Tools / Frequency Analysis
Frequency Analysis
Paste ciphertext to see a letter-frequency chart and an auto-generated substitution mapping based on English frequency order. Correct any wrong guesses by editing the mapping cells - the decoded output updates instantly.
Letter Frequency
Rank order matches English: E T A O I N S H R D L C U M W F G Y P B V K J X Q Z
Substitution Mapping(auto-filled by frequency rank - override any cell)
Amber cells are manual overrides. Clear an override cell to restore the auto-guess.
Decoded Output
Whekuescp asadpini ni ose ow tre odleit asl foit hednayde tecrsnkuei woh yheavnsm cdaiincad cngrehi. Exehp dasmuame rai a crahactehnitnc lnithnyutnos ow dettehi. Ns Esmdnir, tre detteh E aggeahi foit owtes, woddobel yp T, A, O, asl N. Yp coustnsm rob owtes eacr detteh aggeahi ns tre cngrehtejt asl cofgahnsm trat to tre ejgectel Esmdnir lnithnyutnos, pou cas fave elucatel mueiiei ayout tre iuyitntutnos. Insmde detteh bohli fuit ye A oh N. Tre foit coffos trhee detteh bohl ns Esmdnir ni TRE. Doov woh hegeatel gattehsi asl bohv outbahl whof rnmr whekuescp dettehi to lecole tre feiiame asl wnsl tre rnlles wdam.
How frequency analysis works
A monoalphabetic substitution cipher replaces each letter with a fixed substitute. Because the mapping never changes, the frequency distribution of letters is preserved. In English text, E appears roughly 12.7% of the time, followed by T, A, O, I, N, S, H, R, … If the most common cipher letter is X, it almost certainly represents E.
The tool auto-fills the mapping by ranking cipher letters by frequency and assigning them to English letters in frequency order. This first pass is usually 60 to 80% correct. Refine the remaining letters using context clues (short words, double letters, common patterns like “TH”, “THE”, “ING”).
Challenges solved with this tool: picoCTF 2022 - substitution0, substitution1, substitution2.
The standard English letter frequency order (most to least common) is approximately: E T A O I N S H R D L C U M W F G Y P B V K J X Q Z. This order is known as the ETAOIN SHRDLU mnemonic. Because CTF plaintexts are usually English paragraphs or flag descriptions, this ordering gives a reliable starting point for the initial mapping, even on relatively short ciphertexts.
After applying the auto-mapping, look for short words to confirm or fix assignments. Single-letter words are almost always A or I. Two-letter words are frequently OF, TO, or IN. Three-letter words often include THE - look for the most common trigram in the ciphertext, as it is almost certainly THE. Double letters are usually LL, EE, or SS.
One common pitfall: if the ciphertext is short (under ~200 characters), the frequency distribution may not align closely with the theoretical English order. In those cases, rely more heavily on pattern matching - word shapes and digram/trigram analysis - rather than raw frequency rank. The interactive mapping lets you override any auto-assigned letter manually to test hypotheses quickly.