Letter Frequency Analysis: How Frequency Stats Crack Substitution Ciphers

You intercept a short encrypted message: GUWC GSUQG. The key is unknown. Brute force on a 26-letter alphabet gives 26 keys — but with a short message, you cannot test each decryption by eye efficiently. Frequency analysis is the technique that makes the problem tractable: it uses the statistical fingerprint of English to guess which ciphertext letter maps to which plaintext letter.

The Character Frequency Analyzer computes this fingerprint for any text you paste in.

The English letter frequency fingerprint

In a large enough English text, the letter distribution is remarkably stable. E is the most common letter, appearing about 12.7% of the time. T is second at 9.1%. A, O, I, N, S, R, H, L round out the top ten. Z, Q, X, J appear less than 1% of the time.

E: ████████████████ 12.7%
T: ███████████ 9.1%
A: ████████ 8.2%
O: ███████ 7.5%
I: ███████ 7.0%
N: ██████ 6.7%
S: ██████ 6.3%
R: ██████ 6.0%
H: █████ 5.1%
L: ████ 4.0%

This distribution comes from English vocabulary structure: short common words use high-frequency letters, and the language evolved around sounds that are easy to produce and distinguish.

Applying frequency analysis to a Caesar cipher

A Caesar cipher shifts every letter by the same amount. G → D is a shift of -3 (or key 3). With the message GUWC GSUQG:

1. Count ciphertext frequencies. G appears 3 times. U, W, S, Q appear once each.
2. Map to English frequencies. G is the most common letter in the ciphertext, but E is the most common in English. So the most likely mapping is G = E.
3. Compute the shift. G (7th letter) → E (5th letter) is a shift of -2 (key 2).
4. Apply the key. G→E, U→S, W→U, C→A, S→Q (not a word), Q→O.

That gives ESUA EQOG — not English. Try the next hypothesis: G (most common) maps to T (second most common). Shift: G(7) → T(20) = +13. GUWC → THNJ — no.

Try G → A. G(7) → A(1) = -6. GUWC → AOMQ — no.

Try G → O. G(7) → O(15) = +8. GUWC → OCME. GSUQG → OAYKO. Not words.

The message is short enough that frequency alone is ambiguous. Word-level patterns help: GUWC is 4 letters, GSUQG is 5. In English, common 4-letter words include that, this, have, with. Common 5-letter words include there, which, their, about.

Test GUWC as that: G→T = +16, U→H = -16, inconsistent — not a Caesar cipher (Caesar is consistent shift). Test as have: G→H = +1, U→A = -20, no. Test as with: G→W = +19, inconsistent.

Given the pattern GUWC GSUQG, the repetition of GUW at the start and GSUG in the second word (with G in the same position) suggests the same 4-letter word starting with the same letter. A 4-letter word repeated with the last letter changed.

The solution: GUWC GSUQG decrypts with key 22 (or -4): CITY CODER. CITY (4 letters) and CODER (5 letters) share the C prefix. Frequency and word patterns together cracked it.

Beyond single letters: bigrams and trigrams

Single-letter frequency is a starting point. Bigrams (two-letter pairs) are more distinctive:

• Top English bigrams: TH, HE, IN, ER, AN, RE, ON
• Top trigrams: THE, AND, ING, ION, ENT

If the ciphertext bigram VX appears frequently, and TH is the most common English bigram, VX → TH is a strong hypothesis.

Word length and pattern matching

GUWC has pattern ABCA (first and last letters match, middle two are different). Any English word with the same pattern is a candidate. Words matching ABCA: deed, heel, keel, peer, meet, look, took, pass, bull, buzz. Combined with frequency and bigram data, this narrows the key further.

Using the Character Frequency Analyzer

Paste your ciphertext into the Character Frequency Analyzer and it shows:

• Per-character frequency (count and percentage)
• Per-word frequency
• Bigram frequencies
• Line and sentence statistics

Use the frequency map to build your substitution hypothesis, then apply it. The ROT13 Cipher tool can apply any single-shift Caesar cipher — enter the key and see the result instantly.

For longer texts, frequency analysis becomes increasingly reliable. For very short texts (under 50 characters), it is probabilistic — multiple keys may produce plausible decryptions, and contextual knowledge (the subject, expected vocabulary) is needed to choose the right one.

Real-world limits

Frequency analysis assumes the plaintext is natural language with typical English letter distributions. It fails against:

• Short messages with too few characters for the distribution to stabilize
• Transposition ciphers that preserve frequency (the letters are the same, just reordered)
• Polyalphabetic ciphers like Vigenere that use multiple shift values
• Encrypted binary data where any byte value is equally likely (no E-heavy distribution)

For modern cryptography, frequency analysis is a historical technique — AES and ChaCha20 are not vulnerable to it. For puzzles, CTFs, and understanding cipher design, it remains the foundational tool.

Try it with the Character Frequency Analyzer on any text — your own writing, a news article, a code file — and see how the frequency fingerprint changes across genres.