What Is Letter Frequency — And How Was It Used to Break Ancient Ciphers?

Letter frequency is the count of how often each letter appears in a block of text. It matters because natural language is uneven: in English, some letters are common, others are rare, and that imbalance gives you clues. If you want to inspect real text instead of guessing, give our free letter frequency counter a spin.

What letter frequency actually tells you

At the simplest level, letter frequency is a fingerprint. If you count letters in a long enough sample of English, the distribution is not flat: e, t, a, and o show up far more than z, q, or x. That pattern is stable enough to be useful in both linguistics and cryptanalysis.

For developers, the key idea is that random-looking text is often not random at all. Human language has structure, and that structure leaks through even when a message is encrypted with a simple substitution or transposition. If the cipher preserves letter counts, the distribution can survive the scramble.

This is why frequency analysis became a first-pass attack on old ciphers. You do not need to know the key to start making useful guesses. You only need enough ciphertext, a known language, and a way to compare observed counts against expected counts.

Why ancient ciphers were vulnerable

Classic substitution ciphers replace each letter with another symbol or letter. The problem is that they usually keep the same number of each symbol, just under a different mask. So if e is the most common letter in the plaintext, the most common ciphertext symbol is often its replacement.

That does not instantly solve a message, but it narrows the search space fast. A cryptanalyst might start by mapping the most common ciphertext character to e, then inspect common digrams and trigrams like th, he, or ing. It becomes a game of constraints, not magic.

Some older methods were even weaker. Caesar shifts, monoalphabetic substitutions, and many hand-written diplomatic ciphers could be chipped away with nothing more than a pencil and a frequency table. Once one or two letters fall into place, the rest often collapse under pattern matching.

Polyalphabetic ciphers like Vigenère were designed to hide those counts by spreading the plaintext across multiple alphabets. That made letter frequency less obvious, but not useless. Repeated key lengths, repeated segments, and sliced ciphertexts still left traces that analysts could attack.

How analysts use frequency counts in practice

The practical workflow is straightforward. Count the letters, compare the distribution to a known language profile, and look for suspicious spikes or gaps. Then test likely substitutions, common word shapes, and repeated endings.

A quick rule of thumb: short samples lie, long samples talk. In a tiny message, one extra word can distort the counts hard enough to mislead you. In a larger body of text, the distribution starts to converge on the language's usual shape.

Modern text analysis often uses the same concept with better math. You can compute the expected versus observed distribution and score the difference. A common metric is chi-square style comparison, where you measure how far the sample deviates from the expected language model.

// crude sketch of a frequency counter in JavaScript-like pseudocode
const counts = {}
for (const ch of text.toLowerCase()) {
  if (ch >= 'a' && ch <= 'z') {
    counts[ch] = (counts[ch] || 0) + 1
  }
}

console.log(counts)

That kind of code is enough to build a first-pass tool. You do not need a full cryptography stack to spot patterns. Sometimes the useful answer is just: this text is unusually heavy on e, or weirdly starved of vowels.

If you are working with placeholder text, it helps to compare against something designed to look human. Our guide on placeholder text and why it behaves differently from real language is a useful contrast. Lorem Ipsum has a language-like shape, while generated identifiers and hashes usually do not.

What breaks frequency analysis, and what does not

Not every encoding or cipher leaks letter frequency in the same way. If a system simply converts text into a format like Base64, you are not looking at a cipher at all; you are looking at encoding. The output alphabet changes, but the underlying data is still there in a reversible way.

By contrast, some formats are intentionally unfriendly to natural language patterns. UUIDs, random strings, and hashes are built to look noisy and uniform. A good random identifier should not give you the kind of skewed distribution you see in English prose.

That makes frequency analysis a bad fit for modern cryptographic primitives and a good fit for weak or legacy schemes. AES, for example, is designed so ciphertext looks statistically flat to an outsider. The whole point is to kill the easy fingerprints that old ciphers leaked.

There is also a middle ground: text that is compressed, encoded, or lightly transformed. Compressed data often has a flatter distribution than prose, but not always a perfectly random one. That can matter if you are inspecting logs, payloads, or suspicious strings in debugging workflows.

Signals you can inspect beyond single letters

Single-letter counts are the entry point, not the whole story. Real analysis often moves to pairs, triples, and word shapes. English has familiar patterns: th, he, ing, ed, and common one-letter words like a and I.

That is why frequency analysis pairs well with simple heuristics. If a ciphertext has a lot of one-letter tokens after a tentative substitution, that is a clue. If every apparent vowel disappears, that is another clue. You are not solving by raw counts alone; you are stacking evidence.

• Single letters: good for first guesses on substitutions.
• Digraphs: helpful for common pairs like th and he.
• Trigraphs: useful for endings like ing and ion.
• Word shapes: patterns like _ _, _ _ _, or repeated initials can reduce the search space.

In practice, many old ciphers were broken by mixing these signals rather than relying on one stat alone. Frequency gives you the skeleton. Pattern matching adds the meat.

A Worked Example

Here is a tiny example using a Caesar shift, which is the easiest place to see the logic. Suppose the plaintext is:

attack at dawn

Shift each letter forward by 3, and you get:

dwwdfn dw gdzq

If you only see the ciphertext, the counts still look language-like. The most common letters are repeated in roughly the same way as the source. That is why Caesar ciphers are trivial to crack: you can try all 25 possible shifts, but frequency makes the right one stand out faster.

Now compare that with a substitution that preserves counts but shuffles letters differently. Imagine the ciphertext:

gssgca gs zshl

Even without the key, you can notice a few things. The repeated double letters suggest a word like tt or ll might be hiding there, the one-letter word at becomes suspicious, and the final four-letter word might be a common pattern such as dawn. A frequency table tells you which ciphertext letters deserve attention first.

If you run this kind of text through a counter, you are looking for skew. For example, a sample might show a suspiciously high number of one character and almost no vowels. That would tell you to stop treating the text like natural English and start testing whether it is encoded, encrypted, or just random-looking.

Sample plaintext:  attack at dawn
Letters:         a t t a c k a t d a w n
Counts:           a=4, t=3, others=1

Sample ciphertext: dwwdfn dw gdzq
Counts:             d=3, w=3, others=1

The important part is not the exact ciphertext. It is the method: count, compare, guess, refine. That loop is the backbone of a lot of classical codebreaking.

Frequently Asked Questions

What is letter frequency in simple terms?

It is the number of times each letter appears in a text sample. In English, the distribution is uneven, so some letters appear much more often than others. That unevenness is what makes the technique useful for analysis and codebreaking.

How did letter frequency help break ciphers?

Old substitution ciphers often preserved the underlying letter counts, just with different symbols. Analysts compared the ciphertext distribution to the expected distribution of the language and used that to guess mappings. Once a few letters were identified, the rest of the message became much easier to solve.

Does letter frequency work on modern encryption?

Not in the same way. Modern ciphers like AES are designed to hide patterns so ciphertext looks statistically flat and unpredictable. Frequency analysis is mainly effective against older or weaker schemes, not properly implemented modern encryption.

How many characters do I need for frequency analysis to be useful?

More is better, because small samples are noisy. A short message can have weird letter counts just by chance, while a longer sample tends to reflect the language more accurately. For tiny strings, frequency can still hint at things, but it is not something you should trust alone.

One Last Thing

Letter frequency is one of those ideas that looks almost too simple until you see it work. Languages leave statistical fingerprints, and old ciphers often failed because they could not hide those fingerprints well enough. Once you know what to look for, ciphertext stops being a wall and starts being a puzzle.

If you are debugging a suspicious string, comparing placeholder text, or just learning how classical codebreaking works, count the letters first. Then check digrams, look for repeated shapes, and see whether the text behaves like real language or like noise. You can use the letter frequency counter here to get the numbers without hand-counting like it is 1847.