Decoder, brute force and ROT13
Caesar cipher decoder
Encode and decode the Caesar cipher with any shift. At shift three, Caesar's own, ATTACK AT DAWNbecomes DWWDFN DW GDZQ. If you do not know the key, the brute force below tries all 25 shifts and puts the most likely reading first.
How to use it
Type the text in the left box. The encoded version appears on the right with the shift shown in the field below the boxes, which starts at three, the shift Caesar used.
To decode, paste the message into the right box and adjust the shift until the text on the left makes sense. If you do not know the shift, paste the message into the brute-force box further down: it tries all 25 and puts the most likely reading first.
Spaces, digits and punctuation pass through unchanged; only letters move. Accented letters are treated as their base letter, so nothing is left out.
The rule and the history
The cipher carries Julius Caesar's name because Suetonius, in his life of the general, reports that Caesar wrote letters replacing each letter with the third one after it in the alphabet. It is the simplest substitution cipher there is: one rule, one number, and the alphabet treated as a circle. With a shift of one, ABC XYZ becomes BCD YZA, and the wrap at the end is visible: Z moves to A.
The decoder takes the reverse path, moving the same number of places back, so thatDWWDFN DW GDZQ becomes ATTACK AT DAWN again. Accented letters are folded to their base letter before the swap, so a French or Portuguese text keeps every letter: café encoded isFDIH, the same as FDIH. Digits, spaces and punctuation pass through untouched, as in the original cipher, so no character is dropped; what the cipher does not keep is the case, since it writes its output in capitals, as the cipher has been written since antiquity.
ROT13 is the same mechanism with a shift of thirteen. Since thirteen is half of 26, encoding twice undoes the cipher, and that made it the standard way to hide a spoiler on a forum: a reader applies it once, with no key to know. Secret in ROT13 is FRPERG.
Table
The 26 swaps of shift three, the shift the table below is printed at. At another shift the pairs are these ones moved along: at four, every letter of the right-hand column steps on by one.
| Letter | Becomes |
|---|---|
| A | D |
| B | E |
| C | F |
| D | G |
| E | H |
| F | I |
| G | J |
| H | K |
| I | L |
| J | M |
| K | N |
| L | O |
| M | P |
| N | Q |
| O | R |
| P | S |
| Q | T |
| R | U |
| S | V |
| T | W |
| U | X |
| V | Y |
| W | Z |
| X | A |
| Y | B |
| Z | C |
Brute force: all 25 shifts
Paste any message into the box and it is decoded with each of the 25 shifts and sorted by how much the result resembles English. It starts with KYV DVVKZEX ZJ GFJKGFEVU LEKZC EVOK NVVB, encoded with shift seventeen, which sits at the top, because the letter distribution of the result is that of real text. The list shows why the cipher protects nothing: the whole job fits on one screen.
25 shifts, most English-like first. On a short text the order is a guess.
- 17
THE MEETING IS POSTPONED UNTIL NEXT WEEK - 18
SGD LDDSHMF HR ONRSONMDC TMSHK MDWS VDDJ - 3
HVS ASSHWBU WG DCGHDCBSR IBHWZ BSLH KSSY - 25
LZW EWWLAFY AK HGKLHGFWV MFLAD FWPL OWWC - 8
CQN VNNCRWP RB YXBCYXWNM DWCRU WNGC FNNT - 4
GUR ZRRGVAT VF CBFGCBARQ HAGVY ARKG JRRX - 23
NBY GYYNCHA CM JIMNJIHYX OHNCF HYRN QYYE - 19
RFC KCCRGLE GQ NMQRNMLCB SLRGJ LCVR UCCI - 10
AOL TLLAPUN PZ WVZAWVULK BUAPS ULEA DLLR - 2
IWT BTTIXCV XH EDHIEDCTS JCIXA CTMI LTTZ - 6
ESP XPPETYR TD AZDEAZYPO FYETW YPIE HPPV - 15
VJG OGGVKPI KU RQUVRQPGF WPVKN PGZV YGGM - 16
UIF NFFUJOH JT QPTUQPOFE VOUJM OFYU XFFL - 21
PDA IAAPEJC EO LKOPLKJAZ QJPEH JATP SAAG - 9
BPM UMMBQVO QA XWABXWVML CVBQT VMFB EMMS - 7
DRO WOODSXQ SC ZYCDZYXON EXDSV XOHD GOOU - 13
XLI QIIXMRK MW TSWXTSRIH YRXMP RIBX AIIO - 1
JXU CUUJYDW YI FEIJFEDUT KDJYB DUNJ MUUA - 14
WKH PHHWLQJ LV SRVWSRQHG XQWLO QHAW ZHHN - 20
QEB JBBQFKD FP MLPQMLKBA RKQFI KBUQ TBBH - 24
MAX FXXMBGZ BL IHLMIHGXW NGMBE GXQM PXXD - 12
YMJ RJJYNSL NX UTXYUTSJI ZSYNQ SJCY BJJP - 11
ZNK SKKZOTM OY VUYZVUTKJ ATZOR TKDZ CKKQ - 22
OCZ HZZODIB DN KJNOKJIZY PIODG IZSO RZZF - 5
FTQ YQQFUZS UE BAEFBAZQP GZFUX ZQJF IQQW
The measure is the comparison of each letter's frequency in the result with its typical frequency in English text, the same principle Al-Kindi described in the ninth century for breaking substitution ciphers. On very short messages, with few letters to count, the order can be wrong, and that is why the decoder shows a ranked list, never only the first line.
Frequently asked
How does the Caesar cipher work?
Each letter is replaced by the letter a fixed number of places further along the alphabet, and the alphabet wraps around at the end. With a shift of three, A becomes D, B becomes E and Z becomes C. ATTACK AT DAWN becomes DWWDFN DW GDZQ. To decode, move the same number of places back.
What is ROT13?
The Caesar cipher with a shift of thirteen. Because the alphabet has 26 letters, applying it twice gives the original back: SECRET becomes FRPERG, and FRPERG becomes SECRET. That is why it was used on forums to hide spoilers and punchlines, with no pretence of security.
How many shifts are there?
Twenty-five useful ones, because a shift of 26 returns the text itself: SAME shifted by 26 is still SAME. That is why brute force fits in one list: try each of the 25 and read which one makes sense.
Is the Caesar cipher secure?
No, and it never was against anyone who knew the method. With only 25 keys, anyone can try them all in minutes, by hand. The letter frequencies survive too: the commonest letter of the ciphertext is the commonest letter of the language, shifted, which gives the key away in one pass. It is for learning, for play, and for understanding why modern ciphers use enormous keys.
How does the brute force pick the right answer?
It decodes the message with each of the 25 shifts and compares the letter frequencies of each result with the typical frequencies of English. The closest match goes to the top. On short messages it can be wrong, so the list stays visible with the shift beside each line.