Tools / Frequency Analysis
Frequency Analysis
Paste ciphertext to see a letter-frequency chart and an auto-generated substitution mapping based on English frequency order. Correct any wrong guesses by editing the mapping cells - the decoded output updates instantly.
Letter Frequency
Rank order matches English: E T A O I N S H R D L C U M W F G Y P B V K J X Q Z
Index of Coincidence
0.0670Close to English prose (~0.066). A monoalphabetic substitution is a good fit, so the mapping below should apply.
Substitution Mapping(auto-filled by frequency rank - override or lock any cell)
Amber cells are manual overrides; emerald cells are locked. Locked letters are kept when you auto-fill by frequency, and the remaining cells are guessed from the letters you have not used yet. Clear an unlocked override cell to restore the auto-guess.
Decoded Output
Whekuescp asadpini ni ose ow tre odleit asl foit hednayde tecrsnkuei woh yheavnsm cdaiincad cngrehi. Exehp dasmuame rai a crahactehnitnc lnithnyutnos ow dettehi. Ns Esmdnir, tre detteh E aggeahi foit owtes, woddobel yp T, A, O, asl N. Yp coustnsm rob owtes eacr detteh aggeahi ns tre cngrehtejt asl cofgahnsm trat to tre ejgectel Esmdnir lnithnyutnos, pou cas fave elucatel mueiiei ayout tre iuyitntutnos. Insmde detteh bohli fuit ye A oh N. Tre foit coffos trhee detteh bohl ns Esmdnir ni TRE. Doov woh hegeatel gattehsi asl bohv outbahl whof rnmr whekuescp dettehi to lecole tre feiiame asl wnsl tre rnlles wdam.
How frequency analysis works
A monoalphabetic substitution cipher replaces each letter with a fixed substitute. Because the mapping never changes, the frequency distribution of letters is preserved. In English text, E appears roughly 12.7% of the time, followed by T, A, O, I, N, S, H, R, … If the most common cipher letter is X, it almost certainly represents E.
The tool auto-fills the mapping by ranking cipher letters by frequency and assigning them to English letters in frequency order. This first pass is usually 60 to 80% correct. Refine the remaining letters using context clues (short words, double letters, common patterns like “TH”, “THE”, “ING”).
Challenges solved with this tool: picoCTF 2022 - substitution0, substitution1, substitution2.
The standard English letter frequency order (most to least common) is approximately: E T A O I N S H R D L C U M W F G Y P B V K J X Q Z. This order is known as the ETAOIN SHRDLU mnemonic. Because CTF plaintexts are usually English paragraphs or flag descriptions, this ordering gives a reliable starting point for the initial mapping, even on relatively short ciphertexts.
After applying the auto-mapping, look for short words to confirm or fix assignments. Single-letter words are almost always A or I. Two-letter words are frequently OF, TO, or IN. Three-letter words often include THE - look for the most common trigram in the ciphertext, as it is almost certainly THE. Double letters are usually LL, EE, or SS.
One common pitfall: if the ciphertext is short (under ~200 characters), the frequency distribution may not align closely with the theoretical English order. In those cases, rely more heavily on pattern matching - word shapes and digram/trigram analysis - rather than raw frequency rank. The interactive mapping lets you override any auto-assigned letter manually to test hypotheses quickly.
Challenges that use this tool
Tools that pair with this one
- Cipher Identifier & Auto-DecoderPaste any ciphertext and the tool auto-runs every common decoder (base64, hex, Morse, ROT, Atbash, Bacon, binary, decimal, URL) and ranks the results by English-likeness.
- Vigenère CipherEncrypt or decrypt text with the Vigenère polyalphabetic substitution cipher using a keyword.
- ROT / Caesar CipherDecode Caesar-shifted and ROT-encoded text. Drag the shift slider or scan all 26 rotations at once.
- Affine CipherEncrypt, decrypt, or brute-force affine ciphers using E(x) = (ax + b) mod 26. Brute force ranks all 312 key pairs by English letter frequency.
Or browse all 40 CTF tools.