Chris Spackman's NeoCities Page

Substitution Cipher

A substitution cipher replaces each letter in the message with a different letter. Instead of shifting the whole alphabet by a fixed amount (like the Caesar cipher), each letter maps to its own unique replacement. Think of it as scrambling the entire alphabet — A might become Q, B might become M, C might become Z, and so on.

The Scrambled Alphabet Analogy

Imagine writing the normal alphabet on one strip of paper and a completely shuffled alphabet on another. Line them up, and you have your key. To encrypt, find each letter on the top strip and replace it with the letter below it. To decrypt, do the reverse — find the letter on the bottom strip and read the one above it.

A Huge Key Space

Because any of the 26 letters can map to any unused letter, the total number of possible keys is 26! (26 factorial) = 403,291,461,126,605,635,584,000,000. That is roughly 4 × 10²⁶. Unlike the Caesar cipher's 26 keys, this key space is far too large for a brute-force attack. So why can it still be broken? Read on.

Try It

Result

Letter-by-Letter

Frequency Analysis

The chart below compares how often each letter appears in the ciphertext (red bars) with how often letters normally appear in English (green bars). With longer messages, the pattern of the ciphertext bars starts to match the English bars — just shifted to different letters.

How It Works

The key is a permutation of the alphabet — a rearrangement where each letter appears exactly once. For example:

• Plain: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
• Cipher: Q W E R T Y U I O P A S D F G H J K L Z X C V B N M

To encrypt the word "HELLO":

• H → I
• E → T
• L → S
• L → S
• O → G

So "HELLO" becomes "ITSSG". To decrypt, reverse the lookup: find each ciphertext letter in the cipher row and read the plaintext letter above it.

Why It Can Be Broken

Even though brute force is impossible, the substitution cipher has a fatal weakness: frequency analysis. In English, certain letters appear far more often than others — E is the most common (about 12.7%), followed by T (9.1%), A (8.2%), and so on. Because a substitution cipher is monoalphabetic — each plaintext letter always maps to the same ciphertext letter — these frequency patterns survive the encryption.

An attacker can count how often each letter appears in the ciphertext, then match the most frequent ciphertext letters to the most frequent English letters. Common two-letter and three-letter combinations (like "TH", "THE", "AND") provide additional clues. With a reasonably long message, the cipher can be broken without ever trying a single key.

Things to Try

• Encrypt a long paragraph and look at the frequency chart. Which ciphertext letter has the tallest bar? Check the key — does it map from E?
• Encrypt "AAAA". What do you notice about the output? What does this tell you about the cipher?
• Encrypt a short message (3–5 words) and a long one (a full paragraph). Compare the frequency charts. Which one looks more like the English distribution, and why?