Cipher Decoder & Identifier

How to use it

1. Paste the encoded text. Leave the cipher set to “Identify it for me” if you don’t know what it is — that’s the normal case.
2. Read what it found. You get a ranked list of likely ciphers, each with a confidence figure and the reason behind it.
3. Take the decoded text, or scan the 25 shifts underneath if the identifier wasn’t sure.

Nothing is uploaded. The frequency analysis and every decode run in your browser.

You don’t need to know the cipher first

Most cipher tools open with a menu: pick Caesar, or Vigenère, or Atbash. That’s fine if you already know. Usually you don’t — you have a string from a puzzle, a game, a CTF or a note, and identifying it is the problem.

So this tool identifies first and decodes second. It reports what it thinks the cipher is, how confident it is, and why. The reasoning matters as much as the answer, because it’s what lets you tell a good guess from a bad one.

How the identifier works

Three signals, cheapest first.

1. The character set. Some ciphers announce themselves. Only dots and dashes means Morse. Only ones and zeroes, in a multiple of eight, means binary. Only digits, all between 1 and 26, means a number-to-letter cipher. No statistics needed.

2. The index of coincidence. This is the probability that two letters picked at random from the text are the same one. English sits around 6.7%. Random letters sit around 3.9%.

The useful part: any cipher that maps each letter to one fixed other letter leaves this number completely unchanged. Caesar, Atbash and a keyed substitution all preserve it. A cipher that uses several alphabets, like Vigenère, flattens it towards random. So before decoding anything, the index of coincidence tells you which family you’re in.

3. Chi-squared against English letter frequencies. For anything monoalphabetic, the tool decodes with all 25 shifts and scores each result against how often each letter really appears in English. The correct shift scores about 0.2 on this scale. Wrong ones land above 2.9. The gap is wide enough to be decisive on a sentence of normal text.

Why it sometimes says it doesn’t know

Frequency analysis needs material. Below about a dozen letters the counts mean nothing at all, and below about sixty they’re noisy.

There’s a specific case worth knowing about, because it looks like a bug and isn’t. Take WKH TXLFN EURZQ IRA MXPSV RYHU WKH ODCB GRJ. That’s a Caesar shift of 3 on “the quick brown fox jumps over the lazy dog” — a pangram, which uses nearly every letter exactly once. Its letter distribution is almost flat, so it looks nothing like English no matter how you rotate it. The tool reports about 35% confidence and tells you to check the 25 rotations by eye. That’s the honest answer.

The opposite case is handled too. Past sixty letters, a real Caesar cipher would have scored well. If none of the 25 rotations reads as English by then, that’s evidence against Caesar, not a weak vote for the least-bad rotation. The tool stops offering it rather than dressing a guess up as a 74% finding.

The ciphers it covers

Base64 is in the list because people paste it here constantly, not because it hides anything. It’s an encoding, designed to move binary safely through text-only systems. Anyone can reverse it in a second. If something is “protected” with Base64, it is not protected.

Several of these go by other names, which is worth knowing if you were told to look for something specific. A replacement cipher, a monoalphabetic substitution cipher and an aristocrat are all the simple substitution above. A keyword cipher is either a substitution whose alphabet is built from a keyword, or a Vigenère — paste it and the identifier will tell you which. A cipher wheel, a cipher disk and a decoder ring are all physical Caesar devices, so the text they produce decodes here. And because the tool tries every cipher at once rather than asking you to pick, it does the job of the multi cipher decoder people go looking for.

If you are here from Gravity Falls: the end-credit cryptograms work through Caesar in the early season-one episodes, Atbash in the middle, then A1Z26, with one episode combining all three. Season two switches to a keyed Vigenère. Every one of those is handled above — the Vigenère is the only one that needs you to supply the keyword.

Decoding a Caesar cipher by hand

You rarely need to, because 25 rotations is a short list. But the method is worth knowing.

1. Find the most common letter in the ciphertext.
2. Assume it’s E, which is the most common letter in English by a wide margin at 12.7%.
3. Count the distance from that letter back to E. That’s your shift.
4. Check it on a few words. If it’s wrong, try T, then A — the next most common letters.

This is exactly what the tool does, except it tries all 25 and scores every letter rather than just the most frequent one.

Worked example

Paste this in:

Wkh wuhdvxuh lv exulhg xqghu wkh wklug vwrqh
ehklqg wkh rog ploo

The tool reports Caesar / shift cipher, 96% confident, with the reason “shifting back by 3 letters produces text whose letter frequencies match English”. The decoded line reads:

The treasure is buried under the third stone
behind the old mill

Note that the punctuation, spacing and capitalisation all survive. A decoded message that has lost its word boundaries is much harder to read, and there’s no reason to throw that away.

Number ciphers

A string of numbers where every value falls between 1 and 26 is almost certainly A1Z26 — letters written as their position in the alphabet. It’s the first cipher most people meet, and it turns up constantly in escape rooms and children’s puzzle books because it needs no key and no explanation.

That fourth row is the real trap. 85121215 has no single correct reading, and any tool that confidently returns one is picking arbitrarily. This one tells you the numbers are out of range or asks for separators rather than guessing.

If your numbers go above 26, it isn’t A1Z26. Values up to 127 are usually ASCII codes, and values in pairs of two hex digits are usually bytes — both handled by the converter linked below.

Reading Morse

Morse has two levels of separator, and mixing them up is the single most common reason a decode fails.

• One space between letters. .... . is H then E.
• A slash, or two or more spaces, between words. .... . .-.. .-.. --- / .-- --- .-. .-.. -.. is HELLO WORLD.

Without the word separator you get HELLOWORLD, which is usually still readable but not what was written. This tool accepts either convention, and treats underscores as dashes since some sources write them that way.

Morse also covers digits and a fair amount of punctuation, so a decode that returns numbers or a question mark isn’t necessarily wrong.

Where these actually turn up

Not, in practice, in espionage. Every cipher on this page was broken long before computers, and none of them offers real security.

They survive because they’re fun and legible. Escape rooms use Caesar and A1Z26 because a team can solve them under pressure without a computer. Capture-the-flag competitions use ROT13 and Base64 as warm-up puzzles. Alternate reality games and puzzle hunts lean on substitution ciphers. Teachers use them to introduce frequency analysis, which is the actual lesson worth learning: every monoalphabetic cipher falls to letter counting, no matter how clever the mapping looks.

That’s also why the identifier reports its reasoning. Knowing that the index of coincidence gave the game away is more useful, next time, than being handed the plaintext.

What this tool won’t do

It won’t break a Vigenère cipher without the keyword. It’ll tell you the text is Vigenère, which is genuinely the harder half of the problem, but recovering the key needs a Kasiski examination or similar. Same for a simple substitution: identifying it is easy, solving it without the key means hill-climbing against letter statistics, which is a different kind of tool.

It also won’t touch real cryptography. AES, RSA and their like are not “ciphers you decode with a web page”, and anything claiming otherwise is lying to you.

A fair number of classical ciphers aren’t covered, and rather than leave you guessing, here is the list with what each one looks like — enough to identify yours by eye and go and find the right tool.

The pattern in that table is worth taking away. Anything the tool solves is a cipher with either no key or a tiny key space it can exhaust. Anything needing a key it can’t guess, a book, a machine or a symbol set is a different problem, and a page that claimed to solve those would be guessing at your answer.

Related tools

If the identifier says binary or hexadecimal, the hex, binary and ASCII converter handles those properly, with every format shown at once and a full ASCII table. For Base64 specifically, the Base64 encoder and decoder is the better page. If two strings look identical but won’t match, the invisible character detector finds the zero-width character that’s causing it, and text compare shows you exactly which characters differ between a decode attempt and the expected answer. To normalise capitalisation before or after decoding, use the case converter.