← ACARA Digital Technologies Years 9–10

Breaking a Caesar cipher by trying every shift

Trying every possible key, such as all 25 Caesar shifts, then choosing the result that reads as sensible text. A short key leaves few shifts to try, so the cipher is weak.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 108, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 13, WA Computer Science ATAR Year 11 — Cyber Security — Module 69

Understanding Breaking a Caesar cipher by trying every shift in ACARA Digital Technologies Years 9–10

What it does: The loop covers all 25 keys, which is the whole key space of a Caesar cipher. Printing the shift beside each attempt lets the attacker see which one is readable and so find the key. A Caesar key is a shift from 1 to 25 (shift 0 or 26 changes nothing), so there are only 25 keys to try. A brute-force attack tries every key, then you pick the output that reads as sensible text. With so few keys, a computer (or even a person) can try them all in seconds. Gibberish means the shift is wrong, so move on to the next shift in the list.

Common mistakes: The loop prints the original ciphertext c every time, so the student never sees the 25 decrypted attempts. It should print p, the decrypted text, so they can spot the readable one. The arguments are the wrong way round. decrypt expects the ciphertext first and the shift second, so it should be decrypt(text, key).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Breaking a Caesar cipher by trying every shift to a class →

This module's key terms are also in a printable crossword (Modules 828–859) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
How many shifts must you try to brute-force a Caesar cipher on the English alphabet?
25 shifts (1 to 25)Millions of shifts
Matches
for shift in range(1, 25):
↓
range(1, 25) stops at 24, so shift 25 is never tried and the correct key could be missed.
Applying
Meanings
Term
brute-force attack
Meaning
Trying every possible key, such as all 25 Caesar shifts, then choosing the result that reads as sensible text. A short key leaves few shifts to try, so the cipher is weak.
Practice
cipher = "KHOOR"
Testing
Gaps
for shift in (1, 26):
Check Answer
Spots
3 p = decrypt(c, key)
4 print(key, c)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Peregrine Falcon' badge — Operator Ace, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. How many shifts must you try to brute-force a Caesar cipher on the English alphabet?
A. 25 shifts (1 to 25) ✓
B. Millions of shifts
A Caesar key is a shift from 1 to 25 (shift 0 or 26 changes nothing), so there are only 25 keys to try.
2. Which result tells you that you have found the correct shift?
A. The text is the longest one
B. The text reads as sensible English ✓
A brute-force attack tries every key, then you pick the output that reads as sensible text.
3. A brute-force attack on a Caesar cipher uses which approach?
A. Guess one shift and give up
B. Decrypt with every possible shift ✓
Brute force means trying every possible key, not relying on a single lucky guess.
4. Why is a Caesar cipher weak against brute force?
A. It has a very short key space of only 25 keys ✓
B. It has far too many keys to check
With so few keys, a computer (or even a person) can try them all in seconds.
5. You try shift 3 and get 'XQDOJ TKHL'. What do you do next?
A. Reject it as gibberish and try shift 4 ✓
B. Accept it as the answer
Gibberish means the shift is wrong, so move on to the next shift in the list.

Match the Pairs

for shift in range(1, 26): → Loops through all 25 possible Caesar shifts so each one can be tried on the ciphertext
print(shift, decrypt(cipher, shift)) → Shows each shift next to its decrypted text so a person can spot which one reads as sensible
A brute-force attack tries every possible Caesar shift, from 1 to 25 → for shift in range(1, 26):
The attacker picks the shift whose result reads as sensible text, such as real English words → print(shift, decrypt(cipher, shift))
for shift in range(1, 25): → range(1, 25) stops at 24, so shift 25 is never tried and the correct key could be missed.
print(decrypt(cipher, shift)) → The shift is not printed, so the attacker cannot tell which key produced the readable text.

Key Term

brute-force attack
Trying every possible key, such as all 25 Caesar shifts, then choosing the result that reads as sensible text. A short key leaves few shifts to try, so the cipher is weak.

Fill in the Blanks

1. for shift in range(1, 26): print(shift)
Hint: Type the built-in function that generates the sequence of shift numbers to try.
2. for shift in range(1, 26): guess = decrypt(text, shift) print(shift, guess)
Hint: Type the stop value. The loop stops before it, so it must be one more than the last shift to try.
3. shifts = list(range(1, 26)) print(len(shifts))
Hint: Type the function that counts the items in a list, showing how few keys a Caesar cipher has.
4. if "THE" in guess: print(shift, guess)
Hint: Type the operator that checks whether a word appears inside the decrypted text, to spot readable text.
5. new = chr((ord(c) - 65 - shift) % 26 + 65)
Hint: Type the operator that wraps the shifted letter number back around the 26-letter alphabet.

Spot the Error

Question 1
A c = "KHOOR"
B for key in range(1, 26):
C p = decrypt(c, key)
D print(key, c)
Line D — The loop prints the original ciphertext c every time, so the student never sees the 25 decrypted attempts. It should print p, the decrypted text, so they can spot the readable one.
Question 2
A text = "WKLV"
B for key in range(1, 26):
C p = decrypt(key, text)
D print(key, p)
Line C — The arguments are the wrong way round. decrypt expects the ciphertext first and the shift second, so it should be decrypt(text, key).
Question 3
A msg = "ZRUOG"
B for k in range(1, 25):
C guess = decrypt(msg, k)
D print(k, guess)
Line B — range(1, 25) stops at 24, so shift 25 is never tried. A brute-force attack must try every shift from 1 to 25, so it should be range(1, 26).
Question 4
A def shift_back(ch, k):
B n = ord(ch) - 65
C n = (n - k) % 25
D return chr(n + 65)
Line C — The alphabet has 26 letters, so the wrap-around must use MOD 26. Using % 25 gives the wrong letters, so the right shift would never show readable text. It should be % 26.
Question 5
A c = KHOOR
B for k in range(1, 26):
C print(k, decrypt(c, k))
Line A — The ciphertext is text, so it needs quotes. Without them Python treats KHOOR as a variable name and gives an error. It should be c = "KHOOR".

Student with a class code? Join your class →