ROT13 has no key. Everyone knows the shift, applying it twice returns the original text, and breaking it requires no work at all. It was never meant to resist anything — it exists so that a punchline or a spoiler does not register when your eye passes over it.
That is a real job, and ROT13 does it well. Confusing it with encryption is the mistake, and it is one the classical ciphers invite because they look like the real thing.
Why is ROT13 its own inverse?
Because the Latin alphabet has 26 letters and 13 is half of 26. Shift forward 13 and A becomes N; shift forward 13 again and N returns to A, having wrapped past Z.
One function encodes and decodes, which is why tools for it have a single button. No other Caesar shift shares the property — shifting by 5 needs a shift of 21 to undo, so the direction has to be tracked.
A Caesar cipher has 25 useful shifts in total, since a shift of 0 or 26 changes nothing. Twenty-five is a number a person can try by hand over a coffee, which is the whole security analysis.
How does frequency analysis break substitution?
By counting. Any cipher that maps each letter to one fixed other letter preserves the frequency profile of the language underneath, so the most common ciphertext letter is almost certainly standing in for E.
| Letter | Share of English text |
|---|---|
| E | ~12.7% |
| T | ~9.1% |
| A | ~8.2% |
| O | ~7.5% |
| I | ~7.0% |
The gap between E and T is wide enough to be visible in a paragraph or two. Add the short words — a one-letter word is A or I, and the commonest three-letter word is THE — and a monoalphabetic cipher falls apart on any message long enough to be worth reading.
This is why the technique dates to the ninth century and has never stopped working. It is arithmetic on letter counts, not cryptography.
What made Vigenère different?
It uses a different shift for each position, cycling through a keyword. With the key CAT, the first letter shifts by 2, the second by 0, the third by 19, then the pattern repeats — so the same plaintext letter becomes different ciphertext letters depending on where it sits.
That flattens the frequency profile, which is exactly what defeats the counting attack. The cipher held its reputation for roughly three centuries and picked up a nickname for it: le chiffre indéchiffrable, the indecipherable cipher.
It was decipherable. Charles Babbage worked out a method around 1854 without publishing it, and Friedrich Kasiski published the general technique in 1863.
How was it actually broken?
By finding repeats. If a common word like THE lines up with the same part of the key twice, it produces the identical ciphertext sequence both times — and the distance between those two occurrences is a multiple of the key length.
Collect several such distances, take their common factors, and the key length falls out. Once you know the key is five letters long, the message splits into five separate Caesar ciphers, one for every fifth letter, and each of those surrenders to frequency analysis immediately.
That is the Kasiski examination, and it explains the one condition under which the idea does become unbreakable: a key as long as the message, chosen at random and never reused. There are no repeats to find, because the key never cycles. That is the one-time pad, and it is genuinely secure and almost never practical.
When should you reach for these?
Puzzles, teaching, geocaching, escape rooms, crossword clues and hiding spoilers. Every one of those wants a cipher that can be solved by hand, which is a feature rather than a weakness.
For anything with a consequence, the distinction that matters is set out in the article on hashing: encoding is reversible with no secret, encryption is reversible with a key, hashing is not reversible at all. A Caesar shift is closer to encoding than to either of the others, because the "key" is one of twenty-five guesses.
Morse and binary are encodings too, not ciphers — they change how a message is written down without hiding it, and Morse has its own timing article covering what the units actually mean.
One practical advantage keeps ROT13 in use where stronger schemes would be awkward: the output is still letters. It survives being pasted into a forum post, an email or a form field that would mangle the padding characters of a real encoding, and it needs no software at the other end beyond an alphabet.
Questions people ask
Is ROT13 used for anything today? Spoiler tags, joke punchlines and obfuscating text a naive filter would otherwise flag. All three want reversal to be easy.
What is ROT47? The same idea over the printable ASCII range rather than the 26 letters, so it scrambles punctuation and digits too. Equally not encryption.
Does Vigenère work on non-letters? Standard implementations pass spaces, digits and punctuation through unchanged, which leaks word boundaries and helps an attacker.
Can I nest ciphers for strength? Two Caesar shifts are one Caesar shift. Combining weak classical ciphers does not compound into a strong one.
Solve it or set it. The Caesar cipher covers every shift so a brute-force read is a matter of scanning the list, the ROT13 decoder does the one shift that needs no direction, and the Vigenère cipher takes a keyword. All three run in the browser, which for something you are hiding is the right place.