How to Solve a Substitution Cipher (Frequency Analysis)

To solve a simple substitution cipher without the key, use frequency analysis: count how often each letter appears, match the most common ciphertext letters to the most common English letters (E, T, A, O, I, N…), then lock in the rest using short words like THE, single-letter words, and doubled letters — checking your guesses by reading the partial text. Count the letters fast with the frequency analysis tool, and test a recovered key in the substitution cipher tool. This works on a monoalphabetic substitution (one fixed letter-for-letter map); it does not work on Vigenère, which deliberately flattens the frequencies.

TL;DR

• Count first: tally every ciphertext letter — the shape of the counts is the whole game.
• Match ETAOIN: the most common ciphertext letter is almost always plaintext E, then T, A, O, I, N.
• Use structure: single-letter words are A or I; the runaway three-letter word is almost always THE; doubled letters are usually LL, EE, SS, or OO.
• Iterate and read: fill partial words, guess, and confirm — a guess is right only if the text becomes readable.
• Limits: needs enough text; fails on Vigenère (flat frequencies) and on very short messages.

Why Frequency Analysis Works

Letters are not used equally in English. Across ordinary text, some letters appear far more often than others, and a monoalphabetic substitution — where each plaintext letter is always replaced by the same ciphertext letter — preserves that shape. It only relabels the letters. So if plaintext E is the most common letter, whatever it was replaced with becomes the most common letter in the ciphertext. Count the ciphertext, and the frequency ranking hands you a first guess for the whole alphabet.

The commonly cited order of English letter frequencies — sometimes remembered as ETAOIN SHRDLU — is roughly:

These are approximate and depend on the text, but the top of the list is stable enough to anchor a solve. E is reliably first, and T is usually second.

The Step-by-Step Method

1. Count the letters. Tally every letter in the ciphertext. Paste the text into the frequency analysis tool to get the counts instantly instead of tallying by hand.
2. Map the top letters to ETAOIN. Assume the most frequent ciphertext letter is E, the next is likely T, and so on. Treat these as pencilled-in guesses, not facts.
3. Crack the single-letter words. A one-letter word in English is almost always A or I. That gives you two more letters cheaply.
4. Find "THE". The most common three-letter word by a wide margin is THE. The runaway three-letter block in the ciphertext usually reveals T, H, and E in one move — and E should agree with your frequency guess.
5. Spot doubled letters. Repeated adjacent letters are usually LL, EE, SS, OO, or TT. A doubled ciphertext letter you have already mapped to E confirms EE; an unmapped one is a strong OO/LL candidate.
6. Guess whole words and iterate. With a handful of letters fixed, short and common words start to show through (_HE, AN_, _ITH). Fill them in, propagate the new letters everywhere, and keep reading. Confirm by rebuilding the key and decoding in the substitution cipher tool.

A Worked Example (Solved From Real Counts)

Here is an intercepted message enciphered with an unknown simple substitution:

ZIT GSR SOWKQKN ATHZ OZL KQKTLZ WGGAL WTIOFR Q SGEATR GQA RGGK. TCTKN TCTFOFU ZIT ATTHTK EGXFZTR ZITD, FGZTR ZIT VTQZITK, QFR ZITF ZXKFTR ZIT ITQCN OKGF ATN ZVOET WTYGKT STQCOFU ZIT LOSTFZ KTQROFU KGGD ZG ZIT LIQRGVL.

It is 176 letters, all A–Z, no key given. Running the frequency count gives:

Now the deductions:

• Frequency: T is the most common letter at 18.2%, so guess T = e. Z is second, matching English T, so pencil in Z = t.
• "THE": the three-letter word ZIT appears six times — the runaway most common word. That is almost certainly the, giving Z = t, I = h, T = e. Notice E and T agree with the frequency guess — a good sign we are on track.
• Single-letter word: the lone Q standing as its own word must be a or i; it turns out to be Q = a.
• Doubled letters: WGGAL has a doubled GG. With common doubled pairs in mind and G ranking third (near English O), guess GG = oo, making WGGAL → b?ooks = books (W = b, A = k, L = s). And ATTHTK has TT = ee (we already know T = e): with A = k it reads keeper, adding H = p, K = r — and K ranked fourth, matching English R.

Propagating those letters, the opening resolves to "The old library kept its rarest books behind a locked oak door…" and the rest falls out by reading. Rebuild the map, drop it into the substitution cipher tool, and decoding confirms the full plaintext. The whole break came from three moves: the top frequency, the word the, and one doubled letter.

Beginners think breaking a cipher is about clever math. In practice it is bookkeeping: count the letters, find the word "the", and follow the consequences honestly until the sentence reads back.

When It Won't Work

• Too little text. Frequency analysis needs a decent sample; on a handful of words the counts are noise. A single short phrase may not be breakable this way.
• Vigenère and other polyalphabetic ciphers. These use several shifting alphabets, which flatten the frequency distribution so no letter dominates. A flat count on letters-only text is the tell that you are not looking at a simple substitution — see how to identify an unknown cipher.
• Unusual text. Heavy proper nouns, non-English text, or deliberate avoidance of common letters skews the counts. Treat ETAOIN as a starting hypothesis, not a rule.

The tools split the work honestly: the frequency analysis tool counts what is actually there, and the substitution cipher tool lets you apply and test a key you recover. Neither guesses the message for you — the reasoning above is the part you do.

FAQ

What is frequency analysis?

It is counting how often each letter appears in a ciphertext and matching those counts to the known letter frequencies of the language. Because a simple substitution keeps the frequency shape, the most common ciphertext letter usually maps to the most common plaintext letter (E in English).

What are the most common letters in English?

Roughly E, T, A, O, I, N, then S, H, R — often remembered as ETAOIN SHRDLU. E is about 12.7% and reliably the most common; T is usually second. The exact numbers vary by text, but the top of the order is stable enough to start a solve.

Does frequency analysis break a Vigenère cipher?

Not directly. Vigenère uses a keyword and several alphabets, which flattens the single-letter frequencies so no letter stands out. You first find the key length (for example with the Kasiski method) and then apply frequency analysis to each slice. On a flat frequency profile, suspect a polyalphabetic cipher rather than a simple substitution.

How much ciphertext do I need?

More is better. A short sentence can be guessable from structure alone, but reliable frequency analysis wants at least a paragraph so the counts settle toward their true shape. With very little text, lean harder on word patterns like THE and single-letter words.

What is the most common three-letter word?

THE, by a wide margin. Spotting the runaway three-letter block in a ciphertext and reading it as "the" usually reveals three letters at once — and the E should agree with your frequency count.

Ready to try it? Count the letters with the frequency analysis tool, test your recovered key in the substitution cipher tool, and if the text is a simple shift or mirror instead, confirm with the Caesar or Atbash tool. Not sure what you are looking at? Start with how to identify an unknown cipher, or browse the full tools list.