Codebreaking Basics: An Introduction to Cryptanalysis

Making a code and breaking one are almost opposite skills, which is why they have separate names: cryptography is writing a message so only the intended reader can understand it, and cryptanalysis — codebreaking — is recovering that message anyway, without the key. Almost the entire history of codebreaking is a back-and-forth: someone builds a cipher confident it can't be cracked, and it holds, sometimes for centuries, until a specific structural weakness is found.

Two Basic Ways to Hide a Message

Almost every classical cipher is a variation on two ideas. A substitution cipher replaces each letter with something else — another letter, a number, a symbol — while keeping the letters in their original order; the Caesar cipher, which simply shifts every letter a fixed number of places through the alphabet, is the simplest and oldest documented example. A transposition cipher does the opposite: it keeps every original letter but scrambles their positions according to some rule, so the letters are all still there, just rearranged. Most historically significant ciphers either pick one of these approaches and push it further, or combine both.

The Weakness Hiding in Plain Sight

A simple substitution cipher looks unbreakable if you're only imagining trying every possible key by hand — there are over 400 billion trillion ways to map 26 letters to 26 substitutes. But that's the wrong way to attack it. In the 9th century, the Arab scholar and polymath Al-Kindi, working in Baghdad, wrote a treatise describing a completely different approach: every language has letters that appear more often than others, and a simple substitution cipher can't hide that pattern, because it always swaps the same letter for the same substitute. Count which symbol shows up most often in the ciphertext, and in a long enough English message, that symbol is very likely standing in for E. Al-Kindi's frequency analysis didn't need to guess the key at all — it read the cipher's own statistics against it.

The Cipher Built to Defeat Frequency Analysis

Frequency analysis only works because a simple substitution cipher always encodes the same letter the same way. The Vigenère cipher, which layers several different substitution alphabets across a message according to a repeating keyword, was specifically designed to break that assumption — the same plaintext letter can turn into several different ciphertext letters depending on where it falls relative to the keyword. For roughly three centuries, it had a reputation as unbreakable, sometimes nicknamed "le chiffre indéchiffrable," the indecipherable cipher, in the literature that discussed it.

The Break Nobody Talked About For Years

Charles Babbage, better known today for early mechanical computing, worked out how to break the Vigenère cipher around 1854 — roughly a decade before anyone else published the same insight. His method looked for repeated sequences of letters in the ciphertext; if the same word happens to land at the same position relative to the repeating keyword more than once, it produces an identical repeated chunk of ciphertext, and the distance between those repeats reveals the keyword's length. Once the keyword length is known, the message splits into that many separate simple substitution problems, each vulnerable to ordinary frequency analysis. Babbage never published the discovery. Historians studying the timing believe British codebreakers used the technique quietly during the Crimean War against Russian and allied communications, and that publishing it would have handed the method to everyone, including future adversaries. Friedrich Kasiski published essentially the same technique independently in 1863, and it's his name — Kasiski examination — attached to it today, not Babbage's.

Why This Still Matters

Every classical cipher discussed here — Caesar's shift, simple substitution, Vigenère's repeating keyword — shares one property that eventually gave codebreakers a foothold: some structural regularity survives encryption, whether that's letter frequency or a repeating pattern tied to a reused key. The one classical technique proven mathematically unbreakable, the one-time pad — a key as long as the message itself, truly random, and never reused — has no such regularity to exploit, which is exactly why it's the one exception on this list. Everything else on this site's translators, from the shift cipher to the symbol substitutions, inherits some version of the same trade-off: readable enough to use by hand, and for exactly that reason, structured enough to eventually be read by someone it wasn't meant for.