{
  "id": 2440180,
  "title": "You don't search for the key, you search for English: how cipher auto-solvers actually work",
  "url": "https://urgent.news/2026/08/21/you-dont-search-for-the-key-you-search-for-english-how-cipher-auto",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T21:53:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/textmachine/you-dont-search-for-the-key-you-search-for-english-how-cipher-auto-solvers-actually-work-42lc"
  },
  "original_language": "en",
  "account": "Most cipher solvers start by figuring out which type of cipher they are dealing with. If it's a monoalphabetic substitution cipher or a Vigenère cipher, they don't have any key information like a keyword or shift value. Manually cracking these types of ciphers can take a long time, but a computer can do it much faster.\n\nThe key idea behind these solvers is that they don't try to find the key directly. Instead, they look for how English-like a given decryption is. A wrong key will produce gibberish while the correct key will produce readable English text. So, the solver tries to find the key that produces the most English-like output.\n\nOne way to score how English-like something is to look at letter frequencies. In English, certain letters appear more often than others, like E or T. A decryption that has the same frequency distribution as natural English should score higher than one that doesn't. However, this simple method isn't enough. A decryption that's mostly right can score almost as well as the true plaintext if only a few letters are wrong.\n\nTo improve upon this, the solver uses something called n-grams. Instead of just looking at individual letters, it scores sequences of letters. English has certain patterns of letters that occur more often than others, like \"TH\" or \"HE\". Rare letter pairs or triplets show up less often. By penalizing decryptions that contain these rare patterns, the solver can better distinguish between good and bad guesses.\n\nFor monoalphabetic substitution ciphers, the solver first tries frequency analysis. It looks at the most common letters in the ciphertext and maps them to the most common letters in English, like E or T. This usually gets the decryption to about 30% correct. Then, the solver uses a technique called simulated annealing. It randomly swaps two letters in the key and checks if the score improved. If it did, the swap is kept. This process repeats, allowing the solver to escape local optima and find the best key.\n\nFor Vigenère ciphers with a keyword, the solver needs to find the length of the keyword. It does this using methods like the Kasiski examination or the Index of Coincidence. Once the length is known, the ciphertext is split into columns, each of which is a Caesar cipher. The solver can then crack each column independently by looking for the most likely shift.\n\nWhen automatic solvers struggle, it's often because the ciphertext is too short, not really English, or the solver is using a weak fitness function. To improve results, make sure you have enough ciphertext, use language-specific n-gram models, and check if the ciphertext is actually a monoalphabetic substitution or Vigenère cipher.",
  "summary": "You've figured out which cipher you're staring at — say a monoalphabetic cryptogram, or a Vigenère — but you don't have the key. No keyword, no shift, no crib. Manually, this is where people grind for hours. Automatically, a good solver recovers it in about a second. Here's how that actually works, so the tool isn't a black box. The whole game rests on one idea: you don't search for the key, you…",
  "key_points": [
    "Cipher solvers identify cipher type without key information",
    "Solvers score English-like decryption using letter frequencies and n-grams",
    "Monoalphabetic solvers use frequency analysis, simulated annealing"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}