Academics · Middle School · Grades 6–8

Make a secret code.
Then learn how it breaks.

Five ciphers from two thousand years of secret writing, with the wheel, the alphabets and the zigzag in plain view. Write your own messages, then turn codebreaker for ten missions.

Open the cipher labWhat you get
5ciphers to write with
10missions to solve
336letters in the last one

The cipher lab

Pick a cipher, set its key and type. Load the example to see Caesar’s shift of three, or open Missions and start with number 1.

Loading the cipher lab. If nothing appears, turn on JavaScript.

Codemakers against codebreakers

Each cipher on the bench was the best of its day until someone found the pattern it left behind.

about 50 BC25possible keys

Caesar shifts by three

Julius Caesar wrote private letters with every letter moved three places along. Only 25 shifts exist, so trying them all breaks it.

about 8504 × 10²⁶alphabets, beaten by counting

Al-Kindi counts letters

A scholar in Baghdad writes down frequency analysis: the most common symbol probably stands for the most common letter. Every simple substitution falls.

1553 to 1863310years unbroken

One letter, many disguises

Bellaso’s keyword cipher, later named after Vigenère, hides the letter counts. It holds until Kasiski publishes a way to find the length of the key.

today10⁷⁷possible keys, and more

Too many keys to try

The AES cipher that guards web pages and phones can use a 256-bit key. Its design leaves no letter counts to study, and no practical shortcut is known.

What you get

Academics · Middle SchoolFree

What you finish with
Messages enciphered five ways, a working sense of why each cipher is weak, up to ten solved missions that end with a real frequency-analysis break, and a printed message card with a paper cipher slide.
Who it is for
Students in grades 6 to 8 in a cryptology elective, a math or history enrichment block or a club; teachers who want a ready 40-minute lab; families with a child who likes puzzles and codes.
Format
Browser lab with four panels: cipher bench, Codebreaker, missions and saved messages. Works on a phone and from the keyboard. Prints a message card; saves messages as a text file.
Access
Free. No account and no sign-in. Messages, guesses and answers are saved only in this browser; nothing typed is sent to Caveat or anywhere else.
Where it lives
The Middle School space in Caveat Academics.
Support
Questions, a correction or a request: team@caveatacademic.com.

How to use it

  1. On the cipher bench, pick a cipher, set the key and type a message. The picture beside it shows what the cipher is doing.
  2. Switch to Decode and paste a secret message to turn it back. Use as input moves a result back to the top.
  3. Open Missions. Each one opens on the bench or in the Codebreaker; send your result back and check it.
  4. Save messages you like, and print a message card with the paper slide for a friend to decode by hand.

Open the cipher lab

How the lab works

What gets enciphered, how the Codebreaker ranks its guesses, and what the missions are for.

How the lab works

  • Letters only. A to Z are enciphered and keep their capitals. Digits, punctuation and accented letters pass through unchanged. The rail fence is the exception: it moves every character, spaces included, so it can be undone exactly.
  • The best-fit shift is the one whose decoding has letter counts closest to typical English, measured with a chi-squared score. It is a guess from statistics, and mission 7 shows a message where it is wrong.
  • Guess by letter counts pairs the most common secret letter with E, the next with T, then A, O, I, N and so on. On a real message it gets a few right and the rest wrong, which is where the thinking starts.
  • Mission answers are compared letter by letter, ignoring spaces, capitals and punctuation. Every mission’s secret text is generated from its plain text when the page is built, then decoded again by the page’s own code in its tests.

For teachers and families

The missions take about 40 minutes and need no account. Missions 1 to 6 practise each cipher; 7 to 10 are about attacking them. Mission 10 is long on purpose: frequency analysis needs a few hundred letters.

Away from the screen, print a message card. The two strips at the bottom make a paper slide that works for Caesar and, one letter at a time, for Vigenère.

These ciphers are for learning how secrecy works and fails. None of them protects a real secret: use them for notes and puzzles, not for passwords or private information.

The ten missions

No.MissionCipherKeyWhat it shows
1Caesar’s own shiftCaesar wheelGivenCaesar’s cipher is two thousand years old. Its weakness: once you know the method, there are only 25 keys.
2The mirror alphabetAtbashNone neededA cipher with no key is only secret while the method is secret.
3No key givenCaesar wheelFind itTrying every key is called a brute-force attack. It works whenever the list of keys is short.
4A keyword alphabetKeyword alphabetGivenA mixed alphabet has about 403 septillion possible keys, far too many to try. It still breaks, as mission 10 shows.
5ZigzagRail fenceGivenA transposition cipher keeps the letter counts of plain English. That clue tells a codebreaker which kind of cipher it is.
6One letter, five disguisesVigenèreGivenBecause one letter can become several, simple letter counting stops working. For about three hundred years people called this cipher unbreakable.
7Too short to countCaesar wheelFind itCounting needs enough letters. With a short message full of rare letters, a person reading for sense beats the statistics.
8How many railsRail fenceFind itWhen the list of keys is short, try them all. Four rails was the only count that made words.
9A guessable keyVigenèreFind itThis is a dictionary attack: trying likely keys first. It is why a password should never be a word someone can guess.
10Break it by countingKeyword alphabetFind itYou did what Al-Kindi described around the year 850: frequency analysis. Modern ciphers are built so that letter counts reveal nothing.

Sources

  1. Suetonius, The Lives of the Caesars, Julius Caesar 56: Caesar’s letters written with each letter replaced by the one three places on.
  2. Al-Kindi, A Manuscript on Deciphering Cryptographic Messages (ninth century): the earliest known description of frequency analysis.
  3. Giovan Battista Bellaso, La cifra (1553), and Blaise de Vigenère, Traicté des chiffres (1586): the keyword cipher. Friedrich Kasiski, Die Geheimschriften und die Dechiffrir-Kunst (1863): finding the key length from repeated groups.
  4. Robert E. Lewand, Cryptological Mathematics (Mathematical Association of America, 2000): the table of typical English letter frequencies used for the ticks and the best-fit score.
  5. National Institute of Standards and Technology, FIPS 197, Advanced Encryption Standard (2001, updated 2023): key lengths of 128, 192 and 256 bits.
  6. Test vectors in the page’s checks: MEET ME AT NOON at shift 3; ATTACKATDAWN with the key LEMON; WE ARE DISCOVERED FLEE AT ONCE on 3 rails; the keyword alphabet ZEBRAS.

A teaching lab for classical ciphers. They are easy to break and must not be used to protect passwords or private information. The mission messages are original to Caveat. Support: team@caveatacademic.com.