Substitution Cipher Solver: Crack Cryptograms Without the Key

How to use the substitution cipher solver

1. Paste the ciphertext. Paste the substitution cipher or cryptogram exactly as you have it. Letters, spaces and punctuation are all fine. Text written in groups of five letters also works.
2. Check the spacing option. Keep word breaks treats spaces as real gaps between words, which is how newspaper cryptograms and Codebusters Aristocrats are written. Ignore spaces is for ciphertext where the spaces were removed or replaced by five-letter groups, the Patristocrat style. The solver picks one from the look of the text; change it if it guessed wrong.
3. Choose the language. English is the default. Choose Spanish for Codebusters Xenocrypts.
4. Decide about self-mapping. No letter decrypts to itself is on by default, because puzzle-book cryptograms and every Codebusters cipher follow that rule. It rules out nearly two keys in three before the search even starts, which matters most on short texts. Turn it off only if you know the key may leave some letters unchanged, for example a key you shuffled yourself without that rule.
5. Press Solve. The search runs in your browser and shows its progress. On a laptop a cryptogram of 80 to 200 letters takes between a tenth and half a second; a phone is a few times slower. You can stop it at any time and keep the best answer found so far.
6. Read the answers. The substitution cipher decoder writes the plaintext letter by letter under the ciphertext, the way you would fill in a cryptogram on paper. The list next to it holds the best few candidates, each with a confidence label. Usually the first one is right; if it reads almost right, look at the second.

Fixing a nearly right answer: locking letters

On a short or unusual cryptogram the solver can get most of the key right and still swap a few rare letters, for instance J and Q, or K and V, which only appear once or twice. You can repair that yourself instead of starting over.

The key grid under the result shows every ciphertext letter and the plaintext letter the solver chose for it. Change any letter you know is wrong, and press the lock beside each letter you are sure of. Then choose Solve again with locked letters. The solver keeps every locked pair fixed and searches only the rest of the key. Two or three correct letters are often enough to steer it to the right answer on a ciphertext that was too short to solve alone.

Locking is also how you use a hint. If a puzzle tells you that ZIT means THE, lock Z→T, I→H and T→E before you solve.

Reading the keyword out of the key

Many cryptograms are not made with a random key but with a keyword alphabet, the method behind the keyword cipher and the K1, K2 and K3 alphabets in Codebusters. When the solver finishes, it lines the recovered key up both ways and looks for a run of letters at the start that is followed by the rest of the alphabet in order. If it finds one, it shows the alphabet type, the keyword and the shift.

This works even when part of the key is missing. A ciphertext seldom contains all 26 letters, so the solver shows unknown positions in the keyword as question marks, lists the letters that could fill them, and still reports the keyword if the visible part makes it clear. It does need the visible part to be right: if the solver has mixed up two rare letters, fix and lock them first, or the keyword will come out garbled. Codebusters Division C sometimes asks for the keyword instead of the plaintext, so this step can be the actual answer. The Aristocrat practice page explains the three alphabet types with examples.

How the substitution cipher solver works

A substitution cipher has 26! possible keys, far too many to try, so the solver searches instead.

It starts from a key guessed from letter frequencies: the most common ciphertext letter is paired with E, the next with T, and so on. Then it repeatedly swaps two letters of the key and decrypts again. Each attempt is scored by how much the result looks like the chosen language: the score adds up how common every run of four letters in the decryption is, using counts taken from 25 English and 10 Spanish public-domain books, more than ten million letters in all. A swap that raises the score is kept; one that lowers it is undone. When no swap helps any more, the solver starts again, sometimes from a fresh shuffle and sometimes from a small shake-up of the best key so far, and stops once many restarts in a row fail to beat its best answer.

With Keep word breaks on, whole words count too. Every decrypted word that appears in a list of the 12,000 most common English words (15,000 for Spanish) earns a bonus, so a key that turns one-letter words into A or I and short words into THE, AND, OF and TO beats one that only gets the letter groups right. With Ignore spaces on there are no words to check while searching, so the solver climbs on letter groups alone and then, as a last step, tries to split its best few answers into dictionary words. That final split is what lets it tell a correct Patristocrat from a near miss, and it is also why a Patristocrat needs more text than an Aristocrat.

The confidence label measures how far the best answer is ahead of the strongest rival that differs from it in at least three letters. A wide gap means no other reading comes close; a narrow one means two quite different keys explain the ciphertext almost equally well. The labels were calibrated on just over a thousand test solves:

• Likely: in testing, answers with this label were fully right about 9 times in 10 or more.
• Possible: right roughly half the time. Read the answer critically and compare it with the next candidate.
• Unlikely: right only 1 or 2 times in 10. The text may be too short, may not be a simple substitution cipher at all, or may be in a language the solver does not cover.

The label is a measured rate, not a guarantee. On very short texts and on languages other than English and Spanish, the label itself becomes unreliable.

How much ciphertext does the solver need?

These are measured results, not estimates. Passages were taken from 14 public-domain books that were kept out of the solver's training data, cut to each length, and encrypted with random keys in which no letter maps to itself. A solve counts as right when the top answer has at most two wrong letters, the same standard Codebusters uses for full marks.

Each English cell is 30 test passages and each Spanish cell is 20, so the percentages move by a few points between runs. The pattern is what matters. With word breaks, 80 letters, about two lines of a newspaper cryptogram, is almost always enough. Without word breaks the solver needs that much text to be reliable, and around 50 letters it gets fewer than half right; that is where locking a couple of known letters makes the biggest difference.

How to solve a substitution cipher by hand

Solving a substitution cipher with a pencil is a matter of making a small, safe guess and following where it leads. Here is a real cryptogram, a 92-letter quotation encrypted with a random key in which no letter maps to itself:

ZR ZD J RLCRT CQZBHLDJXXE
JWNQAUXHIOHI, RTJR J DZQOXH PJQ ZQ
GADDHDDZAQ AY J OAAI YALRCQH, PCDR
FH ZQ UJQR AY J UZYH.

Step 1: Count the letters, but do not trust the counts yet

In a long text, the top letter would almost certainly be E. Here seven letters are tied within one count of each other, so the counts only say that J, Q, Z, R, D, H and A are the common letters E, T, A, O, I, N and S in some order. That is typical of any substitution cipher below about 150 letters, and it is why word shapes matter more than frequencies for a short cryptogram.

Step 2: One-letter words

J stands alone four times. In English a one-letter word is A or I. Note both options and move on.

Step 3: Two-letter words that share a letter

ZR, ZD and ZQ all start with Z. Three different two-letter words that begin with the same letter suggest I: IT, IS, IN. If Z is I, then the lone J must be A.

Step 4: A word with a repeated letter

RTJR has the pattern ABCA: four letters, the first and last the same, and the third is J, which we think is A. THAT fits exactly. So R = T and T = H, which makes ZR = IT. That agrees with step 3, a good sign that both guesses were right.

Step 5: Use what you have

With I, T, A and H in place, ZD and ZQ become IS and IN, so D = S and Q = N. Now look at the long word GADDHDDZAQ. Its pattern is ABCCDCCEBF: the doubled letter DD appears twice, and we know D is S, Z is I and Q is N. The word reads ?-?-S-S-?-S-S-I-?-N, which can only be POSSESSION. That gives G = P, A = O and H = E.

Step 6: Fill in the short words

RLCRT is T?-?-T-H. With five letters and that shape, it is TRUTH, so L = R and C = U. AY is O?, and in front of a noun that is OF, so Y = F. OAAI is ?-O-O-?, a common word with OO in the middle: GOOD, so O = G and I = D.

Step 7: Read it

Fill those letters in everywhere and the rest falls quickly: UJQR is WANT, PCDR is MUST, FH is BE, UZYH is WIFE. The plaintext is the opening line of Jane Austen's Pride and Prejudice (1813):

IT IS A TRUTH UNIVERSALLY
ACKNOWLEDGED, THAT A SINGLE MAN IN
POSSESSION OF A GOOD FORTUNE, MUST
BE IN WANT OF A WIFE.

Paste the ciphertext above into the cryptogram solver and compare its answer with yours. Its key grid shows the same pairs you found by hand, along with the few letters, like V and K, that appear only once in the cryptogram.

When the substitution cipher decoder cannot crack it

The text is too short. Below about 50 letters, and especially without word breaks, several keys can each produce a believable sentence, and no method can tell which one the writer meant. Lock any letters you know and solve again, or treat the answer as a guess. Leaving No letter decrypts to itself on, when the puzzle follows that rule, also helps a great deal: the 31-letter example on the substitution cipher page is solved correctly with the rule on and turns into nonsense with it off.

It is not a simple substitution cipher. If the confidence stays at Unlikely on a long text, the cipher probably uses more than one alphabet. Check the letter counts: a substitution cipher keeps the uneven shape of the language, a few letters very common and many rare. If the counts are flat, try the Vigenère decoder, or let the cipher identifier suggest what you have.

The letters were not substituted but moved. If the counts look like normal English but the text is still unreadable, the letters may have been rearranged instead of replaced. Ciphers such as the rail fence or the scytale do that.

The language is different. The solver scores English and Spanish. A French or German substitution cipher will be scored as poor English and usually solved wrongly, even though the cipher itself is no harder.

It uses symbols instead of letters. Many puzzle cryptograms use numbers or pictures. Replace each different symbol with a different letter first, then paste the result into the cryptogram solver. The key will come out in terms of your stand-in letters, but the plaintext will be correct.

Cryptograms, Aristocrats and Patristocrats

These are all names for the same simple substitution cipher, set out in different ways. A newspaper cryptogram is usually a famous quotation with its author given in the same cipher. The American Cryptogram Association, and the Science Olympiad Codebusters event that borrows its terms, calls a cryptogram with word breaks an Aristocrat and one without word breaks a Patristocrat. A Xenocrypt is an Aristocrat whose plaintext is in a language other than English; in Codebusters that language is Spanish. This substitution cipher solver handles all four, and doubles as a cryptogram solver for newspaper puzzles, and the practice page generates new ones to solve against the clock.