---
{
  "title": "Frequency analysis",
  "summary": "Repeated patterns can reveal structure in classical ciphers.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    8
  ],
  "aliases": [],
  "sources": [
    {
      "title": "CrypTool project",
      "url": "https://www.cryptool.org/en/"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Frequency analysis examines how often symbols or patterns appear. It can help attack simple substitution systems because language has uneven letter and sequence frequencies. Results depend on message length and language, and short samples can be ambiguous. Modern encryption is designed to avoid useful plaintext patterns in ciphertext under its security assumptions. This method teaches the danger of information leakage rather than a universal way to break modern encryption.

## In practice

A long fictional substitution ciphertext contains a frequent symbol that may correspond to a common letter. The learner tests the hypothesis against larger word patterns.

## A common misunderstanding

The most common symbol is not guaranteed to represent the same letter in every language or message.

## Check your understanding

Why does sample length matter?

**Think it through:** Short messages may not reflect typical language frequencies and can support multiple explanations.

## Treat a frequent symbol as a hypothesis

A fictional substitution puzzle contains a long passage in one language. The learner counts symbols and notices that one appears much more often than the others. That observation suggests possible plaintext letters, but it does not prove a mapping. Test candidates against repeated word patterns and the rest of the passage.

Sample composition matters. A short slogan, a technical list, and ordinary prose can have very different distributions. Language, spelling conventions, and omitted spaces also affect the evidence. Avoid treating a familiar frequency chart as a universal answer key. The method is strongest when several independent patterns support the same interpretation.

Not every transformation preserves these patterns in the same way. A simple monoalphabetic substitution maintains a consistent mapping, while other historical systems can distribute one plaintext letter across multiple ciphertext symbols. Modern encryption uses different constructions and security goals; counting letters is not a general method for defeating it.

## Compare two synthetic samples

Create a long fictional paragraph and a very short sentence, transform both with the same simple substitution, and count symbols. Explain why the longer sample may provide more stable clues. Keep a record of alternative mappings instead of silently selecting the first readable fragment.

This exercise teaches evidence-based reasoning as much as historical cryptography. A plausible word can be a coincidence, and a hypothesis should explain more than one convenient observation. When presenting a result, state the assumptions about language and cipher type. The useful lesson for security is that systems can leak relationships even when individual values look unfamiliar, and that identifying such leakage requires careful interpretation rather than a single statistical shortcut.

## Keep exploring

- [[caesar-cipher]]
- [[cryptanalysis]]
- [[ecb-mode]]