The Caesar Cipher and ROT13, Explained
After reading this you can encrypt and decrypt any Caesar shift by hand, understand why 25 keys means no security at all, and break an unknown shift in seconds using letter frequency.
What the Caesar cipher is
The Caesar cipher shifts every letter of the alphabet by a fixed number of places. Pick a shift of 3, and A becomes D, B becomes E, and Z wraps around to C. That is the whole method. Julius Caesar used a shift of 3 for his military correspondence, which is why the cipher carries his name.
Here is the hook. Encrypt ATTACK AT DAWN with a shift of 3 and you get DWWDFN DW GDZQ. Anyone who knows the shift reverses it by moving back 3 places. Anyone who does not know the shift has only 25 values to try, so they will read your message in well under a minute. The cipher hides text from a casual glance and nothing more.
ROT13 is the same cipher with a shift of 13. Because 13 is exactly half of 26, applying ROT13 twice returns the original text. That self-inverse property made it a convenient way to hide spoilers and punchlines on Usenet, where one function both scrambled and unscrambled.
When to use it and when not to
Use the Caesar cipher to learn how ciphers work, to solve puzzles and CTF challenges, to obscure a spoiler or an answer key from accidental reading, or to teach modular arithmetic with a concrete example. It is fast, reversible, and easy to check by hand.
Do not use it to protect anything of value. The key space is 25 non-trivial shifts (shift 0 leaves the text unchanged). A person testing every shift by hand manages several per minute; a computer tests all 25 in microseconds. There is no secret large enough to hide in 25 possibilities.
The Caesar cipher offers security by obscurity only. If an attacker knows you used a shift cipher, and that is the default assumption, the message is already broken. For real confidentiality use a modern authenticated cipher such as AES-GCM, standardized in NIST SP 800-38D.
The formula and the intuition
Number the letters A=0 through Z=25. Encryption with shift k adds k and wraps around using modulo 26.
Here x is the plaintext letter's number, k is the shift from 0 to 25, and E_k(x) is the ciphertext letter's number. The \bmod 26 is what makes Z wrap to A: after Z=25 a shift of 1 gives 26 \bmod 26 = 0, which is A.
Decryption reverses the addition by subtracting the same shift.
Here y is the ciphertext number and D_k(y) recovers the plaintext number. Subtracting k is the same as adding 26 - k, which is why encrypting with shift 3 and encrypting again with shift 23 returns the original. For ROT13, k = 13 and 26 - k = 13, so encryption and decryption are the identical operation.
A worked example with the demo data
Encrypting HELLO with shift 3
Take the default text HELLO and a shift of 3. Convert each letter to its number, add 3, reduce modulo 26, and convert back.
| Letter | x | x + 3 | mod 26 | Cipher |
|---|---|---|---|---|
| H | 7 | 10 | 10 | K |
| E | 4 | 7 | 7 | H |
| L | 11 | 14 | 14 | O |
| L | 11 | 14 | 14 | O |
| O | 14 | 17 | 17 | R |
His 7.7 + 3 = 10, and 10 isK.Eis 4.4 + 3 = 7, and 7 isH.- Both
Ls are 11.11 + 3 = 14, and 14 isO. Ois 14.14 + 3 = 17, and 17 isR.
The ciphertext is KHOOR. To decrypt, subtract 3: K=10 back to 7=H, and so on, recovering HELLO. Notice that no letter here wrapped past Z. Try XYZ with shift 3 to see the wrap: X=23 gives 26 \bmod 26 = 0 = A, so XYZ becomes ABC.
Breaking an unknown shift
Because there are only 25 shifts, the direct attack is to print all of them and read the one that makes sense. That is brute force, and it always wins here. The tool does this for you and then ranks the 25 candidates so the readable one rises to the top.
The ranking uses letter frequency. English text has a stable fingerprint: E appears about 12.7% of the time, T about 9.1%, A about 8.2%, while Z sits near 0.07%. A common score is chi-squared, which compares the observed letter counts in a candidate decryption against these expected frequencies.
Here O_i is how many times letter i occurs in the candidate, and E_i is how many times you expect it given the text length and English frequencies. The wrong shifts scramble the frequencies and produce large \chi^2 values; the correct shift lines up with English and produces the smallest one.
On very short texts, two or three letters, frequency ranking is unreliable because there is not enough data to match the expected percentages. For a 3-letter message just read all 25 outputs yourself. The ranking earns its keep on sentences and paragraphs.
Common mistakes
The errors below trip up almost everyone at first. None involves the math itself; they involve the edges.
- Confusing encrypt and decrypt shift
- Encrypting with shift 3 requires decrypting with shift 3 in the reverse direction, or equivalently encrypting with shift 23. If you decrypt with the wrong sign you get gibberish that is itself a valid Caesar shift of the plaintext, which is easy to mistake for a broken message.
- Forgetting the wrap
- Without \bmod 26,
Zshifted by 3 would run off the alphabet. Always reduce modulo 26 so 26 maps to 0, 27 to 1, and so on. - Shifting non-letters
- Digits, spaces, and punctuation are normally left unchanged. If your implementation shifts them too, the ciphertext leaks word boundaries or produces symbols, and it will not round-trip cleanly.
- Case handling
- Most tools preserve case, shifting
a-zandA-Zindependently. Decide on one convention and apply it consistently, or decryption will not match. - Treating ROT13 as encryption
- ROT13 has a fixed, publicly known shift. It is an obfuscation format, not a cipher with a secret. Anyone can reverse it instantly.
Related tools on this site
The Caesar cipher is the simplest member of a family. Once you understand it, these are the natural next steps:
- The Vigenère cipher uses a keyword to apply a different Caesar shift to each position, which defeats simple frequency analysis until you find the key length.
- Substitution, Atbash and Affine replace each letter by an arbitrary rule rather than a single rotation, giving a key space of 26! for a full substitution alphabet.
- The Morse code translator is not a cipher at all but an encoding, useful when you want to represent text in dots and dashes.
Frequently asked questions
How many possible Caesar keys are there?
There are 26 shifts from 0 to 25, but shift 0 leaves the text unchanged, so only 25 do anything. That is a tiny key space. A modern cipher like AES-128 has 2^{128} keys, roughly 3.4 \times 10^{38}, which is why brute force is hopeless against it and trivial against Caesar.
Is ROT13 secure?
No. ROT13 uses a fixed, published shift of 13 and provides zero secrecy. It scrambles text so you do not read it by accident, nothing more. Anyone who recognizes it reverses it by applying ROT13 again.
Why does the brute-forcer sometimes rank the wrong shift first?
The ranking scores each candidate by how closely its letter frequencies match English. On short inputs there are too few letters for the frequencies to settle, so a wrong shift can occasionally score lower by chance. Read the top few candidates rather than trusting only the first.
Can I chain two Caesar shifts for more security?
No. Two shifts of a and b combine into a single shift of (a + b) \bmod 26. The result is still one Caesar cipher with 25 possible keys, so stacking gains nothing.
What did Caesar actually use?
According to Suetonius, Caesar shifted each letter by 3 places. That specific choice is why a shift of 3 is often called "the Caesar shift," though the method works for any value.
Related tools
Enigma Machine Simulator
Operate a full Enigma I — rotors, plugboard, lamp board — and watch each letter travel the wiring.
Vigenère Cipher
Keyword polyalphabetic cipher, encode and decode.
Morse Code Translator
Text to Morse and back, with audio playback.
Substitution, Atbash & Affine
Monoalphabetic substitution ciphers with a custom key.
AES Encryption
Encrypt and decrypt text with AES-GCM or AES-CBC.
Cryptographic Key Generator
Random keys, IVs, salts and API tokens from a CSPRNG.