Classic Ciphers

Classic ciphers are old letter-shuffling methods. They are weak by modern standards, which is why they still appear in beginner challenges. The skill is spotting what kind of text you have before you start shifting letters.

Core idea

You usually do not know the original text, so you cannot prove what "survived." Start with the structure still visible in the ciphertext:

The first input is a classic-cipher candidate because a letter-only transformation could leave those word boundaries and repeated patterns in place. The other two should be classified as representations before you start shifting letters.

Caesar cipher

Each letter is shifted by a fixed number of alphabet positions. The alphabet wraps around after Z.

Apply the same shift to every letter:

The encrypted text is IODJ. To decrypt it, shift every letter back by 3.

There are 25 non-identity shifts, so trying all of them is reasonable. Spaces and punctuation usually stay put, which is a clue: the transformation is acting on letters, not on the whole file.

On this platform, flags look like bitctf{{...}}. If a shift produces that prefix, treat it as a strong candidate and read the whole result.

Caesar clues

• The ciphertext is mostly letters.
• Spaces, punctuation, digits, and braces remain in their original positions.
• Repeated ciphertext words could represent repeated plaintext words.
• A challenge may mention rotation, shifting, an alphabet, or ROT followed by a number.

ROT13 is Caesar with a shift of 13. ROT5, ROT7, and similar names use the number as the shift. If the challenge does not give the shift, do not try to infer it from one character: test all 25 possibilities and read the results.

Try every shift

import string

ciphertext = "ovgpgs{{ebgngr_gur_nycunorg}}"

for shift in range(1, 26):
    source = string.ascii_lowercase
    target = source[-shift:] + source[:-shift]
    plaintext = ciphertext.translate(str.maketrans(source, target))
    print(f"ROT {shift:2}: {plaintext}")

const ciphertext = "ovgpgs{{ebgngr_gur_nycunorg}}";
const alphabet = "abcdefghijklmnopqrstuvwxyz";

for (let shift = 1; shift < 26; shift += 1) {
  const plaintext = [...ciphertext].map(character => {
    const index = alphabet.indexOf(character);
    return index === -1
      ? character
      : alphabet[(index - shift + 26) % 26];
  }).join("");

  console.log(`ROT ${shift}: ${plaintext}`);
}

In CyberChef, use ROT13 when the shift is known to be 13 or ROT13 Brute Force to display every rotation. dCode's Caesar tool is another quick way to compare all shifts.

Read the full candidates. A familiar prefix is useful evidence, but the rest of the plaintext should also make sense.

Simple substitution

Each letter maps to another letter, but not by a single shift. The search space is far too big to brute-force by hand. Instead use what survived: repeated words, likely short words (A, I, THE), and letter frequency.

Caesar is a special case of substitution. If a uniform shift works, you do not need the harder method.

Word-shape example

A substitution changes the letters but preserves their pattern:

These patterns do not reveal the answer by themselves. They let you test guesses without losing track of which letters must map consistently.

What to look for

• Letters with spaces preserved — try Caesar first. If that fails, the same spacing still helps a substitution argument.
• Letters with no spaces — still try Caesar, but you have fewer word clues.
• Flag-shaped prefixes — use them as a check, not as the only plan.

Classic cipher overview

This course focuses on Caesar and simple substitution. The other rows are recognition clues: use them when the challenge gives you a matching hint, not simply because Caesar failed.

Worked example

A challenge gives you:

ovgpgs{{ebgngr_gur_nycunorg}}

Work through the evidence in order:

1. The text contains only letters and flag punctuation. The braces and underscores stayed in place, so a letter-only cipher is more likely than Base64 or hex.
2. Try all 25 Caesar shifts.
3. ROT13 produces:

bitctf{{rotate_the_alphabet}}

The prefix and the readable phrase agree, so ROT13 is the answer. If no shift produced coherent text, the next reasonable test would be simple substitution rather than more Caesar guessing.

Common mistakes

• Brute-forcing every alphabetic value without first checking whether spaces and repeated patterns survived.
• Accepting the first readable-looking Caesar result without reading the whole plaintext.
• Assuming that Caesar failing proves simple substitution. Recheck the input and challenge clues before changing families.

Important notes

Classic ciphers are not acceptable protection for real data. In challenges the plaintext is often English or a flag. If none of the Caesar shifts is coherent, revisit the evidence before choosing another cipher family.

Self-check

Text A

WKH FOXH LV WKH ZRUG

Text B

VGhpcyBpcyBCYXNlNjQ=

Which one is a Caesar candidate, and what should you do with the other?

Answer: Text A. Its spaces survived and WKH repeats, which are useful Caesar or substitution clues. Text B is Base64-shaped; decode it before you start shifting letters.

Next

Indy's Scroll