How ROT13 works

The idea in one sentence

ROT13 is a Caesar cipher with the dial glued at half a turn: every letter moves 13 places along the Alphabet, so A becomes N and N becomes A.

The recipe

1. Count 13 positions past the letter — or don't count: the second half of the alphabet is a mirror of the first.

2. Replace each letter with its partner. Spaces and case stay put.

3. To undo it, do it again. Because 13 + 13 = 26, applying ROT13 twice is the identity — the operation is its own inverse.

A worked example

HELLO becomes URYYB. Look at the shift column: every row says 13, and that constancy is the entire cipher. Check the symmetry: U back to H, R back to E — the same table runs both directions.

The formula

encrypt: y = (x + 13) mod 26
decrypt: y = (x + 13) mod 26   # the same line!

That repetition is no accident: 13 is half of 26, the only shift that pairs every letter with exactly one partner and inverts itself. No other Caesar shift has this property.

Obfuscation, not encryption

Nobody has ever claimed ROT13 is secure — it would be absurd: no key, one fixed mapping, instant undo. Its job is convenience: text that a passing eye cannot read accidentally, but that a willing reader reveals without tools. Think of it as a paper bag over the punchline, not a safe around the treasure — the practice tab's challenges all open with one click.

Step-by-step guides

Hide a line of text

1. Type the text into the message input. ROT13 has no settings — the shift is fixed at 13.

2. Read the scrambled line in the output field. Copy it wherever spoilers are unwelcome.

Reveal it again

1. Paste the scrambled text into the message input and press the swap button the swap button — or don't: in encrypt mode the same text transforms identically. ROT13 decrypting is encrypting.

2. Read the original line in the output field.

Recognise ROT13 in the wild

1. It is the commonest "gibberish" on old internet forums: letters only, spacing untouched, frequency distribution suspiciously intact.

2. Test by symmetry: take one letter and try the 13-step partner — if a word appears, apply the whole mapping.

3. Confirm with the giveaway letters: in English, a text rotated 13 turns E's into R's, so ciphertext full of R's and lacking a clear most-common letter is a strong hint.

Breaking ROT13

ROT13 cannot be "attacked" in any meaningful sense — the shift is published in the cipher's own name. This page is short, and that is the pedagogical point.

The flaw: the name is the key

Caesar hid the shift; ROT13 prints it in its title. There is no key space — one possibility, one known shift — so there is nothing to brute-force and nothing to infer. A Brute force attack here is a single, always-successful attempt.

Attack — do it again

1. Paste the Ciphertext into the tool. Because ROT13 is self-inverse, the same operation that produced it removes it.

2. No frequency analysis, no Crib hunting, no statistics: the letter distribution of ROT13 text is exactly the distribution of the original, relabelled — and a trained eye reads relabelled English almost directly.

What makes it useful anyway

The protection ROT13 offers is against accidental reading: a reviewer glancing at a joke's punchline, a reader who does not want the plot spoiled. That is a real use case — just not a cryptographic one. It is the same lesson Atbash teaches one page earlier: an cipher with no key is a convenience feature.

The family resemblance

ROT13 is the Affine cipher with a = 1, b = 13, and the only Caesar shift that is its own inverse. Within the family of monoalphabetic ciphers it marks the floor: no key at all, no security at all, and — precisely because of that — a permanent fixture of netiquette.