Caesar Cipher
Caesar cipher encoder/decoder with custom shift. ROT13 preset. Brute force shows all 26 shifts with English-word scoring. A-Z or full ASCII. 100% offline.
About this tool
The classic Caesar shift cipher, in three modes. Encode mode takes your text and a shift (0-25) and outputs the cipher text. Decode mode takes cipher text and the matching shift and outputs plaintext. Brute Force mode shows all 26 possible shifts at once with a star marker on the shift that produces the most recognizable English words (scored by a small built-in common-words list), so you can crack a short Caesar ciphered text without knowing the key. The shift slider and number input are linked — drag one and the other updates. Four charset options: A-Z case-preserved (default — letters only, other characters kept as-is), a-z only, A-Z only, and printable ASCII (32-126, all 95 characters shift). Use ROT13 preset to instantly apply shift 13 (the most common Caesar variant). All processing is local; no network, no API.
Details
- Category
- text
- Version
- 1.0.0
- Size
- 14 KB
- Updated
- Jun 2026
Frequently Asked Questions
Is Caesar cipher actually secure?
No — it is one of the weakest classical ciphers. With only 25 possible keys, an attacker can try all of them in microseconds. This tool is for education, puzzles, and fun, not for protecting secrets. The brute force mode demonstrates this: it scores all 26 candidates and highlights the most likely plaintext. If you need real confidentiality, use AES-256 (a modern symmetric cipher) or X25519 + ChaCha20 (for key exchange + encryption). The Caesar cipher is historically interesting because it was used by Julius Caesar around 50 BC for military messages, and it illustrates the basic idea of substitution ciphers — every letter is replaced by another letter at a fixed offset.
What is ROT13?
ROT13 is Caesar cipher with shift 13. The special property of shift 13 is that applying it twice returns the original text: ROT13(ROT13(x)) = x. This is because the English alphabet has 26 letters and 13 is exactly half of 26, so each letter maps to the letter 13 positions away, and mapping 13 positions away from that letter brings you back to the start. ROT13 is widely used online to obscure spoilers, puzzle answers, NSFW content, and mildly offensive jokes — anyone who wants to read the text can apply ROT13 in their head (or with a tool like this) and the original content is hidden from casual scanning. It is not encryption because there is no key — the shift is always 13.
What does the brute force star marker mean?
The brute force mode runs all 26 shifts on your cipher text and scores each candidate plaintext by counting how many of the words match a small built-in list of ~100 common English words ("the", "and", "to", "of", "is", "are", etc.). The shift with the highest score gets a star marker. If your cipher text is short (under 30 characters) or contains mostly proper nouns / unusual words, the star may be wrong — common words are a heuristic, not a guarantee. Read each candidate by eye, and use the star as a hint, not a definitive answer. You can also use the copy button next to each candidate to grab that particular shift's output.
What charset should I pick?
Use "A-Z case-preserved" (default) for most English text. It shifts A→A+shift, B→B+shift, etc. while keeping the case of the original letter, and passes numbers, punctuation, and whitespace through unchanged. Use "a-z only" or "A-Z only" if you want strict single-case behavior (useful for some puzzle formats). Use "Printable ASCII (32-126)" if your text contains non-letter characters that you also want shifted — for example, if you have an obfuscated file path or a string of mixed letters and digits where you want everything shifted. Note that with the ASCII option, spaces and punctuation are also shifted, which can make the output harder to read.
Is my text private?
Yes. The cipher is pure client-side JavaScript inlined in the HTML. There are no network calls, no API uploads, no analytics, no CDN. Your plaintext, cipher text, and chosen shift stay in your browser. The copy button uses the standard browser clipboard API. Even the brute force scoring (which uses a small built-in word list) is fully local. You can encode or decode any text without any data being transmitted.