penelope.uchicago.edu/Thayer/E/Roman/Texts/Suetonius/12Caesars/Julius*.html (section 56)

2. 2

   Suetonius, Divus Iulius 56 (Latin text), LacusCurtius.

   https://penelope.uchicago.edu/Thayer/L/Roman/Texts/Suetonius/12Caesars/Julius*.html (section 56)

3. 3

   Suetonius, The Life of Augustus, section 88, trans. J. C. Rolfe (Loeb Classical Library, 1913; public domain), LacusCurtius.

   https://penelope.uchicago.edu/Thayer/E/Roman/Texts/Suetonius/12Caesars/Augustus*.html (section 88)

4. 4

   Suetonius, Divus Augustus 88 (Latin text: "pro X autem duplex A"), LacusCurtius.

   https://penelope.uchicago.edu/Thayer/L/Roman/Texts/Suetonius/12Caesars/Augustus*.html (section 88)

5. 5

   Cicero, De natura deorum 2.93 (Latin text), Latin Wikisource.

   https://la.wikisource.org/wiki/De_natura_deorum/Liber_II (book 2, section 93)

6. 6

   Quintilian, Institutio Oratoria 1.4.7–9, trans. H. E. Butler (Loeb Classical Library, vol. I, 1920; public domain), LacusCurtius, ed. Bill Thayer.

   https://penelope.uchicago.edu/Thayer/E/Roman/Texts/Quintilian/Institutio_Oratoria/1B*.html (book 1, chapter 4, sections 7–9, with the translator's notes)

7. 7

   Austen, Jane. Pride and Prejudice. Project Gutenberg eBook #1342, https://www.gutenberg.org/ebooks/1342 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

   https://www.gutenberg.org/ebooks/1342 (full text)

8. 8

   Doyle, Arthur Conan. The Adventures of Sherlock Holmes. Project Gutenberg eBook #1661, https://www.gutenberg.org/ebooks/1661 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

   https://www.gutenberg.org/ebooks/1661 (full text)

9. 9

   Fontane, Theodor. Effi Briest. Project Gutenberg eBook #5323, https://www.gutenberg.org/ebooks/5323 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

   https://www.gutenberg.org/ebooks/5323 (full text)

10. 10

    Kafka, Franz. Die Verwandlung. Project Gutenberg eBook #22367, https://www.gutenberg.org/ebooks/22367 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

    https://www.gutenberg.org/ebooks/22367 (full text)

11. 11

    Verne, Jules. Vingt mille lieues sous les mers. Project Gutenberg eBook #5097, https://www.gutenberg.org/ebooks/5097 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

    https://www.gutenberg.org/ebooks/5097 (full text)

12. 12

    Flaubert, Gustave. Madame Bovary. Project Gutenberg eBook #14155, https://www.gutenberg.org/ebooks/14155 (text file retrieved via the gutenberg.pglaf.org mirror, 2026-10-16).

    https://www.gutenberg.org/ebooks/14155 (full text)

13. 13

    J. H. Allen and J. B. Greenough, New Latin Grammar, ed. J. B. Greenough, G. L. Kittredge, A. A. Howard and B. L. D'Ooge (Boston: Ginn, 1903), section 1, "The Alphabet"; online edition ed. Meagan Ayer, Dickinson College Commentaries, 2014.

    https://dcc.dickinson.edu/grammar/latin/alphabet (section 1 with its notes)

14. 14

    Peter Giles, "Y," Encyclopaedia Britannica, 11th ed., vol. 28 (Cambridge: Cambridge University Press, 1911); Wikisource transcription.

    https://en.wikisource.org/wiki/1911_Encyclop%C3%A6dia_Britannica/Y (full article)

15. 15

    Peter Giles, "Z," Encyclopaedia Britannica, 11th ed., vol. 28 (Cambridge: Cambridge University Press, 1911); Wikisource transcription.

    https://en.wikisource.org/wiki/1911_Encyclop%C3%A6dia_Britannica/Z (full article)

16. 16

    "Caesar, Gaius Julius," Encyclopaedia Britannica, 11th ed., vol. 4 (Cambridge: Cambridge University Press, 1911), section signed H. S. J.; Wikisource transcription.

    https://en.wikisource.org/wiki/1911_Encyclop%C3%A6dia_Britannica/Caesar,_Gaius_Julius (full article)

17. 17

    Peter Adamson, "al-Kindi," The Stanford Encyclopedia of Philosophy, first published 2006-12-01, substantive revision 2024-04-25.

    https://plato.stanford.edu/entries/al-kindi/ (section 1.1, "Life")

18. 18

    Eric S. Raymond, ed., "rot13," The Jargon File, version 4.4.7 (2003-12-29).

    http://www.catb.org/jargon/html/R/rot13.html (the rot13 entry)

19. 19

    Wikipedia, "Caesar cipher," revision 1380220657 of 2026-10-14.

    https://en.wikipedia.org/w/index.php?title=Caesar_cipher&oldid=1380220657 (full text)

20. 20

    Wikipedia, "Al-Kindi," revision 1374736876 of 2026-09-13.

    https://en.wikipedia.org/w/index.php?title=Al-Kindi&oldid=1374736876 (full text)

21. 21

    Wikipedia, "Frequency analysis," revision 1372785472 of 2026-09-02.

    https://en.wikipedia.org/w/index.php?title=Frequency_analysis&oldid=1372785472 (full text)

22. 22

    Wikipedia, "ROT13," revision 1378384130 of 2026-10-04.

    https://en.wikipedia.org/w/index.php?title=ROT13&oldid=1378384130 (full text)

Download the data: letter counts (CSV) · attack success rates (CSV) · worked example (CSV) · top letter in 100-letter stretches (CSV) · English, German and French rates (CSV)

Corrections

No corrections yet. Report an error through the corrections address in the page footer; every change is logged here as YYYY-MM-DD — what changed and why.

Decode next:

• Vigenère Cipher: the Caesar shift, set letter by letter by a repeating keyword, and what that does to the letter counts.
• Latin Alphabet: an alphabet that ended at X, then took in Y and Z, and much later W, J and U.

Cite this page