The Caesar cipher

The Caesar cipher hides a message by moving every letter a fixed number of places along the alphabet. With a shift of 3, A becomes D, B becomes E, and VENI VIDI VICI becomes YHQL YLGL YLFL. Julius Caesar used it two thousand years ago, and it's been a toy ever since. There are only 25 possible shifts, so anyone can try them all in a minute.

Try it

Nothing you type here leaves your browser.

Change the shift and the result follows. To decrypt, choose Decrypt with the same shift, or enter the negative of it. If you've got a ciphertext and don't know the shift, the Caesar cipher decoder tries all 26 and ranks them.

How the shift works

Number the letters A = 0 to Z = 25. Encrypting adds the shift and wraps around past Z, which is arithmetic modulo 26. Decrypting subtracts it.

That wheel is the cipher's physical form too: two rings, one turned against the other. People made cipher disks like it for centuries, and once you know your shift you can do the whole thing in your head.

Try VENI VIDI VICI with a shift of 3. V is 21, plus 3 is 24, which is Y. E is 4, plus 3 is 7, which is H. N is 13, plus 3 is 16, which is Q. I is 8, plus 3 is 11, which is L. Repeat for the rest and you get YHQL YLGL YLFL. Words, spaces and punctuation usually stay as they are, which hands an attacker the word lengths for free.

Where it comes from

The Roman historian Suetonius, writing about a century and a half after Caesar's death, says that when Caesar had something private to write he put it in cipher, "that is, by so changing the order of the letters of the alphabet, that not a word could be made out". To read it, you substitute "the fourth letter of the alphabet, namely D, for A" (Deified Julius 56.6). The same shift of three appears in Cassius Dio's history, and Aulus Gellius mentions that Caesar's letters to his friends Oppius and Balbus held letters that didn't form words. Those three authors, all of the second century AD, are the surviving descriptions. Suetonius adds that Augustus did the same thing with a shift of one, writing B for A, with a quirk at the end of the alphabet: he used AA for X, because he didn't wrap round.

The alphabet Caesar used was shorter than ours. Latin in his day had about 23 letters, with no J, no W and no separate U (V did both jobs), so a Roman shift wrapped round sooner than ours does. The sums on this page use the 26 letters of the modern alphabet, as every tool here does.

Caesar picked his shift of three in a world where very few people could read at all. The cipher holds up against someone who doesn't know it exists, and against nobody else.

Breaking it

There are three ways, from crudest to best.

1. Try every shift. The key is a single number from 1 to 25. Write the ciphertext out 25 times and read down the page, and one of them is English. A computer does it in a few microseconds, and a patient person manages it too.
2. Use the most common letter. In English, E makes up about 12.7% of text, followed by T (9.1%) and A (8.2%). A Caesar cipher moves every letter by the same amount, so the most frequent letter in the ciphertext is probably E in disguise, and its distance from E gives the shift. That method is frequency analysis, first written down by the Arab scholar al-Kindi in the ninth century.
3. Score every candidate. Rather than trust one letter, compare the letter counts of each of the 26 candidate decryptions with English using a chi-squared test: sum, over the letters, of (observed − expected)² / expected. The shift with the lowest total fits English best.

Here's the third method on a short message, computed by scripts/examples/classical-batch1.mjs. The ciphertext is Xppe xp le esp zwo dezyp mctorp le xtoytrse lyo mctyr esp wpeepcd, 53 letters. The four best candidates:

The median of all 26 scores is 539.6 and the worst is 2,557.9, so the right answer isn't close: 24.1 against 182.1 for the runner-up. Even 53 letters are plenty. Below about 20 letters the statistics wobble, and a human reading the 25 candidates is the better judge. The decoder shows you both.

The code

// Shift every letter by `shift` places (negative to decrypt). Case is kept; anything that is not a letter is left alone.
function caesar(text, shift) {
  return text.replace(/[a-z]/gi, function (ch) {
    var base = ch <= 'Z' ? 65 : 97;                       // 'A' or 'a'
    var n = (ch.charCodeAt(0) - base + shift) % 26;
    return String.fromCharCode((n + 26) % 26 + base);     // the second % keeps negative shifts in range
  });
}

That's the cipher the tool above runs, apart from input checking. The second % is the one people forget, because in JavaScript -3 % 26 is -3, not 23.

Descendants

Nearly everything in classical cryptography is a Caesar cipher with a twist.

• Fix the shift at 13 and you have ROT13, which undoes itself.
• Multiply the letter number as well as add to it and you get the affine cipher.
• Swap the single shift for a short repeating keyword of shifts and you have the Vigenère cipher. It stood for three centuries because breaking it means finding the key length first.
• Allow any rearrangement of the alphabet, not just a rotation, and you reach the simple substitution cipher. It has 26! keys, which looks safe and falls to the same letter counting.
• A repeating shift as long as the message, used once, with a truly random key, is the one-time pad, the only cipher proven secure against an attacker with unlimited computing power.

Caesar's method lives on in the modern lock cipher.ink builds from the same ingredients: add a secret to a message, and undo it with the same secret. The difference is size. A 256-bit key has about 10⁷⁷ possibilities against Caesar's 25, and a computer can't count that high in the lifetime of the universe (AES-GCM, explained).