Substitution Ciphers

A monoalphabetic substitution cipher replaces each letter with a different fixed letter. Unlike Caesar, the mapping is arbitrary (not a simple shift), making brute force impossible - but frequency analysis works.

Overview

26! possible keys - brute force is impossible. But letter frequencies in English are stable, making substitution ciphers vulnerable to statistical attacks.

Key characteristics:

• Each letter maps to one and only one other letter (monoalphabetic)
• The mapping is arbitrary and fixed throughout the ciphertext
• Index of Coincidence (IC) ≈ 0.067 (similar to English)
• Vulnerable to frequency analysis and pattern matching

How It Works

Key (random mapping):
A→Q, B→W, C→E, D→R, E→T, F→Y, G→U, H→I, ...

Plaintext:  HELLO WORLD
Ciphertext: ITTVY IVHTR  (using the above key)

English Letter Frequencies

E: 12.7%  T:  9.1%  A:  8.2%  O:  7.5%  I:  7.0%
N:  6.7%  S:  6.3%  H:  6.1%  R:  6.0%  D:  4.3%
L:  4.0%  C:  2.8%  U:  2.8%  M:  2.4%  W:  2.4%
...

Quick Attack: Automated Tools

quipqiup.com - Best First Step

quipqiup.com solves most English substitution ciphers automatically in seconds.

Steps:

1. Go to quipqiup.com
2. Paste your ciphertext
3. Click "Solve"
4. Review the results

Success rate: ~95% for English substitution ciphers.

CyberChef - Manual Mapping

Use CyberChef's Substitute operation to apply known letter mappings:

1. Open CyberChef
2. Add "Substitute" operation
3. Input your mapping: ABCDEF...→QWERTU...
4. Apply to ciphertext incrementally as you discover letters

dcode.fr - Cipher Identification

If unsure of cipher type: dcode.fr cipher identifier

Attack Strategy

Manual Approach: Frequency Analysis

Pattern Recognition

Short words help crack the cipher:

Single letter: A or I
Two letters: IT, IN, IS, AN, OR, TO, OF, BE, BY, DO, GO, HE, ME, MY, NO, SO, UP, US, WE...
Three letters: THE (most common), AND, FOR, ARE, BUT, NOT, YOU, CAN, HER, WAS, ONE, OUR, OUT...

Common patterns to look for:

• _H_ (likely THE)
• _ER (common ending)
• _ING (common ending)
• _LE (common ending)
• Double letters: LL, EE, OO, SS

Cipher Variants

Standard Substitution

Each letter maps to an arbitrary other letter. IC ≈ 0.067. Attack with frequency analysis or quipqiup.com.

Detection: Random-looking ciphertext with normal letter frequency distribution matching English.

Tools: quipqiup.com, CyberChef, dcode.fr

Atbash

Each letter maps to its mirror: A↔Z, B↔Y, C↔X, etc.

Alphabet mapping:

Plain:  A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cipher: Z Y X W V U T S R Q P O N M L K J I H G F E D C B A

Detection: If plain letters appear in reverse positions.

def atbash(text):
    result = ""
    for c in text:
        if c.isalpha():
            base = ord('A') if c.isupper() else ord('a')
            result += chr(base + 25 - (ord(c) - base))
        else:
            result += c
    return result

plaintext = "HELLO WORLD"
ciphertext = atbash(plaintext)
print(f"Plaintext: {plaintext}")
print(f"Ciphertext: {ciphertext}")  # → SVOOL DLIOW

# Decode (Atbash is self-inverse)
decoded = atbash(ciphertext)
print(f"Decoded: {decoded}")  # → HELLO WORLD

Attack: Try Atbash decoding when frequency analysis fails - it's a special case where each letter flips to its opposite.

Pigpen

Pigpen (Freemason's Cipher) uses geometric shapes instead of letters.

Symbol grid:

┌─┬─┬─┐     ┌─┐  ┌─┐
│1│2│3│  ·  │9│  │•│
├─┼─┼─┤     │0│  │1│
│4│5│6│     │1│  │2│
├─┼─┼─┤     └─┘  └─┘
│7│8│9│
└─┴─┴─┘

Letter-to-shape mapping:

A B C        J K L
D E F    +   M N O
G H I        P Q R

S T U        V W X
V W X    +   Y Z
Y Z

Detection:

• Visual inspection - you'll see geometric shapes (grids, crosses, X's, diamonds)
• Symbols are unmistakable and structured
• Often called "Freemason cipher" or "Masonic cipher"

Decoding tools:

• dcode.fr/pigpen-cipher
• Manual: map each shape to its grid position

Python decoder:

def decode_pigpen(symbols_text):
    """
    Decode Pigpen cipher.
    Symbols format: shapes representing grid positions
    """
    pigpen_grid_1 = {
        'A': '1', 'B': '2', 'C': '3',
        'D': '4', 'E': '5', 'F': '6',
        'G': '7', 'H': '8', 'I': '9'
    }
    pigpen_grid_2 = {
        'J': '1', 'K': '2', 'L': '3',
        'M': '4', 'N': '5', 'O': '6',
        'P': '7', 'Q': '8', 'R': '9'
    }
    pigpen_x = {
        'S': '1', 'T': '2', 'U': '3',
        'V': '4', 'W': '5', 'X': '6',
        'Y': '7', 'Z': '8'
    }
    
    # Map shapes back to letters
    # (In practice, you'd match visual shapes to these positions)
    return "Use dcode.fr for visual shape matching"

# Best approach: go to dcode.fr and draw/upload the Pigpen symbols

Checklist

• quipqiup.com first - solves most English substitution ciphers automatically
• dcode.fr cipher identifier if unsure of cipher type
• Count letter frequencies, map most frequent to E, T, A
• Look for single letters (A/I), short words (THE/AND)
• Try common 2-letter and 3-letter words: IT, IN, AND, THE
• Use CyberChef for manual mapping refinement
• Pigpen/Atbash? → visual symbols or mirror mapping
• Check IC (Index of Coincidence) ≈ 0.067 for English plaintext

Last updated on Aug 1, 2025