Caesar Cipher Decoder

What is a Caesar cipher?

A Caesar cipher replaces every letter with the letter a fixed number of places further along the alphabet, wrapping round from Z to A. That fixed number is the key, and the whole system is that one rule applied to every letter in the message.

With a shift of 3, A becomes D, B becomes E, and X becomes A again because the alphabet wraps. The word hello becomes khoor. Decoding is the same operation in reverse, which is why one tool does both and why the only thing you need to reverse a message is the number.

It is named after Julius Caesar, who is described by Suetonius as shifting letters by three in his private correspondence. It is the oldest substitution cipher that is still taught, and it is the ancestor of every method that replaces symbols rather than rearranging them.

How do you decode a Caesar cipher without the key?

Try all 25 possible shifts and read the one that turns into language. The alphabet has 26 letters, one shift leaves the text unchanged, and 25 candidates is a list a person can scan in seconds. That is why this cipher offers no real security.

The Show all 25 shifts button does exactly that. It prints every candidate and marks the one that scores highest against English letter frequencies, comparing how often each letter appears in the candidate with how often it appears in ordinary English text. That ranking is a hint rather than a verdict: on short messages, on names, and on anything that is not English, the marked row is often not the right one, and reading the list yourself is the reliable step.

The frequency method works because E, T, A, O, I and N together account for roughly half of all letters in English. A candidate where those letters are common is far more likely to be plaintext than one full of Q, X and Z.

What is the difference between a Caesar cipher and ROT13?

ROT13 is a Caesar cipher with the key fixed at 13, and that one choice changes how it is used. Because 13 is exactly half of 26, applying it twice returns the original text, so the same operation both encodes and decodes.

That symmetry is why ROT13 became the convention for hiding spoilers and punchlines on early internet forums: no key had to be exchanged and no second tool was needed. It was never intended as security, and it is not. If you specifically want the fixed 13 version, our ROT13 encoder does it in one step, and this page covers every other shift.

What happens to numbers, punctuation and spaces?

They pass through untouched, which is both convenient and the cipher's biggest weakness. Only the 26 Latin letters are shifted. Digits, punctuation, spaces and line breaks come out exactly as they went in.

That preserves the shape of the message, and shape is information. Word lengths survive, so a one-letter word in English is almost certainly A or I. Apostrophes survive, so a pattern like x'y is probably a contraction. Sentence punctuation survives, so the message structure is visible before a single letter is decoded. A cipher that leaks this much structure is a puzzle rather than a protection.

Capitalisation is handled by the option above. Keeping it preserves the original case, which is the usual choice; turning it off returns everything in capitals, which is how classical ciphertext is traditionally written and what most puzzle sets expect.

Is a Caesar cipher secure?

No, and it has not been for over a thousand years. Two attacks break it completely and neither requires a computer. Brute force tries all 25 keys. Frequency analysis counts letters and matches the distribution against the language, which is exactly what the button above does.

Arab scholars described frequency analysis in the ninth century, which means this cipher has been readable by anyone who knows the method for most of its history. Nothing you encode here should be anything you need kept private: not a password, not a key, not personal data. Treat the output as obscured, never as encrypted.

What it is genuinely good for is teaching, puzzles, escape rooms, geocaching clues, capture-the-flag challenges and hiding a spoiler from a casual glance. In each of those the point is that the reader can solve it.

How do you solve a Caesar cipher by hand?

Four steps, and the first two solve most short puzzles without touching the rest.

1. Look for one-letter words. In English they are A or I, so the shift is the distance between the ciphertext letter and one of those two. Two candidates, and one usually reads as language immediately.
2. Look for the commonest letter. In a message of any length it is probably E. Measure the distance from it back to E and test that shift.
3. Test the guess on one word. Apply the shift to a single short word rather than the whole message. If it produces language, apply it to everything.
4. If neither works, walk the alphabet. Write the first word out at all 25 shifts. It is faster than it sounds and it never fails.

The button above automates steps two and four, and the reason to know the manual method anyway is that it tells you when the automated answer is wrong.

Why does the suggested shift sometimes look wrong?

Because frequency scoring needs enough letters to be meaningful, and three cases break it. The tool marks a most likely row rather than announcing an answer for exactly this reason.

• Short messages. Under about twenty letters, the letter distribution is noise and the highest score is close to random.
• Names and codes. A message that is mostly proper nouns, abbreviations or a licence plate does not follow English frequencies at all.
• Another language. The scoring uses English frequencies. French, German, Spanish and Italian have different distributions, so the marked row will often be wrong even when the plaintext is perfectly readable further down the list.

In all three, the full list is still there and the right answer is in it. Read the 25 rows and take the one that is a sentence.

Where do Caesar ciphers still turn up?

Five places account for nearly all current use, and none of them is security. Each one wants a slightly different thing from a decoder, which is why this page has both a fixed-key mode and a brute-force mode.

• Classroom exercises. It is the first cipher taught in almost every introduction to cryptography, because the whole system fits in one sentence and can be worked by hand.
• Capture-the-flag challenges. Early rounds routinely hide a flag behind a shift, and the expected solution is exactly the brute-force list above.
• Escape rooms and puzzle hunts. A shifted clue is solvable by a group with no equipment, which is the design requirement.
• Geocaching. Cache hints are conventionally published under ROT13 so that a hint can sit in plain sight without being read by accident.
• Spoiler and answer hiding. The same convention on forums and in puzzle answers, for the same reason.

In every one of those, the reader is meant to get through. That is the correct use of a cipher with 25 keys, and it is worth separating from anything that needs to stay private.

A worked example, step by step

One short message, encoded and then broken without the key, shows the whole system in about a minute. Take the plaintext MEET ME AT NOON and a shift of 3.

Encoding moves each letter three places forward. M becomes P, E becomes H, T becomes W, and the wrap only matters near the end of the alphabet. The result is PHHW PH DW QRRQ. The spaces did not move, so the word lengths are still 4, 2, 2 and 4.

Now break it without knowing the key. The two-letter words PH and DW are the fastest way in: in English they are very likely to be common two-letter words such as ME, AT, IT, IS, ON or TO. The repeated letters in QRRQ give a second grip, since a four-letter word with a doubled middle pair is a small set: NOON, DEED, BOOK, LOOK and a handful more. Testing the shift that turns Q into N gives 3, and applying 3 backwards to the whole message returns the plaintext.

That is the cipher's real security level. Two structural clues, no computer, under a minute, and the message is open.

How do you build a cipher wheel?

Two concentric circles with the alphabet written round each edge, pinned so the inner one turns, is the physical form of this cipher and still the best way to teach it. Rotating the inner ring by three positions sets the key to 3, and every letter can then be read straight off.

The wheel makes two properties obvious that the algebra hides. Encoding and decoding are the same wheel read in opposite directions, which is why one setting serves both. And the alphabet is a loop rather than a line, which is what the wrap from Z to A means, and why a shift of 26 does nothing at all.

It is also why a shift of 13 is special. Half of 26 puts each letter exactly opposite its partner, so the wheel looks the same from either side, which is the whole of ROT13 in one physical fact.

What comes after the Caesar cipher?

Every classical cipher that followed exists to fix one of its two weaknesses: the tiny key space and the leaked letter frequencies. Knowing which weakness each one addresses is the clearest way to see the family.

The Atbash cipher reverses the alphabet, mapping A to Z and B to Y, which is a fixed substitution with no key at all. The simple substitution cipher maps every letter to an arbitrary other letter, expanding the key space enormously while leaving frequency analysis just as effective. The Vigenere cipher uses a keyword so that the shift changes from letter to letter, which flattens the frequency distribution and is why it resisted casual attack for three centuries. Modern encryption abandoned letter substitution entirely and works on blocks of bits with keys no one can enumerate.

For encoding that is meant to be read back rather than kept secret, our Base64 encoder and ROT13 encoder cover the two most common cases.