Posted on Leave a comment

Breaking Letter Substitution codes

A Letter Substitution Cipher replaces the letters in the alphabet with symbols or another random letter.

An example of a letter substitution cipher can be seen below, and we are going to solve it!

Cipher 1

Now there are 2 facts about the English language which will help considerably when solving a Cipher.
1 – The most common letter in the English language is E
2 – The most common 3 letter words are ANDTHE

Using the first fact have a look at the cipher above and see what the most common letter here is used?

Cipher 2

We can see that F is the most common Cipher letter, let us initially presume that F equals (This isn’t always the case, so you may need to try other common letters if you find it doesn’t work)…

Cipher 3

Then let’s use this information on the second fact (The most common 3 letter words in the English language are both ANDTHE)

I’ve highlighted below where 3 letters are repeated (MKe is repeated twice and so is ZVC)

Cipher 4

We can make a guess that the MKe one is ‘the‘ and we could also try replacing ZVC with the word ‘and‘.

Cipher 5

and we can now fill in the newly discovered letters and replace all the Z V and C‘s with a, n & d‘s (As per our guess that ZVC is actually the word ‘and‘), and replace all the M & K‘s with t‘s and h‘s (As per our guess that MKe is actually the word ‘the’)

Your Cipher should now look like the below image.

Cipher 6

Now I would say that the assumptions we have made earlier, have come to be true, as this is starting to look like English.
We still have a while to go but we are on the right track, so lets continue!

Now here comes the fun part. We have to study the Cipher and make assumptions.

The easiest one to guess is the Cipher letter that is on its own ‘E

Letters that are usually words on their own are A‘s and I‘s as in ‘I am going to the shops for A drink…’
We can rule out A on the basis that it has been used within the word AND. So we can guess E is actually I
Also we can see there are two 3 letter words ending in ‘he‘ – these are most likely either ‘the‘ or ‘she‘ and seen as we have used ‘the‘ earlier, we can assume it’s ‘she
also we have a 2 letter word beginning with ‘t‘ which is definitely going to be ‘to

Cipher 9
So, lets start replacing those highlighted letters…

Cipher 10

And then we can go through the Cipher replacing the letters with the newly found ones, as below…

Cipher 11

Now we can study and make assumptions, focusing on certain letters which look easy to solve…

Cipher 12

Cipher 13

Focus and assume

Cipher 15Cipher 16

Now we can guess the sentence based on the context…

Cipher 17


Congratulations, you have solved your first Cipher! It wasn’t that difficult was it?

Cipher 18


Posted on Leave a comment

Knock Code

Knock Codes, sometimes called Tap Code come up intermittently in our Cosykiller boxes.

The example below is a telegram written with a classic Knock Code cipher. (We used this on a cruise we did in 2018).

Knock Code ciphers encode messages using just 10 letters rather than the usual 26, which makes them quite easy to spot. If you find a message using just 10 letters, then the chances are it’s a knock code cipher created using a Polybius Square.

Polybius Square sounds super impressive, but in actuality it’s just a 5 x 5 square with the letters of the alphabet placed within it.  Some cryptographers use C/K in the same square, others use I/J in the same square.  It depends on the encoder as to their preference, whether it be phonetic, or visual.

The above shows a typical Polybius square.  It’s created by the five letter words Mango and Fruit.

To code your message, you would replace the letter you want within the grid, with the pair of letters on the XY axis.   e.g. If you wanted to encode the letter A, your code would be MF, if you wanted to encode the letter S your letter pair would be GU.  Decoding would be the same process in reverse.


It IS possible to decode Knock Codes without creating the square, though you’ll often find our 5 letter code words show up in other ways within the boxes to give you the code words.  Unfortunately this still won’t necessarily help you decode the messages until you know how the alphabet has been placed within the grid itself.  (And that’s something we don’t tell you – I know… we’re meanies).

Once you recognise the code however, all you need to do is solve it in the same way as a letter substitution code.

If the lettering confuses you, type it all into a word document and then use “find and replace” option and replace the two letter combinations with a symbol.


Letter substitution codes are hard if there are no gaps between words.

However we often use the knock code in telegrams as this gives you a hint on how to solve them.

In telegrams a full stop is transmitted using the word STOP which means if you find an 8 letter repeating section, the chances are the letters will be STOP.  This gives you 4 letters immediately.  After than you’re back to the usual method to decode substitution ciphers by looking at letter frequency and double letters.