Introduction
Letter frequency analysis is the oldest cryptanalytic technique in recorded history. By counting how often each letter appears in a text sample, you can identify the statistical fingerprint of a language. In English, E appears about 12.7% of the time while Z appears in less than 0.1% of typical text. These patterns break monoalphabetic substitution ciphers and identify authorship. This tool goes beyond single-letter counts: it also computes bigram (letter-pair) and trigram (three-letter) frequencies, which expose common English sequences like TH, HE, IN, THE, AND, and ING. Paste your text below to see the distribution instantly. All analysis runs in your browser.
What this tool does
- Counts single-letter frequencies and displays them as counts and percentages, sorted from most to least common.
- Computes bigram (two-letter) frequencies to reveal common English digraphs like TH, HE, IN, ER, and AN.
- Computes trigram (three-letter) frequencies to expose common sequences like THE, AND, ING, ION, and ENT.
- Switches between single-letter, bigram, and trigram modes with a single click.
- Updates instantly as you type and processes everything client-side with no network requests.
How this tool works
The tool processes your input text in three modes. In single-letter mode, it counts each alphabetic character (case-insensitive) and calculates both raw counts and percentages. In bigram mode, it slides a two-character window across the cleaned text and counts each pair. In trigram mode, it uses a three-character window. Results are sorted by count, showing the top 50 n-grams for bigram and trigram modes. Non-alphabetic characters are stripped before n-gram extraction so that punctuation and whitespace do not fragment the sequences. All computation happens locally in your browser.
How letter frequency analysis works
Letter frequency analysis is the technique of counting how often each letter (or letter sequence) appears in a text sample and using the resulting distribution to infer linguistic structure or break substitution ciphers. It is the oldest documented cryptanalytic method in history.
Origin: The Arab polymath Abu Yusuf al-Kindi described frequency analysis in his *Risalah fi Istikhraj al-Mu'amma* ("A Manuscript on Deciphering Cryptographic Messages"), written around 850 CE. He observed that every language has a characteristic letter distribution, and that a monoalphabetic substitution cipher preserves those relative frequencies in the ciphertext.
Standard English letter frequencies (Lewand, 2000 — 40,000 word corpus):
| Rank | Letter | Frequency | Rank | Letter | Frequency | |---|---|---|---|---|---| | 1 | E | 12.70% | 14 | D | 4.25% | | 2 | T | 9.06% | 15 | L | 4.03% | | 3 | A | 8.17% | 16 | C | 2.78% | | 4 | O | 7.51% | 17 | U | 2.76% | | 5 | I | 6.97% | 18 | M | 2.41% | | 6 | N | 6.75% | 19 | W | 2.36% | | 7 | S | 6.33% | 20 | F | 2.23% | | 8 | H | 6.09% | 21 | G | 2.02% | | 9 | R | 5.99% | 22 | Y | 1.97% | | 10 | D | 4.25% | 23 | P | 1.93% | | 11 | L | 4.03% | 24 | B | 1.49% | | 12 | C | 2.78% | 25 | V | 0.98% | | 13 | U | 2.76% | 26 | K,X,J,Z | <0.15% each |
N-gram analysis: Single-letter frequencies break monoalphabetic ciphers, but polyalphabetic ciphers like Vigenere flatten the single-letter distribution. Bigram and trigram frequencies provide additional signal. The most common English bigrams are TH (2.7%), HE (2.3%), IN (2.0%), ER (1.9%), and AN (1.7%). The most common trigrams are THE (1.8%), AND (0.7%), ING (0.7%), ION (0.5%), and ENT (0.4%). These n-gram distributions survive simple transposition ciphers and can help identify the language of an unknown text.
Index of Coincidence: Beyond frequency counts, the Index of Coincidence (IC) measures the probability that two randomly chosen letters from a text are identical: IC = Σ(n_i × (n_i − 1)) / (N × (N − 1)). English plaintext has IC ≈ 0.065. A uniformly random distribution yields IC ≈ 0.038. A Caesar cipher preserves IC ≈ 0.065 because it is monoalphabetic. A Vigenere cipher with key length *k* produces IC closer to 0.038. Use the Index of Coincidence tool for that calculation.
How to use this tool
- Paste or type your text into the input field. Any length from a few words to full documents works.
- Select the analysis mode: Single Letter, Bigrams, or Trigrams.
- Review the frequency table showing counts and percentages, sorted from most to least common.
- For bigrams and trigrams, the top 50 sequences are displayed. Compare them against known English distributions.
- Use the results to identify substitution cipher mappings, language patterns, or unusual text characteristics.
Real-world examples
Breaking a monoalphabetic substitution cipher
A CTF player intercepts a ciphertext where single-letter frequency shows X at 12.8%, suggesting X maps to E. Switching to bigram mode reveals XD is the most common pair, matching TH. Trigram mode shows XDL as the top trigram, matching THE. These three data points alone resolve most of the substitution alphabet without guessing.
Identifying polyalphabetic vs monoalphabetic ciphers
A student analyzes a ciphertext with single-letter mode and finds a nearly flat distribution (all letters near 3.8%). This points to a polyalphabetic cipher like Vigenere. Switching to trigram mode still reveals some repeated sequences at positions consistent with the key length, which the student then confirms using the Kasiski Examination tool.
Language identification
A researcher has a text in an unknown European language. Single-letter frequencies show E, A, and I as the top three letters, and bigram analysis reveals CH and HE as common pairs. This pattern matches Italian, where E appears at 11.8% and bigrams like CH and HE are frequent. The researcher confirms by checking for the trigram CHE, which is the most common Italian trigram.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Single-letter frequency | Low | Breaking monoalphabetic substitution ciphers, language identification |
| Bigram frequency | Medium | Identifying common digraphs, cross-checking substitution guesses |
| Trigram frequency | Medium | Finding common word fragments like THE, AND, ING |
| Index of Coincidence | Medium | Distinguishing monoalphabetic from polyalphabetic ciphers |
Limitations or considerations
Single-letter frequency analysis works reliably on monoalphabetic substitution ciphers but is less effective against polyalphabetic ciphers like Vigenere, which flatten the distribution. Short texts (under 200 characters) may not show reliable frequency patterns due to sample size. Bigram and trigram analysis requires even more text to produce stable distributions. The method assumes standard English text; specialized vocabulary, poetry, or non-English languages have different frequency baselines. N-gram analysis can suggest likely substitutions but cannot provide certainty without additional context. For polyalphabetic ciphers, combine this tool with the Kasiski Examination and Friedman Test tools.
Frequently asked questions
What are the most common letters in English?
E (12.7%), T (9.1%), A (8.2%), O (7.5%), I (7.0%), N (6.7%), S (6.3%), H (6.1%), R (6.0%), and D (4.3%). These percentages come from a 40,000-word corpus compiled by Lewand in 2000.
What are the most common bigrams in English?
TH (2.7%), HE (2.3%), IN (2.0%), ER (1.9%), AN (1.7%), RE (1.5%), and ON (1.4%). Bigram frequencies are useful for confirming single-letter guesses in substitution cipher solving.
What are the most common trigrams in English?
THE (1.8%), AND (0.7%), ING (0.7%), ION (0.5%), ENT (0.4%), and HER (0.4%). Trigrams like THE are especially useful because they identify a complete common word, not just a letter pair.
How much text do I need for reliable n-gram analysis?
Single-letter analysis needs about 200 to 300 characters for rough patterns and 1000+ for reliable ones. Bigram analysis needs at least 500 characters. Trigram analysis needs 1000+ characters to produce stable distributions.
Can frequency analysis break any cipher?
Single-letter frequency analysis breaks monoalphabetic substitution ciphers. Polyalphabetic ciphers like Vigenere require combining frequency analysis with key-length detection (Kasiski, Friedman). Modern encryption like AES is completely immune to frequency analysis.
Conclusion
Frequency analysis, from single letters to trigrams, is the foundation of classical cryptanalysis. This tool handles all three modes in a single interface so you can move between them as you work. For the next steps in breaking polyalphabetic ciphers, use the Kasiski Examination tool to find the key length, then the Vigenere Cracker to recover the key. For a guided approach to solving substitution ciphers with both frequency and word-pattern matching, try the Cryptogram Solver.