# Caesar cipher: why only 25 keys means anyone can crack it

> The Caesar cipher shifts every letter by a fixed number. With a shift of 3, HELLO becomes KHOOR. It is fun and historic, but there are only 25 useful shifts, so a computer (or a patient person) can try them all in seconds. Here is how it works and why it fails.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/caesar-cipher-why-only-25-keys-means-anyone-can-crack-it
Related free tool: [Caesar Cipher & ROT13](https://toolcloak.pages.dev/tools/caesar-cipher)

Julius Caesar is said to have used a simple trick to hide military messages: shift every letter a few places along the alphabet. The method is easy to learn and a good first step into cryptography. It is also easy to break, and seeing why teaches the key idea behind every secure system.

> **In short**
> - A Caesar cipher **shifts each letter by a fixed number**. Shift 3: A→D, B→E, **HELLO→KHOOR**.
> - There are only **25 useful shifts**, so trying them all (brute force) is instant.
> - A general substitution cipher has about **4.03 × 10²⁶** keys, but it still falls to **letter-frequency analysis**.
> - None of these is secure. Use it for puzzles, not for secrets.

## How it works

Write the alphabet twice, one row shifted. To encrypt, find each letter in the top row and replace it with the letter below it. To decrypt, go back the same number of places. The shift amount is the key.

| Plain | H | E | L | L | O |
| --- | --- | --- | --- | --- | --- |
| Shift 3 | K | H | O | O | R |
| Shift 13 (ROT13) | U | R | Y | Y | B |

*Shift 13 is special: applying it twice returns the original, because 13 + 13 = 26 letters.*

> **Encrypt: (letter + key) mod 26     Decrypt: (letter − key) mod 26:** Number the letters A=0 to Z=25. “mod 26” means wrap around after Z. H is 7, add 3 gives 10, which is K.

Try it: [Caesar Cipher & ROT13](https://toolcloak.pages.dev/tools/caesar-cipher). Type a message and a shift to encode or decode it.

## Why it is so weak

A shift of 0 does nothing and a shift of 26 returns to the start, so only shifts 1 to 25 change the text. An attacker does not need to guess the key. They try all 25 and read the one that makes sense.

**The whole key space: 25 useful shifts**

| Group | Count |
| --- | --- |
| Shifts to try | 25 |

**Breaking a Caesar cipher by brute force**

1. **Take the ciphertext.** For example KHOOR.
2. **Try shift 1 to 25.** Decode with each one. It takes seconds by hand and microseconds by computer.
3. **Read the results.** Only one will be a real word. Shift 3 gives HELLO.

## A bigger key space still is not enough

What if each letter could be swapped for any other, not just by a fixed shift? That is a general substitution cipher, with 26! (26 factorial) possible keys, about 4.03 × 10²⁶. Brute force is hopeless. But the cipher still leaks, because the language does.

**How often each letter appears in typical English text (%)**

|  | Value |
| --- | --- |
| E | 12.7% |
| T | 9.1% |
| A | 8.2% |
| O | 7.5% |
| I | 7% |
| N | 6.7% |
| S | 6.3% |

*These are approximate averages for English. In a long ciphertext, the most common symbol is likely E, the next T, and so on. That is enough to start cracking the cipher.*

Count the letters in the ciphertext and match the most common to E, T and A. Then use common words like THE and AND to refine. A few paragraphs of text usually give it away. This is frequency analysis, known for over a thousand years.

## What modern encryption does differently

**Caesar versus modern encryption**

| Caesar cipher | Modern ciphers like AES-256 |
| --- | --- |
| 25 keys | 2²⁵⁶ keys |
| Same shift for every letter | Scrambles bits, not letters |
| Pattern of the language shows through | Output looks random |
| Cracked by hand in minutes | Brute force is infeasible |

*AES-256 has about 1.2 × 10⁷⁷ keys. And the security does not rest on keeping the method secret, only the key.*

## Where the Caesar cipher is still used

- **Puzzles and escape rooms.** Easy to make and to solve.
- **ROT13 on forums.** Used to hide spoilers so you must choose to read them. It is not security.
- **Teaching.** It shows keys, encryption and brute force in one small example.
- **Obfuscation.** It sometimes hides text from a casual look. Do not use it for passwords. See [password entropy](https://toolcloak.pages.dev/articles/password-entropy-bits-guesses-and-why-length-beats-symbols) for what real strength looks like.

> **Never protect real secrets with it:** Base64, ROT13 and Caesar are encodings and toys, not encryption. [Base64 is not encryption](https://toolcloak.pages.dev/articles/base64-is-not-encryption-and-it-makes-files-a-third-bigger) explains the same mistake with another format.

## A quick challenge

Decode WKLV LV IXQ with a shift of 3. Go back three letters for each: W→T, K→H, L→I, V→S. The message is THIS IS FUN. Try the tool above with your own message and share the shift with a friend.

## Frequently asked questions

### How does the Caesar cipher work?

Each letter is replaced by the letter a fixed number of places further along the alphabet, wrapping around after Z.

### How many keys does a Caesar cipher have?

25 useful shifts (1 to 25). Shift 0 and 26 leave the text unchanged.

### How do you break a Caesar cipher?

Try all 25 shifts and read the one that gives real words, or use letter frequency to guess the shift.

### What is ROT13?

A Caesar cipher with a shift of 13. Applying it twice returns the original text.

### Is the Caesar cipher secure?

No. It is easy to crack and should only be used for fun or learning.