Caesar and the Origins of the Shift Cipher

The oldest documented cipher in Western history is also, by modern standards, one of the easiest to break — and the gap between those two facts is really a story about how much the world around a cipher can change while the cipher itself stays exactly the same.

What Suetonius Actually Wrote

The earliest surviving account of Caesar's cipher comes from the Roman historian Suetonius, writing in his biographical collection The Twelve Caesars around 121 CE — roughly 150 years after Caesar's own lifetime. Suetonius describes it directly: when Caesar had anything confidential to communicate, he wrote it "by so changing the order of the letters of the alphabet, that not a word could be made out," replacing each letter with the one three places further along. Suetonius also records a detail that rarely makes it into shorter retellings: Caesar's successor Augustus found even that modest three-letter shift too complicated to use reliably, and simplified it further to a shift of just one letter each — swapping every letter for the very next one in the alphabet.

Written for Generals, Not Codebreakers

Caesar is understood to have used the cipher for military correspondence, including dispatches connected to his campaigns in Gaul, where a message intercepted by an enemy — or simply by a messenger who shouldn't have been reading it — needed to stay meaningless without the key. Nothing in the surviving historical record suggests Caesar's contemporaries had any real technique for attacking a substitution cipher at all. The likeliest explanation for why a shift this simple worked isn't cryptographic sophistication, it's audience: most of the people who might intercept a Roman military dispatch were illiterate, and among those who could read, an unfamiliar jumble of letters plausibly looked like a message in a foreign language rather than a deliberately scrambled Latin one. The cipher didn't need to be hard to break. It needed an opponent who had no idea there was anything to break in the first place.

Centuries Before Anyone Had a Reason to Attack It

That gap — a cipher with no serious opponent — lasted a remarkably long time. It would be roughly nine centuries before anyone is known to have developed a systematic method for breaking a simple substitution cipher like Caesar's: the 9th-century scholar Al-Kindi's work on frequency analysis, arising out of a completely different context in Baghdad, gave codebreakers for the first time a reliable way to recover a message like this without knowing the shift in advance. Caesar's cipher wasn't specifically what Al-Kindi was attacking, but every shift cipher, including Caesar's exact three-letter version, falls to the same technique, because it shares the same underlying weakness: one letter always becomes the same other letter, everywhere in the message, which is precisely the regularity frequency analysis is built to exploit.

The Same Idea, Now a Teaching Tool and a Spoiler Filter

The shift cipher never actually left circulation after Caesar — it just stopped being useful for anything genuinely secret. Today it survives almost entirely as a teaching example and a piece of low-stakes internet culture: ROT13, a shift of exactly thirteen places, has been used online for decades to lightly obscure spoilers, puzzle answers, or off-color jokes in forum posts, not because it provides any real security — a shift of thirteen is trivial to reverse — but because it's just inconvenient enough to stop a reader from seeing the text by accident while scrolling past. With only 25 possible non-zero shifts total, a modern computer can simply try every single one in a fraction of a second and read off whichever result forms real words, making brute force alone enough to defeat it completely — no frequency analysis required at all.

ROT13's specific choice of thirteen isn't arbitrary the way it might look — thirteen is exactly half of the 26-letter alphabet, which gives it one genuinely useful property none of the other 25 possible shifts share: applying it twice in a row returns the original text unchanged. That means the same simple function can be used to both hide and reveal a message without needing separate encode and decode logic at all, which is exactly why early internet software built spoiler-hiding tools around it instead of picking a different, equally weak shift value.