Frequency Analysis

How frequency analysis works

A monoalphabetic substitution cipher replaces each letter with a fixed substitute. Because the mapping never changes, the frequency distribution of letters is preserved. In English text, E appears roughly 12.7% of the time, followed by T, A, O, I, N, S, H, R, … If the most common cipher letter is X, it almost certainly represents E.

The tool auto-fills the mapping by ranking cipher letters by frequency and assigning them to English letters in frequency order. This first pass is usually 60 to 80% correct. Refine the remaining letters using context clues (short words, double letters, common patterns like “TH”, “THE”, “ING”).

Challenges solved with this tool: picoCTF 2022 - substitution0, substitution1, substitution2.

The standard English letter frequency order (most to least common) is approximately: E T A O I N S H R D L C U M W F G Y P B V K J X Q Z. This order is known as the ETAOIN SHRDLU mnemonic. Because CTF plaintexts are usually English paragraphs or flag descriptions, this ordering gives a reliable starting point for the initial mapping, even on relatively short ciphertexts.

After applying the auto-mapping, look for short words to confirm or fix assignments. Single-letter words are almost always A or I. Two-letter words are frequently OF, TO, or IN. Three-letter words often include THE - look for the most common trigram in the ciphertext, as it is almost certainly THE. Double letters are usually LL, EE, or SS.

One common pitfall: if the ciphertext is short (under ~200 characters), the frequency distribution may not align closely with the theoretical English order. In those cases, rely more heavily on pattern matching - word shapes and digram/trigram analysis - rather than raw frequency rank. The interactive mapping lets you override any auto-assigned letter manually to test hypotheses quickly.