Caesar cipher and ROT13

What is a Caesar cipher?

It replaces every letter with the one a fixed number of places further along the alphabet. Shift by three and A becomes D, B becomes E, and Z wraps around to C. Decrypting is the same operation in reverse. It is named for Julius Caesar, who is reported to have used it for military correspondence, and it is the first cipher most people meet.

ROT13 is the same thing with a shift of thirteen. It is used on forums and puzzle sites to hide a spoiler or a punchline in plain sight — not to protect anything, just to stop your eye reading it by accident.

This tool does all three things: encrypt with a shift you choose, decrypt with a shift you know, and break a message when you do not know the shift at all. Everything runs in your browser.

How to use the Caesar cipher tool

1. Pick what you want to do. Encrypt, decrypt, or break it. Breaking needs no shift — that is the whole point of the third button.
2. Type or paste your text. Letters shift; digits, punctuation and spacing pass through untouched. Accented letters are left alone too, because the cipher is defined on the twenty-six letter alphabet and quietly turning é into e would change your text rather than encipher it.
3. Read the result, or the ranked list. In breaking mode the panel shows all twenty-six candidate shifts, scored and sorted, with the best at the top. If the answer is right it is usually obvious at a glance.

Breaking it takes thirty letters

The usual thing said about the Caesar cipher is that frequency analysis breaks it. That is true and it is missing the interesting part, which is the quantity. So we measured it.

The attack works like this. Try all twenty-six shifts. For each candidate, count how often each letter appears and compare that against how often it appears in ordinary English, using a chi-squared score. The candidate that fits best is almost always the message. There is no cleverness in it, and no searching: twenty-six candidates is not a search space, it is a list that fits on one screen.

The letter frequencies this tool scores against were measured rather than quoted — 5,329,782 letters across twelve public-domain books. They come out in the order everyone half-remembers: e at 12.85%, then t at 9.45%, a at 7.84%, o at 7.52%, n at 7.03% and i at 7.02%. Getting that familiar order back out is the check that the corpus was ordinary prose and not something odd.

Then the sweep. Taking random passages, enciphering each with a random shift and asking the attack to recover it: at 15 letters it is right 90% of the time, and at 30 letters 99%. Thirty letters is shorter than this sentence. Any message long enough to be worth sending is long enough to break, which is a more useful way to put it than “only twenty-six keys”.

The result that decided the interface was the cross-language one. Every figure above was produced with the English frequency table, and we ran the same sweep over Spanish, Portuguese and French ciphertext without changing it. They all fall too, just needing more text: 90% accuracy at around 60 letters for Spanish and 40 for Portuguese and French. So this tool has no language picker, and that is a measured decision rather than a shortcut — the distributions of Latin-script European languages are similar enough that one table does the job. (The English figures come from whole books while the other three come from this site's own translated pages, which are smaller, so treat the non-English numbers as indicative.)

Honest limitations

This is not encryption and nothing here should be used to protect anything. That is not a caveat about this implementation, it is what the cipher is: a key with twenty-six possibilities, which the tool on this page will exhaust in the time it takes to render a table. Use it for puzzles, for teaching, for hiding a spoiler — never for a secret.

The breaking mode needs enough text. Under about thirty letters the top answer is a guess, and the tool says so rather than presenting a confident wrong shift. Very short messages genuinely cannot be broken this way, which is the one situation where a Caesar cipher holds up — and it holds up because there is not enough information in the message, not because the cipher is doing anything.

Scoring folds accents so that á counts as a, which is what lets one English table score four languages. The cipher itself never folds anything: your ñ comes back as ñ. Those are deliberately different behaviours and it is worth knowing which is which.

Only the twenty-six Latin letters shift. Cyrillic, Greek, Arabic and everything else passes through unchanged, so a Caesar cipher on Arabic text simply is not a thing this tool does. Word lengths and punctuation also survive intact, which is a large part of why the cipher leaks so much — even before counting letters, the shape of the sentence is already visible.

The engine carries 58 assertions. The one worth naming enumerates all twenty-five non-zero shifts and confirms that exactly one of them is its own inverse, which is ROT13 — a fact usually asserted and here checked. Another pins the chi-squared calculation against a hand computation, after a deliberate sabotage that replaced it with a cruder distance passed every other test in the file. That sabotage surviving was itself informative: the attack does not depend on a clever statistic, it works with a fairly blunt one too.

Why is it free?

Shifting letters and counting them is arithmetic your own machine does instantly. Nothing is uploaded, there is no account, and there is nothing to watermark.

If you want to encode rather than encipher, the Base64 and URL encoder pages on this site handle that, also without uploading anything.