How to Solve a Substitution Cipher

A substitution cipher replaces each letter of the alphabet with a different letter, number or symbol, and keeps that replacement consistent through the whole message. Every A becomes the same thing, every time. That consistency is what conceals the text, and it is also the flaw that opens it.

What is a substitution cipher?

One alphabet swapped for another, letter by letter, with the order of the letters left alone. Nothing is moved. Nothing is added. Only the identities change.

That makes it the largest family in classical cryptography, and most of the ciphers you have met are members of it. A Caesar cipher is a substitution where the replacement alphabet is the ordinary one, shifted. Atbash is a substitution where it is the ordinary one, reversed. Pigpen is a substitution where the replacements are grid fragments instead of letters. A1Z26 swaps letters for their positions.

The general case is harder than any of those, because the replacement alphabet is arbitrary. There is no shift to find and no mirror to spot. A can become Q, B can become F, and the only rule is that the mapping never changes mid-message.

That arbitrariness is why a substitution cipher has 403 septillion possible keys and why none of that matters. You will never search them. You will read the message instead.

Why can you break it without the key?

Because English is not random, and the cipher does not touch what makes it predictable.

A substitution cipher hides which letter is which. It does not hide how often each one appears, how long the words are, where the doubles fall, or which letters cluster together. All of that survives the swap intact, and all of it is a fingerprint.

The technique that reads the fingerprint is frequency analysis, and it is roughly eleven hundred years old. Al-Kindi, writing in the ninth century, wrote the first surviving description of it: count the symbols in the enciphered text, compare the counts to what the language normally does, and the commonest symbol is probably the commonest letter. Every solver since has used some version of that idea.

How do you solve a substitution cipher?

Five steps. The first three do most of the work, and the last two finish it.

1. Count every symbol. In English, E leads by a wide margin, then T, A, O, I, N. If one symbol appears far more than the rest, start by calling it E and see what happens.
2. Solve the one-letter words, if there are any. There are two in English, A and I. Short messages often have none, in which case skip straight to the short words.
3. Attack the short words. THE is the commonest three-letter word by a distance. Two letter words come from a small set: OF, TO, IN, IT, IS, AS, AT, ON, BE, BY, OR.
4. Use the doubles. LL, EE, SS, OO and TT are the common doubled letters. A doubled symbol at the end of a word is often LL or SS. In the middle, EE and OO.
5. Read forward, not sideways. Once four or five letters are placed, stop counting and start reading. Partial words suggest their own endings, and each guess you confirm gives you two or three more letters free.

The discipline that matters most is undoing. A wrong guess produces impossible letter runs two or three words later. When that happens, do not push on. Go back to the guess that caused it.

A worked example

Here is a short message in a substitution cipher.

In the panels below, letters shown faint are still ciphered. Solved letters are shown in full.

Count first, and accept a tie. D and V appear five times each. Q appears three times. Nothing else appears more than twice. Two symbols tied at the top is the normal situation in a short message, and it tells you something useful: E and T are the two commonest letters in English, so these are probably E and T in some order. You do not yet know which is which.

Look for the shape of THE. DCV is three letters, it contains both of the frequent symbols, and it ends in one of them. THE is the commonest three-letter word in English and it ends in E. Try D as T, C as H, V as E.

That one guess placed three letters, and it also broke the tie for us: D was T, V was E.

Use the doubles. QEET has a doubled E in the middle and a T at the end. QJOO has a doubled O at the end of the word, and a double at the end of a word is usually LL or SS. Take QJOO first: with an unknown start, a vowel, then a double, MILL and FULL and WALL all fit the shape. Hold it.

Use the repeat, and make a mistake. ZT appears twice, two letters, ending in T. The two-letter words ending in T are AT and IT. Nothing so far distinguishes them, so pick one. Call it IT.

Now read forward. QEET has a doubled E and a T at the end: MEET, so Q is M. QJOO is M, unknown, double L at the end of a word. MILL fits, which makes J an I and O an L.

And there is the contradiction. J is I, but Z is also I, and one plain letter cannot have two cipher symbols in a substitution cipher. That is the rule the whole system rests on, and it has just caught a bad guess three letters after it was made.

Go back to the guess, not to the letters that followed it. ZT was AT or IT, and IT is now impossible. So Z is A.

One word left. TES still carries a ciphered letter at the end: S has appeared once and nothing has placed it yet. The word follows AT and closes the message, so it is almost certainly a time or a place. TEN fits, and nothing else does.

What the detour teaches. The wrong guess at ZT cost four words and was caught by a rule, not by a feeling. That is the difference between a cheap mistake and an expensive one: the collision appeared as soon as the guess touched a second letter. Place a letter, use it immediately, and a bad guess announces itself before you have built anything on it.

How hard is a substitution cipher, really?

Harder than Caesar, easier than it looks, and almost entirely a matter of length.

A one-sentence cryptogram is genuinely tight, and the worked example above shows why: no single commonest letter, no one-letter words, and a solve that runs on word shapes instead of statistics. There may be no doubled letters at all, the frequency counts are too small to be reliable, and you are working from word shapes more than statistics. Those are solved by pattern recognition, not arithmetic.

A paragraph is much easier. By a hundred words the frequency counts start behaving, THE appears several times, and two or three footholds open the rest at once.

The rule of thumb solvers use: under twenty words, hunt for patterns. Over fifty, count first. The American Cryptogram Association has been publishing both lengths since 1930, and its members will tell you the short ones are the cruel ones.

Is a substitution cipher secure?

No, and it has not been for eleven centuries.

Any cipher that maps one letter to one symbol, consistently, falls to frequency analysis. The key space is irrelevant. The message betrays itself through its own statistics, and Al-Kindi worked out how to read them before the year 900.

The fix, when it finally came, was to stop using one alphabet. A cipher that changes its substitution as it goes flattens the frequencies and removes the fingerprint entirely. That idea took until the sixteenth century and produced the Vigenere cipher, which held for three hundred years.

For the full solving method, with a cryptogram taken from first symbol to final word, our guide covers the footholds in order.