← ACARA Digital Technologies Years 7–8

Frequency analysis of ciphertext

Counting how often each letter appears in ciphertext. The most common letter probably stands for E, so an attacker can work out the key.

Part of: ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 57

Understanding Frequency analysis of ciphertext in ACARA Digital Technologies Years 7–8

What it does: Counting letter frequencies is the first step of frequency analysis. It gives a tally that can be compared with English. E is the most common letter in English, so the most common ciphertext letter probably stands for E. E appears more often than any other letter in typical English text. Q is one of the rarest. If plaintext E was shifted to H, you move forward 3 letters (E, F, G, H). So the key is 3. Longer messages give more letters to count. The pattern of common letters shows up clearly, so the guess is more reliable. Once the attacker guesses E, they can work out the shift and test it. If the result is readable English, the guess was right.

Common mistakes: Counting letter frequencies means adding 1 to a letter's count each time it appears. It should be += 1, not -= 1. The attacker wants the most common ciphertext letter, because it probably stands for E. It should be max count, not min count.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Frequency analysis of ciphertext to a class →

This module's key terms are also in a printable crossword (Modules 674–695) and word search (Modules 635–695).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An attacker counts the letters in a Caesar cipher message. Which letter is most common in the ciphertext?
The letter that always stands for ZThe letter that probably stands for E
Matches
Most common ciphertext letter = Z, so Z must be E
↓
The attacker assumed the most common ciphertext letter is always Z. Frequency analysis only says the most common ciphertext letter probably stands for E, whatever that ciphertext letter is.
Applying
Meanings
Term
frequency analysis
Meaning
Counting how often each letter appears in ciphertext. The most common letter probably stands for E, so an attacker can work out the key.
Practice
counts ← list of 26 zeros
Testing
Gaps
for letter in :
Check Answer
Spots
2FOR each letter in ciphertext
3 counts[letter] -= 1

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Fox' badge — Tundra Tracker, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An attacker counts the letters in a Caesar cipher message. Which letter is most common in the ciphertext?
A. The letter that probably stands for E ✓
B. The letter that always stands for Z
E is the most common letter in English, so the most common ciphertext letter probably stands for E.
2. Which is the best description of frequency analysis?
A. Changing every letter to the next letter in the alphabet
B. Counting how often each letter appears in ciphertext ✓
Frequency analysis is a counting method. It does not change the message. It helps an attacker guess the key.
3. In English, which letter is usually the most common?
A. E ✓
B. Q
E appears more often than any other letter in typical English text. Q is one of the rarest.
4. The most common ciphertext letter in a Caesar message is H. What is a good first guess for the shift?
A. E became H, so the shift is 3 ✓
B. H became E, so the shift is 8
If plaintext E was shifted to H, you move forward 3 letters (E, F, G, H). So the key is 3.
5. Which message is easier to crack with frequency analysis?
A. A short message with only five letters
B. A long message with hundreds of letters ✓
Longer messages give more letters to count. The pattern of common letters shows up clearly, so the guess is more reliable.

Match the Pairs

frequency analysis → Counting how often each letter appears in ciphertext to guess which letters stand for common plaintext letters
most common ciphertext letter = E? → A good first guess is that the most common ciphertext letter stands for E, the most common English letter
An attacker counts the letters in a ciphertext to see which one appears most often → count(letter) for each letter A to Z
If X is the most common ciphertext letter and it stands for E, the Caesar shift can be worked out → shift = X - E = 23 - 5 = 18
Most common ciphertext letter = Z, so Z must be E → The attacker assumed the most common ciphertext letter is always Z. Frequency analysis only says the most common ciphertext letter probably stands for E, whatever that ciphertext letter is.
Short message: HI. Frequency analysis always works perfectly → Frequency analysis needs enough text. A very short message does not have enough letters for the counts to match normal English, so the guess can be wrong.

Key Term

frequency analysis
Counting how often each letter appears in ciphertext. The most common letter probably stands for E, so an attacker can work out the key.

Fill in the Blanks

1. for letter in ciphertext: counts[letter] += 1
Hint: Type the variable that holds the encrypted message whose letters are being counted.
2. top = max(counts, key=counts.get)
Hint: Type the built-in function that finds the largest value, so we can spot the most frequent letter.
3. shift = ord(top) - ord("E")
Hint: Type the capital letter that is the most common in English text, which the top ciphertext letter probably stands for.
4. if len(ciphertext) > 100: print("Frequency analysis works well")
Hint: Type the comparison operator meaning 'greater than', because longer messages are easier to crack.
5. total = len(ciphertext) percent = count / total * 100
Hint: Type the variable that holds the number of letters in the whole message.

Spot the Error

Question 1
A counts ← empty table
B FOR each letter in ciphertext
C counts[letter] -= 1
Line C — Counting letter frequencies means adding 1 to a letter's count each time it appears. It should be += 1, not -= 1.
Question 2
A ciphertext ← 'KHOOR'
B counts ← count letters
C top ← letter with min count
Line C — The attacker wants the most common ciphertext letter, because it probably stands for E. It should be max count, not min count.
Question 3
A top ← 'X'
B common ← 'E'
C shift ← top + common
Line C — The key is the distance from E to the top ciphertext letter, so you subtract. It should be top - common, not top + common.
Question 4
A counts ← count letters
B top ← most common letter
C shift ← top - 'E'
D PRINT encrypt(text, shift)
Line D — After finding the key, the attacker decrypts the message to read it. It should be decrypt, not encrypt.
Question 5
A IF message is long
B attack is harder
C ELSE attack is harder
Line B — Longer messages give more letters to count, so the frequencies are closer to normal English and the attack is easier. It should be 'attack is easier'.

Student with a class code? Join your class →