Caesar's Secret: How Julius Caesar Encrypted His Army (And Why It Still Matters)

2026-04-20 · 13 min read

It is the spring of 54 BCE. A dispatch rider gallops up the gravel road toward the Roman camp at Alesia, his satchel bouncing against the flank of his horse. Inside is a single papyrus scroll. The legionary on watch passes it along without opening it; he wouldn't understand it if he did. The scroll reaches the praetorium — the commander's tent — and is handed, finally, to the only person in camp who knows how to read it.

The general unrolls the scroll. The letters march across the page in what looks, at first, like gibberish:

FDHVDU YHQLW XLGL YLFL

He takes a wax tablet, slides each letter back three places, and reads, in Latin:

CAESAR VENIT VIDI VICI

Caesar came, saw, conquered.

Julius Caesar did not invent the idea of writing in code. But he used it so consistently, and so effectively, that two thousand years later the technique still carries his name. The Caesar cipher is the most famous encryption method in history. It is also, by modern standards, laughably weak. That contradiction is the point.

What the Caesar cipher actually is

The method is simple enough to explain in one sentence: take every letter in your message and replace it with the letter three positions later in the alphabet. A becomes D. B becomes E. C becomes F. And so on. When you reach the end, you wrap around — X becomes A, Y becomes B, Z becomes C.

That's it. That's the whole thing.

Caesar shift wheel illustration — two concentric discs showing the alphabet offset by three positions

To decrypt a Caesar-ciphered message, you just do the reverse: shift every letter back three places. The shift value — the number 3, in Caesar's case — is what cryptographers today call the key. Whoever holds the key can read the message. Whoever doesn't holds a page of nonsense.

Try it yourself. Here's a short Latin phrase:

YHQL YLGL YLFL

Slide each letter back three places. (Remember: A comes after Z.) You'll end up with Caesar's famous boast after the Battle of Zela in 47 BCE: veni, vidi, vici — I came, I saw, I conquered.

What the Romans actually wrote

We know Caesar used this cipher because of a single sentence, written about 150 years after his death, by the Roman biographer Suetonius. In his Life of the Deified Julius, section 56, Suetonius describes the general's personal habits and mentions, almost in passing, that Caesar wrote confidential letters to his confidants:

...si qua occultius perferenda erant, per notas scripsit, id est sic structo litterarum ordine, ut nullum verbum effici posset: quae si qui investigare et persequi velit, quartam elementorum litteram, id est D pro A et perinde reliquas commutet.

...if there was anything confidential to say, he wrote it in cipher — that is, by so changing the order of the letters of the alphabet, that not a word could be made out. If anyone wishes to decipher these, and get at their meaning, he must substitute the fourth letter of the alphabet, namely D, for A, and so with the others.

Two details in that passage are worth noticing. First, Suetonius specifies the shift: A becomes D. (Counting in the Roman fashion, where you include the starting letter, that's a shift of "three" — which is why we remember it that way.) Second, he feels the need to explain the cipher to his readers. That tells us something: by the time Suetonius was writing in the early second century CE, the Caesar cipher was already old, already a bit of a historical curiosity. It was Caesar's personal signature.

Suetonius also tells us that Caesar's grand-nephew Augustus used a cipher of his own — but a lazier one. Augustus simply replaced each letter with the next letter (A → B, B → C), and at the end of the alphabet he wrote two letters of X instead of wrapping around to the start. Augustus was, apparently, not a details person.

Side-by-side illustration: Caesar's alphabet shift (by 3) vs. Augustus's alphabet shift (by 1)

Why did Caesar need a cipher at all?

To understand why a cipher — even a simple one — was useful in the first century BCE, you have to imagine the military reality of the late Roman Republic.

Caesar's armies fought in Gaul, Britain, Germany, Spain, North Africa, Greece, and Egypt. His legions marched across landscapes where messages traveled at the speed of a tired horse. A single dispatch rider might be out of contact with headquarters for days or weeks. If that rider was captured — by Gauls, by a rival Roman faction, by bandits, by an ambitious centurion — the contents of his satchel could cost a war.

Roman messengers were sometimes killed specifically so that the enemy could read what they carried. At the Battle of Carrhae in 53 BCE, the Parthians famously paraded a captured Roman eagle and captured correspondence as trophies. Caesar knew this. He was, before he was anything else, a supremely practical operator.

The Caesar cipher was not designed to resist a serious cryptanalyst. It was designed to defeat a captured rider — an enemy soldier, probably illiterate or literate only in a different language, who would open the scroll, see what looked like nonsense, and throw it away or hand it to someone equally unable to read it. Against that adversary, a simple shift of three letters was more than sufficient.

This is a crucial idea in the history of cryptography: a cipher only needs to be strong enough to defeat the attackers you actually face. Caesar's opponents were not professional codebreakers. Professional codebreaking, as a discipline, did not yet exist.

How Caesar's cipher works under the hood

Strip the romance away and Caesar's cipher is modular arithmetic. Number the letters of the alphabet from 0 to 25:

A=0, B=1, C=2, D=3, ..., X=23, Y=24, Z=25

To encrypt a letter, add the shift value (call it k) and take the remainder when you divide by 26:

encrypted = (plaintext + k) mod 26

To decrypt, you do the opposite:

plaintext = (ciphertext - k) mod 26

For Caesar's personal cipher, k = 3. For Augustus's, k = 1. For the modern internet joke cipher ROT13, k = 13 — and because 13 is exactly half of 26, applying ROT13 twice gets you back where you started. (This is why ROT13 is used to lightly obscure spoilers and punchlines on online forums: anyone can decrypt it, but you have to want to.)

Diagram: modular arithmetic on a circle of 26 letters, showing how a shift wraps around

The Caesar cipher is the simplest member of a family of techniques cryptographers call monoalphabetic substitution ciphers — ciphers where every instance of a given letter is replaced by the same other letter, consistently, throughout the message. Caesar's is the most restricted form of the family, because the substitution is just an alphabet shift. A general monoalphabetic substitution could map A to any of the 25 other letters, B to any of the remaining 24, and so on — giving 26! (that's "26 factorial") possible keys, or about 4 × 10²⁶. For its day, that is a very large number.

How to break it in thirty seconds

Here is the embarrassing secret of the Caesar cipher: with a modern brain and a piece of paper, you can break any Caesar-ciphered message in under a minute, even if you don't know the key.

There are only 25 possible non-trivial shifts (the 26th, a shift of zero, just gives you the original message). So you can simply try them all. This is called a brute-force attack — exhaustively testing every possible key.

Take the ciphertext ZHOFRPH, for example. Try each shift:

shift 1:  YGNEQOG
shift 2:  XFMDPNF
shift 3:  WELCOME  ← readable English!
shift 4:  VDKBNLD
...

The moment you hit a shift that produces readable words, you've cracked it. For a modern computer, this takes microseconds. For a patient human with a sheet of paper, a couple of minutes.

The Caesar cipher has another weakness, one that would not be formally discovered for almost a thousand years. Because every letter is replaced consistently — every A becomes D, every E becomes H — the frequency of letters in the ciphertext matches the frequency of letters in the plaintext, just shifted. In English, the letter E is the most common, appearing about 12% of the time. If you look at a Caesar-ciphered English message and notice that the letter H appears about 12% of the time, you can guess the shift is 3 without trying anything else.

This technique — frequency analysis — was not invented by a European. It was documented in the 9th century CE in Baghdad by the polymath al-Kindi, working in the libraries of the House of Wisdom. The moment al-Kindi wrote it down, every simple substitution cipher in history became, in principle, breakable. Caesar's cipher had been a state secret of the Roman elite for nine hundred years. A single manuscript in Arabic retired it overnight.

(We'll tell al-Kindi's story in depth in a future post. It is one of the great untold chapters of science.)

Why it still matters

If the Caesar cipher is so easy to break, why does anyone still teach it?

Because every idea in modern cryptography is, in some sense, a refinement of what Caesar did. Here are a few of the threads that lead from his wax tablets to the encryption protecting your devices right now.

Substitution is still everywhere. Every block cipher used on the modern internet — AES, the workhorse behind HTTPS and most file encryption — contains an internal step called the S-box, or "substitution box," which is mathematically a sophisticated version of exactly what Caesar was doing: replacing each input with a scrambled output. AES just does it on chunks of 8 bits at a time, with a table chosen to resist frequency analysis.

The key/algorithm distinction was born here. Caesar's cipher separates the method (shift the alphabet) from the key (by how much). That split — algorithm versus key — is one of the most important ideas in the field. In 1883, the Dutch cryptographer Auguste Kerckhoffs formalized it into Kerckhoffs's Principle: the security of a cipher should depend only on the secrecy of the key, not the secrecy of the algorithm. Modern cryptography lives and dies by this rule.

Brute-force bounds are still the foundation. When a modern cipher like AES-256 is described as "unbreakable," what is really meant is that the keyspace — the number of possible keys — is so vast (2²⁵⁶, a number with 78 digits) that trying them all would take longer than the age of the universe, even with every computer on Earth working in parallel. The Caesar cipher had 25 keys, so it fell in microseconds. The same logic, just at a different scale.

Simple ciphers still have their place. ROT13 isn't meant to stop attackers — it's meant to stop accidents. It keeps you from accidentally reading a spoiler. In exactly the same spirit, Caesar's cipher was never meant to stop a professional codebreaker; it was meant to stop an illiterate cavalry scout. Matching your security to your real threat model — not some imagined worst case — is a lesson first-year engineers still need to learn.

The descendants of Caesar

In the centuries after Rome, the Caesar cipher evolved. Medieval scribes toyed with it. Renaissance polymaths like Leon Battista Alberti built mechanical cipher discs — two concentric wheels that you could rotate to create any Caesar shift at will, and change mid-message for extra security. Alberti's disc, invented around 1466, was the first step toward the polyalphabetic ciphers that would dominate European cryptography for the next four centuries.

The most famous of those descendants is the Vigenère cipher, which is essentially a Caesar cipher whose shift value changes at every letter according to a keyword. For three hundred years, the Vigenère was considered unbreakable — le chiffre indéchiffrable, the French called it. When it finally fell, it did so to a method — the Kasiski examination — that is itself a generalization of the frequency analysis that sank Caesar.

The family tree runs further. Polyalphabetic ciphers begat rotor machines, in which the alphabet shift is performed mechanically by electrical wheels that change position with every keystroke. The most infamous rotor machine was the German Enigma, which scrambled Wehrmacht communications in the Second World War. And when Alan Turing and the mathematicians of Bletchley Park finally defeated Enigma, they were, in the end, doing what al-Kindi had done in Baghdad eleven hundred years earlier, just faster and with electromechanical help: looking for the statistical fingerprints that substitution ciphers cannot fully hide.

Everything that followed — the block ciphers of the 1970s, the public-key revolution of the 1980s, the elliptic-curve cryptography that now secures your phone — is, in some distant sense, a reaction to the weaknesses that a careful observer could already have seen in what Julius Caesar was doing by the banks of the Rhine.

From wax tablets to your browser

When you log in to TreeNotes, your password is mixed with an algorithm called Argon2 to derive a cryptographic key. That key is used, via a chain of modern ciphers, to encrypt every note and folder you create — in your browser, before anything touches our servers. The mathematics involved would have been unimaginable to Caesar or his scribes. But the basic posture is the same one they adopted in 54 BCE: this message is for the intended reader only; to anyone else, it must be noise.

The difference is how strong the noise is. The Caesar cipher was noise that looked like noise only to an illiterate cavalry scout. Modern end-to-end encryption is noise that looks like noise to everyone who does not hold the key — including the company that built the software. That is not a cosmetic improvement on Caesar's idea. It is the fulfillment of it.

Two thousand years later, we are still sending sealed messages to trusted readers. The envelopes have just gotten much, much harder to steam open.

Want notes that even we can't read? TreeNotes encrypts everything in your browser before it reaches our servers. We hold only ciphertext — the modern equivalent of a Roman scroll written in shifted letters, except the shift is a 256-bit key nobody will ever guess.