Solving an unknown cipher

Puzzles, escape rooms and capture-the-flag challenges often hand you a block of scrambled letters and nothing else. This guide takes one through four tools, from “what is this?” to the plain text. Everything runs in your browser.

The ciphertext used throughout:

Lb ykw gzh jgcx bx wqoow, vl ziu dlr orzud ss llugc, mg oda vri nyh wh gmfvru, kd ank wpg kkr gi nqypvkkvgcw, vl ziu dlr wswer ss thtkoj, vl ziu dlr wswer ss aqktohhdlba.

1. Ask what it is

Paste it into Identify. If the text were Base64, hex, Morse or another encoding rather than a cipher, this is where you’d find out. Here the answer is Polyalphabetic cipher (Vigenère or similar), because the index of coincidence is 0.043.

The index of coincidence is the chance that two letters picked at random are the same. English (and any cipher that only swaps or moves its letters) scores about 0.067. A cipher that uses several alphabets in turn, such as Vigenère, flattens the letters out towards 0.038, the score of random letters.

A Caesar shift or ROT13 is solved on the spot: Identify shows the plain text and links to Caesar / ROT13 with the shift set.

2. Look at the letters

Paste the text into Frequency Analysis and count Letters. In English, E, T, A and O lead the list. In a single substitution (one alphabet), some other letter leads instead, but the shape of the bars is the same: a few very common letters and a long tail. Here the bars are much flatter, which agrees with Identify: no single letter stands for E all the way through.

3. Crack it

Paste it into the Cipher Cracker. It tries every Caesar shift and Affine key, Rail Fence with 2 to 10 rails, and Vigenère and Beaufort with the likeliest key lengths, then ranks the results by how English they look. The top result is Vigenère, key DICKENS:

It was the best of times, it was the worst of times, it was the age of wisdom, it was the age of foolishness…

4. When the cracker can’t

Some ciphers need a key or a guess: a keyword substitution, Playfair, columnar transposition, ADFGVX. Once you have a likely keyword (from the puzzle’s theme, or a word that appears elsewhere), try it in Classical Ciphers, set to Decrypt. For the text above, choose Vigenère with the keyword DICKENS.

If Identify says the letters have English frequencies but the words aren’t English, the letters are probably in the wrong order rather than swapped: try Rail fence and Columnar there.