Free cipher decoder and substitution cipher solver. Auto-solve cryptograms, plus frequency, bigram and word-pattern analysis. Runs in your browser.
This substitution cipher solver decodes monoalphabetic ciphers — the classic cryptogram, where every letter of the alphabet is consistently replaced by a different one. Paste the ciphertext and the auto-solver attempts a full break on its own; where the text is short or unusual, four analysis views let you finish the job by hand: an interactive letter-mapping editor, frequency analysis against English norms, bigram and trigram counts, and a word-pattern finder that matches the shape of ciphertext words to real English words.
It works in both directions. Use the encode mode with a 26-letter key to produce a cipher for a puzzle, a class exercise or a CTF challenge; use the decrypt assistant to attack one you have been handed. Everything runs client-side in your browser, and the ciphertext can be captured in a shareable permalink so a teammate opens the same puzzle you are looking at.
The key is a permutation of the alphabet. If the key begins QWERTYUIOP..., then every plaintext A becomes Q, every B becomes W, every C becomes E, and so on for all 26 letters. Encryption and decryption are simple table lookups; spacing, punctuation and capitalisation are normally preserved.
The keyspace looks enormous: 26 factorial is 403,291,461,126,605,635,584,000,000 — roughly 4 × 1026 possible keys, far beyond brute force. Yet substitution ciphers fall quickly to a laptop, because the cipher leaks structure it cannot hide. A substitution cipher preserves:
ABA can be did, eye, pop — but never the.TH, HE, IN, ER and THE, AND, ING keep their relative dominance under any key.Cryptanalysis exploits exactly these leaks, and this is why the cipher is unsuitable for real security while remaining a superb teaching tool for how statistical attacks work.
The auto-solve button runs a hill-climbing search scored by a quadgram fitness model — a table of how likely each four-letter sequence is in English. The solver starts from a frequency-seeded key, repeatedly swaps pairs of letters, and keeps a swap whenever the decoded text scores higher. It performs 18 independent random restarts to escape local optima, abandoning a restart after 1,200 consecutive swaps produce no improvement. The model is built into the tool, so no data is fetched and nothing you paste leaves the page.
Quadgram scoring is dramatically stronger than single-letter frequency because it rewards readable English rather than merely the right letter counts. It also explains the tool’s main limitation: it needs text to be statistical about. Above roughly 150–200 letters an auto-solve is usually clean on the first attempt; below about 60 letters, expect a partial solution you finish manually.
The frequency tab counts every ciphertext letter and lines the ranking up against English expectations:
| Letter | English frequency | Letter | English frequency |
|---|---|---|---|
| E | 12.7% | N | 6.7% |
| T | 9.1% | S | 6.3% |
| A | 8.2% | H | 6.1% |
| O | 7.5% | R | 6.0% |
| I | 7.0% | D | 4.3% |
Rank-matching alone rarely finishes a puzzle — sample noise scrambles the middle of the table — but the top three and the bottom (J, Q, X, Z) are usually reliable, and each confirmed pair constrains everything else.
The tool counts two- and three-letter sequences in the ciphertext. Because TH is by a wide margin the most common English bigram and THE the most common trigram, the leading ciphertext trigram is a strong candidate for THE — and cracking it hands you three letters at once, including E and T, the two highest-frequency letters in the language.
Every word has a structural signature independent of the key. HELLO is ABCCD; THERE is ABCDC; PEOPLE is ABCADB. The pattern finder computes the signature of each ciphertext word and lists English words with the same shape, drawn from a dictionary of common words. Rare signatures are enormously powerful: a five-letter word whose second and fourth letters repeat narrows the candidates to a handful, and one confirmed word typically cascades into five or six letters of the key.
Take the ciphertext QBT LSDYF RMJVI OJW ESHKN JUTM QBT GCZX PJA. Four moves solve it:
QBT appears twice and is the most common three-letter word in the text, with no repeated letters. Try THE: Q→T, B→H, T→E.JUTM now reads ? ? E ?. A four-letter word with E in third position and all letters distinct has few common candidates; OVER fits and uses high-frequency letters. That gives J→O, U→V, M→R.RMJVI now reads ? R O ? ?. BROWN fits the shape, so R→B, V→W, I→N. And OJW reads ? O ? — FOX resolves it.LSDYF becomes QUICK, ESHKN becomes JUMPS, GCZX becomes LAZY, PJA becomes DOG. Every word resolves, so the key is right.This is exactly the loop the tool automates: hypothesise a word, propagate its letters through the whole text, check whether what remains still looks like English, and back the guess out if it does not.
The Caesar cipher is a special case of substitution where the key is a rotation of the alphabet rather than an arbitrary permutation — only 25 keys, so a dedicated brute-force tool is faster. ROT13 is the shift-13 case. Atbash reverses the alphabet and can be entered here as the key ZYXWVUTSRQPONMLKJIHGFEDCBA.
Polyalphabetic ciphers are a different problem: the Vigenère cipher uses a repeating keyword so one plaintext letter maps to several ciphertext letters, which flattens the frequency distribution and defeats the techniques here. If you do not know what you are looking at, start with the cipher identifier, which classifies a ciphertext by its statistical signature before you commit to a method.
An encryption method in which each plaintext letter is replaced by a fixed substitute letter throughout the message. In a monoalphabetic substitution cipher, one substitution alphabet is used for the entire text — A always becomes the same letter — which is what makes frequency analysis effective against it.
Yes. That is what the auto-solver does: it searches for the key using a quadgram statistical model of English rather than requiring you to supply one. Longer ciphertexts solve more reliably, and the result is loaded into an editable mapping so you can correct any letters it gets wrong.
Around 150–200 letters is comfortable for a fully automatic solve. Between about 60 and 150 letters, expect most of the key to come out correctly with a few letters to fix by hand. Below roughly 60 letters there is not enough statistical signal, and the pattern and frequency tabs become the primary tools.
Usually one of four reasons: the text is too short; it is not English (the quadgram model is English-only); it is not actually a simple substitution cipher — a Vigenère or transposition cipher will not yield; or the plaintext is unusual, such as a word list or heavy jargon, whose statistics do not resemble prose. Re-running helps, since each attempt uses fresh random restarts.
A Caesar cipher is a substitution cipher whose key is restricted to a uniform shift of the alphabet, giving only 25 usable keys. A general substitution cipher allows any of the 26! possible alphabet permutations, so it cannot be brute-forced — it has to be broken statistically.
Yes. Only letters are substituted; spaces, digits and punctuation pass through unchanged, which is why word-pattern matching works. Ciphertext written as unbroken blocks of five letters can still be solved by auto-solve and frequency analysis, just without pattern matching.
No. Despite a keyspace of roughly 4 × 1026, a substitution cipher over a paragraph of English is routinely broken in seconds because it preserves the statistical structure of the plaintext. It is a puzzle and teaching cipher, not a security control.
No. Encoding, decoding, the frequency and pattern analysis and the hill-climbing solver all run in your browser. Text is only ever transmitted if you choose to copy the permalink and send it yourself.
Yes — newspaper cryptograms are exactly this cipher. Type the puzzle in with its spacing intact, run auto-solve, and use the pattern finder on any short words that remain unresolved.
Not sure which cipher you have? Use the Cipher Identifier to auto-detect cipher types from unknown ciphertext using frequency analysis and Index of Coincidence.
A substitution cipher is a method of encryption where each letter (or symbol) in the plaintext is replaced by another letter (or symbol) according to a fixed mapping. Unlike the Caesar cipher, which shifts all letters by the same amount, a general substitution cipher uses an arbitrary permutation of the alphabet — the key is the entire mapping table itself.
Substitution ciphers represent an important step in the evolution of cryptography. With 26! (approximately 4 x 10^26) possible keys, a substitution cipher cannot be broken by brute force alone. However, it remains vulnerable to frequency analysis, a technique known since the 9th century. Understanding substitution ciphers teaches fundamental concepts about keyspace, patterns, and why modern encryption requires far more sophisticated approaches.
In a simple monoalphabetic substitution cipher, each plaintext letter maps to exactly one ciphertext letter:
| Plaintext | A | B | C | D | E | F | G | H | ... | Z |
|---|---|---|---|---|---|---|---|---|---|---|
| Ciphertext | Q | W | E | R | T | Y | U | I | ... | M |
Using this key, "HELLO" encrypts to "ITSSG" — each H becomes I, each L becomes S, and so on. The recipient uses the inverse mapping to decrypt.
| Type | Description | Key Size | Example |
|---|---|---|---|
| Monoalphabetic | Each letter maps to one other letter | 26! permutations | QWERTY keyboard mapping |
| Polyalphabetic | Multiple substitution alphabets used in rotation | Varies | Vigenere cipher |
| Polygraphic | Groups of letters substituted together | Varies | Playfair, Hill cipher |
| Homophonic | Each letter can map to multiple symbols | Large | Great Cipher of Louis XIV |
Despite the enormous keyspace, monoalphabetic substitution ciphers are broken by frequency analysis:
A skilled cryptanalyst can break a monoalphabetic substitution cipher from a few hundred characters of ciphertext using only pen, paper, and frequency tables.
A monoalphabetic substitution cipher replaces each letter with another letter consistently throughout the message. Unlike Caesar cipher which shifts all letters by the same amount, a substitution cipher can use any mapping (A→Q, B→X, C→M, etc.). This creates 26! possible keys.
Start with frequency analysis - E, T, A, O, I, N are the most common English letters. Look for single-letter words (A, I) and common short words (THE, AND, FOR). Identify common patterns like double letters (LL, SS, EE) and word endings (-ING, -TION, -ED). Build up the solution gradually.
Bigrams are two-letter combinations (like TH, HE, IN), while trigrams are three-letter combinations (like THE, AND, ING). In English, TH is the most common bigram and THE is the most common trigram. Analyzing these patterns helps identify letter mappings.
Words have unique patterns based on repeated letters. For example, THAT has pattern ABAB, and PEOPLE has pattern ABCADB. By matching ciphertext word patterns against dictionary words, you can identify potential plaintext words and their letter mappings.