Naming an unknown cipher is a triage problem, and it runs in a fixed order. First you look at which characters are present, because that alone can close the question with no arithmetic at all. Then you count letters, which tells you whether one alphabet was used or several. Then you measure the distances between repeated runs, which can hand you the length of the key.
Each of those three steps is older than it looks. The letter-counting step is roughly eleven hundred years old. The distance-measuring step was published in Berlin in 1863. The statistic that separates one alphabet from many was named by an American cryptanalyst in 1922.
What follows is that method, and the place where each of its three tests stops telling you anything.
Key Takeaways
- The character set can decide it before any statistics run. Two symbols cannot stand for twenty-six letters one for one, so the question becomes the grouping, and a trailing run of equals signs two, three, four or six long separates base64 from base32 outright.
- Frequency analysis is the oldest of the three. A survey in Cryptologia calls the ninth-century scholar al-Kindi the author of "the oldest known book on cryptology, antedating any other by more than 300 years"; an earlier book, al-Khalil's, is recorded as lost.
- Letter counts cannot separate a Caesar shift from any other one-to-one substitution, because a monoalphabetic cipher moves the frequency peaks without flattening them.
- The index of coincidence can. On a 790-letter sample computed for this article it reads 0.0676 for English, 0.0676 after a Caesar shift, and 0.0412 after a six-letter Vigenère key.
- Every one of these tests degrades on short text. At 40 letters the same English sample scores 0.0474 against the Vigenère ciphertext's 0.0397, which is not a gap a verdict can rest on.
Some ciphers are named by their character set alone
Before anything is counted, the alphabet in front of you is evidence. Two distinct symbols cannot stand for twenty-six letters one for one, so the letters cannot all be single symbols, and a reader has to be able to tell where one letter ends and the next begins. There is more than one way to arrange that, and Morse uses both of them at once: its twenty-six letters run from one element to four and lean on the gaps, while all ten of its figures are exactly five elements long, so their boundaries can be found by counting alone. The one entry that spoils the pattern is in the standard too: the accented e is five elements, listed among the letters. So the question is not whether a separator is present. It is: what is the grouping, and how does a reader know where it starts and stops?
International Morse code is the canonical case, and its grouping is carried by silence. ITU-R Recommendation M.1677-1 recommends that its Annex 1 "should be used to define the Morse code characters and their applications in the radiocommunication services", and that annex builds every letter, figure and punctuation mark out of dots and dashes alone. Section 2 of it is entirely about spacing and signal length: "A dash is equal to three dots", the gap inside a letter is one dot, between letters three, and between words seven. So the give-away is not only the two symbols but the three tiers of separator, and a transcription that has lost the word gaps has lost information the standard treats as part of the code.
The base encodings give a sharper tell still, because their padding is arithmetic rather than convention. RFC 4648 fixes the base64 alphabet at 64 printable characters plus a 65th, the equals sign, which "is used to signify a special processing function". Because input is always a whole number of octets, the specification enumerates exactly three endings: no padding, one equals sign, or two. Base32 draws its 32 characters "from US-ASCII digits and uppercase letters" and enumerates five endings: none, one, three, four or six.
That arithmetic is a test, not a hint. A trailing run of two equals signs can only be base64. A run of three, four or six can only be base32. And a base64 string of the right length carries no padding at all, so the absence of an equals sign rules nothing out.
Hexadecimal is the same test read the other way. RFC 4648 makes base16 the one encoding of the three that carries no padding, its section 3.2 noting that "the base16 alphabet does not need it", and its section 8 fixes the grouping exactly: the encoding "represents 8-bit groups (octets) of input bits as output strings of 2 encoded characters". So a hex string is always of even length and never ends in an equals sign, which is why an odd-length run of hex digits is either truncated or is not an octet-wise hex encoding. Digits on their own are weaker evidence than they look. Values that never exceed 26 are consistent with letter positions, but they are equally consistent with a grid scheme, so the ceiling narrows the field without closing it; and a pair of digits neither of which exceeds 5 is at least consistent with coordinates in a five-by-five grid, which is a hypothesis to test rather than a finding. None of it needs a frequency count.
Frequency analysis is about eleven hundred years old
Once the character set has said the message is alphabetic, the next move is the oldest one in the field: count the letters.
Its origin is Arabic, and the strongest documentation is Ibrahim A. Al-Kadi's survey in Cryptologia in April 1992, which reports on manuscripts found and published in the twentieth century. Its abstract names the ninth-century scholar al-Kindi as the author of "the oldest known book on cryptology, antedating any other by more than 300 years", and adds that the discoveries "push the frontiers of the history of cryptology back by about 500 years".
The vocabulary came with it. The same abstract records that "The word 'cipher' in European languages comes from the Arabic word sifr", so the word this article keeps using arrived by the same route as the technique.
Al-Kadi is careful about a distinction that popular accounts flatten. The first known book on the subject was not al-Kindi's. It was the linguist al-Khalil's Kitab al-Mu'amma, and Al-Kadi records on page 104 that it "is apparently lost". Al-Kindi's is the oldest one that survives, and Al-Kadi reproduces its first page as his Figure 1. Its title, Risalah fi Istikhraj al-Mu'amma, comes from the KACST lecture cited below, which calls it the oldest extant manuscript on cryptanalysis.
What the treatise actually does is count. Mohammed I. Al-Suwaiyel of KACST, lecturing at the University of Oxford in 2018, reports that al-Kindi worked out the frequency of the Arabic letters from a text of 3,667 letters and set the result beside the modern figures, and sources that to the edition of the treatise prepared by M. Mrayati and colleagues and published in 2003 by KACST with the King Faisal Center for Research and Islamic Studies. That is a documented figure at one remove: the count is in the edition, and this article has read the lecture rather than the edition.
What a 1916 field manual counted first
The best surviving picture of how this was actually done by hand is Parker Hitt's Manual for the Solution of Military Ciphers, printed at Fort Leavenworth in 1916. It is not a history. It is a procedure, written for a room with one examining officer, one stenographer and one clerk.
Hitt's first cut is not between ciphers but between the two classes of cipher, and it is a vowel count. Chapter IV instructs the clerk to "Count the number of letters in the message, the number of vowels, AEIOU, the number of the consonants, LNRST, and the number of the consonants, JKQXZ." For English, a transposition cipher should show roughly 40 per cent, 30 per cent and 3 per cent, because transposition rearranges the plaintext without replacing any of it. Hitt's rule is blunt: "If these proportions do not hold within 5%, one way or the other, the cipher is certainly a substitution cipher." He does not say whether the 5 is percentage points or a proportion of the figure, and every reading below takes it as points, which is how the tolerance behaves against his own tables.
On the 790-letter English sample used throughout this article the counts are 37.6, 35.4 and 1.6 per cent. Shift every letter by three and they become 18.4, 14.1 and 18.6. The rare-consonant figure jumping from under 2 per cent to over 18 is the whole test in one number.
Read against the rounded figures the plaintext itself just misses: 35.4 against 30 for LNRST is 5.4 points out, where Hitt allows 5. Read against his own measurements it passes comfortably. His Table I, counted over ten thousand letters, gives the vowels 38.37 per cent, LNRST 31.86 per cent and JKQXZ 1.77 per cent, and only then rounds: "The vowels may be safely taken as 40%, consonants LNRST as 30% and consonants JKQXZ as 2%." Against the measured 31.86 the sample is 3.5 points out, not 5.4, and its vowels land within a point of his 38.37. The rounding is where the miss comes from.
Hitt is not quite consistent about it himself. Table I rounds the rare consonants to 2 per cent; the rule in Chapter IV states them as 3.
There is an innocent reading, and it does not survive contact with the book. Message endings are padded with exactly those letters, as the same chapter warns, so 3 per cent could be a deliberate allowance for real traffic rather than a slip. Two things say otherwise. Hitt's Table II, the telegraph-message table and so the most traffic-like of the set, still gives JKQXZ 2.25 per cent. And the Spanish rule sits in the same Chapter IV rule, under the same padding warning, and rounds its table's 1.76 per cent down to 2, where the English 1.77 goes up to 3. A rounding that treats two figures a hundredth of a point apart in opposite directions is not an allowance. A percentage point inside a 5-point tolerance changes no verdict, which is presumably why it survived, but it is a reminder that the numbers in a rule of thumb are a summary of a table rather than a measurement.
Hitt's second cut, in Chapter III, separates one alphabet from several without any statistic more advanced than a ratio. If the counted letters are very uneven, the cipher is monoalphabetic. If they come out level, "the most common letter occurring not over three or four times as often as the least common letter", he eliminates the simple cases and sends the clerk looking for repeated groups. On the same sample his fifteen check letters run 62 to 1 after a Caesar shift, and 48 to 20 after a six-letter Vigenère key, a ratio of 2.4. His threshold lands almost exactly between them.
He also flags a trap that survives every later refinement, because it is a property of the message rather than of the method. Message endings are padded: "often the end of a message is filled with letters like K, X, Z to complete cipher words and it is best to neglect the last word or words in making a count."
Why letter counts cannot separate a Caesar cipher from a Vigenère
Hitt's ratio is a rule of thumb standing in for a statistic, and the statistic arrived a few years later.
William F. Friedman's The Index of Coincidence and its Applications in Cryptanalysis began as a paper published by the Riverbank Laboratories at Geneva, Illinois, in 1922. He revised it in 1923, and the War Department printed the revision in 1935, its footnote recording that the text is "a revision of an earlier paper with the same title" and that although better methods had since been elaborated, "it has been deemed of interest historically to publish this paper in its 1923 form without change".
Its opening paragraph is a description of the identification problem itself. The shape of the frequency curves, Friedman writes, had been read mainly to settle "two more or less preliminary points": "(1) whether the frequency distribution approximates that of a substitution cipher involving only one alphabet or more than one alphabet; (2) whether this approximation corresponds to that of a standard alphabet, direct or reversed, or that of a mixed alphabet." His claim for the new method is that it works "without any assumptions whatever of plain-text values for the cipher letters". You can classify the cipher without guessing a single letter of it.
There is a wrinkle in the name that most accounts skip. The quantity Friedman actually christens on page 89 of that paper is not the one modern tools compute. His index is a signed goodness-of-fit score for two superimposed sequences, "obtained by dividing the difference between the totals of coincidences and noncoincidences by the total occurrences". It can go below zero, which settles the point: he writes on the same page that "an index of -.03 will indicate a much better fit than an index of -.35". A probability cannot be negative, so that is not the statistic anyone computes today. The familiar ratio arrived later, and the 1935 printing records it in a footnote on page 11, crediting further mathematical work by Friedman and by S. Kullback: "the ratio of the number of actual coincidences to the total number of possible coincidences is .038 for an incorrect case and .066 for a correct one."
Those two numbers are the whole test. Here is the same 790-letter passage of Hitt's own Chapter II run through it, every figure computed rather than quoted:
| Text |
Index of coincidence |
Ratio to random |
| Plain English |
0.0676 |
1.76 |
| After a Caesar shift of three |
0.0676 |
1.76 |
| After a six-letter Vigenère key |
0.0412 |
1.07 |
| Flat, random letters |
0.0385 |
1.00 |
The first two rows are identical to four decimal places, and they have to be. A one-to-one substitution renames the peaks without levelling them, so no measure of unevenness can tell a Caesar from an Atbash from a scrambled cryptogram alphabet. The third row is the point of the statistic: six alphabets in rotation drag the count almost down to the random floor. Friedman's footnote gives .066 for a correct case, and in this letter-frequency setting that is the ordinary-text value; the sample's measured 0.0676 sits close enough to it that a reader can check the arithmetic.
Kasiski's 1863 rule: measure the gaps, then factor them
Knowing a cipher is polyalphabetic is not the same as knowing how many alphabets. That test was published fifty-nine years before Friedman's, by a retired Prussian major, F. W. Kasiski, in Die Geheimschriften und die Dechiffrir-Kunst, Berlin, 1863.
Section 78, on page 34, is the identification test set out plainly. In German it reads: "In der einfachen Chiffre-Schrift kommen die Wiederholungen häufiger und nur zufällig, also selten in regelmäßigen Zwischenräumen vor; während in der zusammengesetzten Chiffre-Schrift diese Wiederholungen weniger oft, jedoch gewöhnlich in solchen Abständen vorkommen, daß die Anzahl der Buchstaben ihrer Entfernung von einander, durch eine Zahl, welche die Anzahl der Buchstaben des Schlüssels anzeigt, theilbar ist". Rendered into English: in a simple cipher, repetitions are more frequent but land at random intervals; in a compound cipher they are rarer, but the distance between them is usually divisible by the number of letters in the key.
Section 80 turns that into a procedure. Find every repetition of two or more characters, measure the distance between occurrences, write the distance under the text and break it into factors. His worked example is two characters "gf" with 28 letters between them, so "Man schreibt also gf = 30 = 5 . 6." The verdict, on page 35, is a counting rule: "Diejenigen Faktoren, welche am häufigsten gefunden werden, zeigen die Anzahl der Buchstaben des Schlüssels an." The factors found most often give the number of letters in the key.
Run that on the Vigenère ciphertext used in the comparison and it works, with a caveat the textbooks tend to leave out. Counting only runs of three or more, which Hitt rates "always much more valuable than single pairs", the text yields 56 repeated runs and 72 measurable gaps. The factor 6 divides 67 of them, or 93 per cent. But 2 divides 69 and 3 divides 68, because every divisor of the true key length also divides the gaps. The answer is not the commonest factor; it is the largest factor that still divides almost every gap. Past 6 the tally falls off a cliff, and it falls off for factors that have nothing to do with the key as well: 4 divides 41 of the 72 and 12 divides 40, against 6 at 67. The gap is between 6 and everything else, not between 6 and its own multiples.
Friedman later called the procedure simply "factoring", and his Military Cryptanalysis, Part II states the negative result that makes it an identification test rather than merely a solving step. Applied to a monoalphabetic cipher, "recurrences are very plentiful as a rule, and the intervals separating these recurrences may be factored, but the factors will show no constancy". The Caesar text from the same sample bears that out exactly: 164 repeated runs, 630 gaps, and the best-scoring factor is 2 at 42 per cent, against 93 per cent for the real key length.
What each cipher test cannot tell you
Every one of these tests has a documented failure mode, and knowing them is most of the skill.
Text length beats all three of them. On the sample used here the English index is unstable at the short end, reading 0.0474 at 40 letters, 0.0570 at 100 and 0.0649 at 200, while the Vigenère ciphertext holds between 0.0393 and 0.0412 throughout. At 40 letters the two are 0.008 apart. That is a real gap in the right direction, and it is not a gap a verdict can rest on, because the English figure has not yet settled anywhere near the 0.0676 it reaches over the full sample.
Factoring has two named blind spots. Friedman gives one: with a long key and a short message it simply fails to find the period. He gives the other too, and it is the more interesting, because certain non-periodic polyalphabetic ciphers throw up plenty of repeated groups whose intervals "bear no definite multiple relation to the length of the key". A clean-looking factor tally is evidence; an untidy one is not proof of anything.
The index of coincidence is blind by construction to which monoalphabet was used, and blind altogether to transposition, which changes no letter at all. Kasiski's rule inherits a related weakness that he documents himself in section 77: repetitions can be pure accident, which is why he insists on listing all of them rather than trusting one. Hitt saw the same problem from the other side, and his advice was to weight the evidence by length, since groups of three or more letters "are always much more valuable than single pairs".
And a message need not use one system at all. Hitt allowed for the combination in 1916 and said what it does to a verdict: such a message "will fall into the substitution class on first determination and after solution as a substitution cipher it must be handled as a transposition cipher". One answer is not enough for it, and no statistic computed over the whole text will say so. The Kryptos sculpture at CIA headquarters is the celebrated modern instance. The CIA's own account of it identifies the chart on the reverse of the screen as Vigenere's tableau, and says the artist used that chart system "in combination with matrix coding systems, to encipher the first three encoded texts", which is more than one system on a single sheet of copper. The fourth, it says, was designed "to be very difficult to crack and as of yet, it has not been broken". It was dedicated in November 1990. Every test in this article assumes one system, one language and enough text, and each of those three is an assumption a real message is free to break.
Frequently asked questions
How can you tell which cipher was used without the key?
By working through three tests in order. The character set comes first, because a message of only two symbols, or only hex digits, or a block ending in a run of exactly two equals signs, is narrowed, and sometimes settled, by inspection alone. Then the letter frequencies, which separate a transposition cipher from a substitution one and a single-alphabet cipher from a multi-alphabet one. Then the distances between repeated runs, which give the key length for a repeating-key cipher. Friedman's 1922 paper makes the point explicitly: this classification can be done "without any assumptions whatever of plain-text values for the cipher letters".
What is the index of coincidence, in plain terms?
It is the probability that two letters drawn at random from a text, without replacement, turn out to be the same letter. Friedman's 1935 footnote gives the two reference values as .066 for a correct case and .038 for an incorrect one; in the letter-frequency setting those correspond to ordinary text and to flat random letters, which is what the worked example above reproduces. On the 790-letter sample computed for this article, English reads 0.0676 and stays at 0.0676 after a Caesar shift, while a six-letter Vigenère key pulls it down to 0.0412. It is the standard way of telling a one-alphabet cipher from a many-alphabet one.
Why can frequency analysis not tell a Caesar cipher from a cryptogram?
Because both are one-to-one substitutions, and a one-to-one substitution relabels the frequency peaks without changing their shape. The index of coincidence of the sample here is identical to four decimal places before and after a Caesar shift. What separates the two is not the shape of the distribution but its alignment: a Caesar's peaks sit at a constant offset from the English ones, so a shift cipher matches under one of 25 rotations while a scrambled alphabet matches under none.
How does the Kasiski examination find the key length?
You list every repeated run of two or more characters, measure the gap between occurrences, and factor each gap; the tallies quoted here count only runs of three or more, which carry far more weight than a repeated pair. Kasiski's 1863 rule is that the factors found most often indicate the number of letters in the key. One refinement matters in practice: because every divisor of the true key length also divides the gaps, the answer is the largest factor that still divides nearly all of them, not simply the commonest. On the worked example here 6 divides 67 of 72 gaps while 12 divides only 40.
Why do 2 and 3 outscore the real key length in a Kasiski tally?
Because every divisor of the true key length also divides the gaps between repetitions, so a six-letter key makes 2 and 3 look at least as good as 6. On the worked example here 2 divides 69 of the 72 gaps and 3 divides 68, against 6 at 67, and the true key is six letters long. The reading that works is to take the largest factor that still divides almost every gap, and to check that the next candidates up collapse: 4 divides 41 and 12 divides 40, so 6 is where the evidence stops.
Sources
- Friedrich W. Kasiski, Die Geheimschriften und die Dechiffrir-Kunst, Berlin, printed and published by E. S. Mittler und Sohn, 1863, sections 77 to 81 at pages 33 to 35, read as page images from the digitised copy - retrieved 13 August 2026, https://books.google.de/books?id=fB5dAAAAcAAJ
- Parker Hitt, Manual for the Solution of Military Ciphers, Press of the Army Service Schools, Fort Leavenworth, Kansas, 1916, Tables I and II in chapter II, the Spanish table at page 11, chapter III at pages 19 to 22, chapter IV at pages 23 to 25, and chapter VII at page 64 - retrieved 13 August 2026, https://archive.org/details/manualforsolutio00hittrich
- William F. Friedman, The Index of Coincidence and its Applications in Cryptanalysis, Technical Paper, War Department, Office of the Chief Signal Officer, Washington, 1935; a revision prepared in 1923 of the paper published in 1922 by the Riverbank Laboratories. Introduction at page 1, footnote 3 at page 11, definition at page 89. Declassified and approved for release by NSA on 06 January 2014 - retrieved 13 August 2026, https://archive.org/details/41761039080018
- William F. Friedman, Military Cryptanalysis, Part II: Simpler Varieties of Polyalphabetic Substitution Systems, third edition, War Department, Office of the Chief Signal Officer, paragraphs 9q and 10 on factoring, at page 15 - retrieved 13 August 2026, https://archive.org/details/41751989079119
- Ibrahim A. Al-Kadi, Origins of Cryptology: The Arab Contributions, in Cryptologia, volume 16, number 2, April 1992, pages 97 to 126; abstract at page 97, al-Khalil at page 104, al-Kindi manuscript facsimile at page 105 - retrieved 13 August 2026, https://membres-ljk.imag.fr/Bernard.Ycart/mel/hm/AlKadi_cryptology.pdf
- Mohammed I. Al-Suwaiyel, King Abdulaziz City for Science and Technology, Arabic Origins of Cryptology: The Discovery of Ancient Manuscripts, lecture given at the University of Oxford, 26 April 2018, slide 13 - retrieved 13 August 2026, https://muslimheritage.com/wp-content/uploads/2018/05/cryptology01.pdf
- International Telecommunication Union, Recommendation ITU-R M.1677-1, International Morse Code, October 2009, the recommends clause at page 1, and Annex 1 Part I sections 1 and 2 - retrieved 13 August 2026, https://www.itu.int/dms_pubrec/itu-r/rec/m/R-REC-M.1677-1-200910-I!!PDF-E.pdf
- Central Intelligence Agency, Kryptos Sculpture, CIA legacy headquarters pages - retrieved 13 August 2026, https://www.cia.gov/legacy/headquarters/kryptos-sculpture/
- S. Josefsson, RFC 4648, The Base16, Base32, and Base64 Data Encodings, Internet Engineering Task Force, October 2006, sections 3.2, 4, 6 and 8 - retrieved 13 August 2026, https://www.rfc-editor.org/rfc/rfc4648.txt
