← ACARA Digital Technologies Years 7–8

Breaking a Caesar cipher by trying every shift

Trying every possible key, such as all 25 Caesar shifts, until readable text appears. A cipher with so few keys is weak because an attacker can check them all quickly.

Part of: ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 56

Understanding Breaking a Caesar cipher by trying every shift in ACARA Digital Technologies Years 7–8

What it does: The tiny number of keys is the weakness. Checking 25 shifts takes a computer almost no time. Printing each shift next to its decrypted text lets the attacker scan for the one that makes sense. A Caesar cipher only has 25 useful shifts (1 to 25). Shift 0 or 26 leaves the message unchanged. That is a very small number to check. This is called brute force. The attacker keeps trying shifts until one gives real words. Gibberish means the shift is wrong. The attacker moves on to shift 8, then 9, and so on. Spotting real words like 'MEET AT THE OVAL' shows the correct shift was found.

Common mistakes: range(1, 25) stops at 24, so shift 25 is never tested. To try every Caesar key the loop must be range(1, 26). This prints the original ciphertext every time, so the attacker never sees the decrypted attempt. It should print k and plain.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Breaking a Caesar cipher by trying every shift to a class →

This module's key terms are also in a printable crossword (Modules 674–695) and word search (Modules 635–695).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
How many different shifts could an attacker need to try to break a Caesar cipher?
Millions25
Matches
for shift in range(1, 25):
↓
range(1, 25) stops at 24, so shift 25 is never tested and the correct key could be missed.
Applying
Meanings
Term
brute force
Meaning
Trying every possible key, such as all 25 Caesar shifts, until readable text appears. A cipher with so few keys is weak because an attacker can check them all quickly.
Practice
cipher = "KHOOR"
Testing
Gaps
for shift in range(1, ):
Check Answer
Spots
1text = "KHOOR"
2for k in range(1, 25):

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Peregrine Falcon' badge — Operator Ace, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. How many different shifts could an attacker need to try to break a Caesar cipher?
A. Millions
B. 25 ✓
A Caesar cipher only has 25 useful shifts (1 to 25). Shift 0 or 26 leaves the message unchanged. That is a very small number to check.
2. Which method breaks a Caesar cipher without knowing the key?
A. Try every shift from 1 to 25 until the text is readable ✓
B. Guess one shift and give up if it fails
This is called brute force. The attacker keeps trying shifts until one gives real words.
3. The attacker decrypts ciphertext with shift 7 and gets 'XQZ PLW BTR'. What should they do?
A. Try the next shift, because the text is not readable ✓
B. Stop, because shift 7 must be the key
Gibberish means the shift is wrong. The attacker moves on to shift 8, then 9, and so on.
4. How does an attacker know they have found the right shift?
A. The result turns into readable words ✓
B. The result turns into a longer message
Spotting real words like 'MEET AT THE OVAL' shows the correct shift was found.
5. Why is having only 25 possible keys a weakness?
A. The message becomes too long to send
B. An attacker can check every key quickly ✓
With so few keys, a person can try them all by hand in minutes. A computer can do it in a blink.

Match the Pairs

for shift in range(1, 26): → Loops through every possible Caesar shift from 1 to 25 so each one can be tested
if "THE" in guess: → Checks whether a decrypted guess contains a real word, which suggests the shift was correct
A Caesar cipher has only 25 possible keys, so an attacker can test them all → total_keys = 25
Brute force means trying every shift and printing each result to look for readable text → print(shift, decrypt(text, shift))
for shift in range(1, 25): → range(1, 25) stops at 24, so shift 25 is never tested and the correct key could be missed.
Only try shift 3, because that is the common one. → Brute force means trying every shift, not guessing one. The real key could be any number from 1 to 25.

Key Term

brute force
Trying every possible key, such as all 25 Caesar shifts, until readable text appears. A cipher with so few keys is weak because an attacker can check them all quickly.

Fill in the Blanks

1. for shift in range(1, 26): print(shift)
Hint: Type the number where the loop stops so that the last shift tried is 25.
2. for shift in range(1, 26): print(shift)
Hint: Type the keyword that starts a loop so every shift gets tried in turn.
3. for shift in range(1, 26): print(shift, decrypt("KHOOR", shift))
Hint: Type the loop variable that holds the shift being tested each time round.
4. plain = decrypt(text, shift) if "the" in plain: print("Found it!", shift)
Hint: Type the keyword that checks whether a readable word appears inside the text.
5. keys = list(range(1, 26)) print(len(keys))
Hint: Type the built-in function that counts how many keys are in the list, showing how few an attacker must try.

Spot the Error

Question 1
A text = "KHOOR"
B for k in range(1, 25):
C print(k, shift(text, -k))
Line B — range(1, 25) stops at 24, so shift 25 is never tested. To try every Caesar key the loop must be range(1, 26).
Question 2
A text = "KHOOR"
B for k in range(1, 26):
C plain = decrypt(text, k)
D print(k, text)
Line D — This prints the original ciphertext every time, so the attacker never sees the decrypted attempt. It should print k and plain.
Question 3
A shifts = list(range(1, 26))
B count = len(shifts) + 1
C print(count, "keys to try")
Line B — A Caesar cipher has only 25 keys, and len(shifts) is already 25. Adding 1 gives 26, which is wrong. It should be count = len(shifts).
Question 4
A for k in range(1, 26):
B guess = decrypt(text, k)
C if "THE" in text:
D print("Found key", k)
Line C — This checks the original ciphertext, which never changes, so it can never spot readable text. It must check the decrypted guess: if "THE" in guess.
Question 5
A total_keys = 26
B tried = 10
C left = total_keys - tried
D print(left, "shifts left")
Line A — A Caesar cipher has 25 useful keys. A shift of 26 returns the original letters, so it is not a real key. It should be total_keys = 25.

Student with a class code? Join your class →