How to solve a cryptogram, counted against a real puzzle bank

How we got these numbers

Every count in this article was taken over the complete Daily Cryptogram puzzle bank as shipped in src/lib/cryptogramBank.ts on 12 August 2026: 40 quotes, 259 words in total. Words were counted as whitespace-separated tokens with punctuation stripped. The cipher properties described come from buildCipher and encryptQuote in the same file. Nothing here is carried over from another site.

Start with the thing our cipher guarantees

Before any letter counting, there is one structural fact worth more than most of the advice you will read elsewhere, and it is specific to how this game builds its puzzles.

The cipher is a derangement. When the daily puzzle is generated, the alphabet is shuffled and then checked: if any letter has landed on itself, the shuffle is thrown away and repeated until none has. So no letter ever encodes to itself. A ciphertext E is never a plaintext E, a ciphertext T is never a plaintext T, and so on for all 26.

That is not decoration. It removes one candidate from every single letter you are trying to place, and it removes it from the candidate you would otherwise waste the most time on, because a letter sitting on itself is exactly the coincidence that makes a wrong guess look right. When you are down to two options for a high frequency letter, check whether one of them is the letter itself. If it is, it is wrong.

• Punctuation and spaces pass through unchanged, so word boundaries and sentence structure are always visible.
• The bank contains no digits and no apostrophes, so the popular apostrophe heuristic has nothing to work on here. More on that below.
• The daily puzzle is chosen by hashing the date, and the cipher is seeded separately by the same date. The same quote can come round again under a completely different cipher.

No letter ever stands for itself in our puzzles. Cross the letter off its own candidate list before you start.

The single-letter word is always A

Standard advice, repeated on most cryptogram sites, is that a one-letter word is either A or I, and several of them tell you to try I first because quotes tend to be personal.

We counted. Across all 40 puzzles there are 17 single-letter words. Every one of them is A. There are zero occurrences of a standalone I in the bank.

That makes it the strongest single opening move available. Find a one-letter word, set it to A, and you have a free letter with no risk attached. It is also a high frequency letter, so that one placement immediately marks up a good number of positions elsewhere in the text.

Counted over all 40 quotes in src/lib/cryptogramBank.ts, 12 August 2026.

One-letter word means A. This is true for every occurrence in the bank, which makes it the safest first placement in the game.

Two-letter words: IS, not TO

The usual list of common two-letter words runs something like of, to, in, it, is, be, as, at, so, on, do, by, or, an, go, no. It is accurate for English generally and close to useless as a solving order, because it is unranked.

In our bank there are 39 two-letter words and they are heavily lopsided. IS accounts for a third of them by itself. TO, which most guides list near the front, appears exactly once in 40 quotes. IT, AT, OR, SO, BE, IF and ON-style filler either never appear or appear once.

The practical consequence is a clear order of attack. If a two-letter word repeats within a puzzle, or appears in more than one place, try IS before anything else. It is also structurally useful: the second letter S is a common ending, so placing IS often unlocks plurals elsewhere in the same quote.

Shares rounded. No other two-letter word occurs anywhere in the bank.

• IS and IN share a first letter, and both are common. If you have placed A already, neither conflicts with it, so try IS first and fall back to IN.
• DO is unusually well represented because several quotes are imperatives. Two of the five come from a single quote.
• A two-letter word whose second letter also ends several other words in the same quote is almost certainly IS.

Three-letter words: THE is nearly four in ten

Every guide tells you to look for THE. None of them tell you how dominant it is, which is what determines whether you should guess it immediately or hedge.

The bank contains 53 three-letter words. THE is 20 of them, roughly 38 percent. Nothing else comes close: NOT is next at 4, then FOR and YOU at 3 each. Nineteen different three-letter words appear exactly once.

So the correct play is aggressive. Take the most frequent three-letter pattern in the puzzle and set it to THE outright. If it is wrong you will know within two or three more placements, because E and T are high frequency and a wrong assignment will produce impossible letter runs almost immediately. The expected cost of being wrong is low and the payoff is three letters at once, including the two most common in English.

The single-occurrence group covers AND, ONE, TWO, HAS, WAS, HOT, POT, RUN, ALL, CAN, ITS, OUT, OAK, PEN, EYE, MAN, WHO, WAY and GET.

AND appears once in the entire bank. THE appears twenty times. If a three-letter word repeats, it is THE, and the usual THE-or-AND hesitation is wasted effort here.

Doubled letters, and the six pairs that actually occur

A doubled letter is the most visible structure in a cryptogram, because two identical symbols side by side jump out before you have decoded anything. The standard advice lists the common English doubles and leaves you to work through them.

There are 19 doubled letters in the bank and they use only six distinct pairs. EE leads clearly with six, then LL with four, TT and SS with three each, OO with two and PP with one. Nothing else appears at all: no RR, NN, MM, FF, DD, GG or CC anywhere in 40 quotes.

That reduces a vague heuristic to a six-item checklist, and the checklist has a useful property. Nearly a third of the doubles are EE, so if you have cracked THE and know your E, check the doubled symbols against it first. If it is not E, then the remaining candidates are L, T, S, O and P, and the surrounding word shape usually settles which.

No other doubled letter occurs in any of the 40 quotes.

Two pieces of standard advice that do not apply here

Almost every cryptogram guide tells you to look for apostrophes, on the reasoning that the letter after an apostrophe is nearly always S, T, D, M, LL or RE. It is sound advice and it is dead weight in this game: the bank contains no apostrophes at all. Contractions are written out in full, so DO NOT appears rather than DON'T. If you are hunting for an apostrophe you are hunting for something that is not there.

The second is raw frequency analysis. The advice to count symbol frequencies and map the most common to E is built for long ciphertexts, and the usual rule of thumb is that you need somewhere around 60 letters before the counts settle down enough to trust.

No quote in this bank reaches 60 letters. The longest is 45, and the average quote is 6.5 words. At that length the counts are noise: a 30-letter quote can easily contain more Os than Es without anything unusual having happened, and acting on the tally will send you down a wrong branch that takes several placements to notice.

So frequency counting is not a late step here, it is a step you can skip. Structure beats counting every time at this length: word length, repeated words, doubled letters and the position of the short words carry far more information than the tally does.

• No apostrophes anywhere in the bank. Contractions are spelled out.
• Average quote length is 6.5 words. The longest is 11 words and 45 letters, the shortest 3 words.
• Ignore frequency counts entirely and work from word shape. No puzzle in the bank is long enough for them to be reliable.
• Repeated whole words are the exception worth chasing: several quotes repeat a word, and a repeat gives you every letter of that word at once when you crack it.

A solving order that reflects the counts

• Scan for a one-letter word and set it to A. It is correct every time in this bank.
• Scan for a repeated three-letter word and set it to THE. That gives you T, H and E.
• Check the two-letter words. Try IS before IN, DO, OF or NO, and try TO last rather than first.
• Mark every doubled letter and restrict it to EE, LL, TT, SS, OO or PP, minus anything already placed.
• Cross off self-mappings. A letter never encodes to itself, so eliminate that candidate everywhere.
• Skip the frequency count. No quote here is long enough for it to be trustworthy.
• Use the clue. Every puzzle ships with a one-line hint about the meaning, and on a short quote that is often worth more than any letter-level technique.

A, then THE, then IS, then the doubles. Four steps in that order will open most puzzles in the bank before you have counted a single frequency.

Frequently asked questions

What is the fastest first move in a cryptogram?

Find a single-letter word and set it to A. Across the 40 puzzles in our bank there are 17 single-letter words and every one of them is A, so it carries no risk. Standard advice to try I first does not hold here.

Can a letter stand for itself in a cryptogram?

Not in ours. The cipher builder shuffles the alphabet and rejects any shuffle where a letter lands on itself, so the mapping is always a derangement. That lets you eliminate one candidate for every letter before you start.

Which two-letter word should I guess first?

IS. It accounts for 13 of the 39 two-letter words in the bank, a third of the total. IN and DO follow at five each. TO appears just once in 40 puzzles despite being near the top of most published lists.

Is it THE or AND?

Almost certainly THE. It appears 20 times in the bank against a single appearance of AND, and it makes up about 38 percent of all three-letter words. Guess THE immediately rather than weighing the two.

Does letter frequency analysis work on short quotes?

Not here. Frequency counts need roughly 60 letters before they settle, and the longest quote in our bank is 45 letters. Word shape, doubled letters and short-word position are far more informative at this length, so the count is a step you can skip entirely.

Why are there no apostrophes in the puzzles?

The quote bank writes contractions out in full, so DO NOT appears rather than DON'T. The widely repeated apostrophe heuristic, which predicts the following letter, has nothing to act on in this game.

Do the daily puzzles repeat?

The bank holds 40 quotes and the daily puzzle is selected by hashing the date, so quotes do come round again over time. The cipher is seeded separately, so a repeated quote arrives under a different substitution and has to be solved fresh.