Caesar Cipher for Kids: Write a Secret Message Today

The moment worth waiting for is not when your kid writes the secret note. It comes twenty minutes later, when they are handed somebody else’s note with no key, start grinding through shifts, and hit the one where gibberish turns into English. They stop. They read it again. Then they look up and say some version of “wait, that’s it?” A Caesar cipher for kids is the cheapest way to teach the most important idea in cryptography: a secret is only as good as the number of guesses it takes to find it. You need paper, scissors and a pen.

Key Takeaways

• Build a two-strip sliding cipher, encode a real note, swap with a partner, then break a note you have no key for.
• It teaches key space: the Caesar cipher has only 25 keys, so brute force takes minutes by hand and microseconds by machine.
• Best from about 7, once a child can find a letter’s place in the alphabet without thinking.
• The common failure is a mis-copied strip. One wrong letter and every message decodes to nonsense, which feels like the cipher broke.
• Frequency analysis, the second half, needs a long message. On a ten-word note it fails, and that failure is worth showing on purpose.

What You’ll Need

Item	How much	Where to get it	If you don’t have it
Card or thick paper	2 sheets of A4 or US Letter	Any stationery drawer	Cereal-box card works and is stiffer
Scissors	1 pair	Kitchen drawer	An adult can cut all four strips in advance
Ruler	1, at least 20 cm	School supplies	Any straight edge plus a tape measure
Pen or fine marker	1 per person	Anywhere	Pencil, but it smudges on the sliding strip
Tape	A few cm	Drawer	Glue stick and a 1 cm overlap
Plain paper for messages	4 sheets	Printer tray	Back of old homework
A long printed paragraph	1 page from any book	Your shelf	A page of a magazine or a printed email

Time: prep 15 min, activity 35 min, cleanup 5 min Cost: everything is probably already in your house Mess level: low, paper scraps only

Do the Experiment: A Caesar Cipher for Kids, Step by Step

Step 1 – Cut four strips, two per person

Cut strips 3 cm tall along the long edge of the card. Each person needs one short strip about 27 cm long and one long strip about 54 cm long. For the long one, cut two 27 cm pieces and tape them end to end; A4 is only 29.7 cm, so a single 54 cm strip is not happening. Keep both strips the same height so they slide flat.

Step 2 – Write the alphabet on the short strip

Mark 26 boxes 1 cm wide with the ruler and write A to Z in them. Do this slowly. Every error from here on traces back to this strip.

Step 3 – Write the alphabet twice on the long strip

Same 1 cm boxes, but write A to Z, then immediately A to Z again: 52 boxes. This is the trick that makes the activity work. Because the alphabet repeats, the wrap from Z back to A happens by itself and nobody has to remember a rule about it.

Step 4 – Agree the key and encode a message

Slide the long strip under the short one so the A on top sits above the D underneath. That’s a shift of three, the key the Roman historian Suetonius says Julius Caesar actually used. Write a message of six to ten words. For each letter, find it on the top strip and write the letter directly beneath. Leave spaces and punctuation alone, and say out loud that you are doing it, because it is a real weakness.

Step 5 – Swap notes and decode

Hand the note over along with the key. Your partner lines up their strips the same way and reads in the opposite direction: find the ciphertext letter on the bottom strip, write the letter above it. Decoding goes about twice as fast as encoding, because by now their hands know the strip.

Step 6 – Break a note with no key

Now the real work. Someone writes a note using a shift they do not reveal. The breaker takes only the first word and tries shift one, then two, then three, on up. They never need the whole message: as soon as one shift produces a word, the key is found and the rest falls out.

Step 7 – Count letters in a page of a book

Tally every letter on one printed page. Five minutes of boring work that pays off. Then tally the letters in a long ciphertext. The most common letter in the ciphertext is almost certainly the encoded form of the most common letter in English, and the gap between the two is the key.

What you should see: Breaking a short note by brute force takes a motivated nine-year-old two to five minutes, usually landing inside the first ten shifts. The letter-counting attack behaves very differently. On a ten-word note it gives the wrong answer, because ten words is too small a sample for frequencies to settle. On a 300-letter message it works almost at once. Run both.

What’s Actually Going On

A Caesar cipher is a monoalphabetic substitution cipher with a shift key. Every plaintext letter is replaced by the letter a fixed number of positions further along the alphabet, counting modulo 26 so Z wraps to A. Cryptographers write encryption as c = (p + k) mod 26 and decryption as p = (c − k) mod 26, where p and c are letter positions from 0 to 25 and k is the key.

There are 25 usable keys, not 26, because a shift of zero leaves the message unchanged. That set of possibilities is the key space, and it is the quantity that decides whether a cipher is any good. Twenty-five is catastrophically small. A child can try all of them on one word in a few minutes. A phone can try all of them, on a message of any length, faster than the screen refreshes.

There is a second, subtler flaw, and it is the one that killed hand ciphers for good. A shift preserves the statistics of the language. If E is the most common letter in English text, then whatever E maps to is the most common letter in the ciphertext. The pattern of common and rare letters slides sideways but keeps its shape. So you don’t even need 25 attempts: count letters, find the peak, read the shift off. Every single-alphabet substitution falls to this, including the ones that scramble the alphabet randomly instead of shifting it. Random scrambling pushes the key space to a number with 26 digits and still loses, because the frequencies are untouched.

Here is where a popular explanation goes wrong. Children, and plenty of adults, conclude that a cipher is strong if the key is hard to guess. That is half the story. A cipher is strong if the key is hard to guess and the ciphertext leaks nothing about the plaintext. Modern encryption is built so that flipping one bit of the input flips roughly half the bits of the output, which destroys exactly the statistical fingerprint the Caesar cipher hands over. The US National Institute of Standards and Technology maintains the vocabulary and the approved algorithms, and none of them are substitutions in the Caesar sense.

One honest note on the history. Suetonius describes the shift of three as a private habit in Caesar’s letters, not a state cryptosystem. To read them, he writes, you must “substitute the fourth letter of the alphabet, namely D, for A, and so with the others.”

How to Explain It to Your Kid

Ages 5–8: the alphabet has a secret slide

Don’t talk about keys. Put the strips in their hands and move the bottom one three places, so A points at D. Say: “Every letter gets to stand in a different letter’s spot. If you know how far they moved, you can move them back.” Then write their name in cipher and let them decode it. Their own name is the right first message, because they already know the answer and can check themselves. Let them pick the next shift, even something silly like 20, and discover it still works.

Ages 9–12: count the keys

Introduce the word key, then ask the question that matters: how many are there? Walk the answer out loud. A shift of 1, 2, 3, on up to 25, and then 26 brings you back to the start. Twenty-five. Now have them time themselves breaking a note. If 25 keys takes four minutes, how long would 250 take? Forty minutes. A million? They do the division and arrive at the insight themselves: security is an arithmetic problem about how much work an attacker has to do.

Ages 13+: modular arithmetic and the frequency attack

Write the cipher as c = (p + k) mod 26 and have them run it by hand for a few letters before they touch a keyboard. Then set the serious investigation: how long does a ciphertext have to be before a frequency attack beats brute force? Encode messages of 20, 50, 100, 200 and 400 letters, run the letter-count attack on each, record whether it found the right key. A threshold turns up somewhere in the low hundreds of letters, which is a real result about sample size.

The question to ask: “Suppose I invent a cipher where every letter becomes a different letter, but not by sliding. I scramble the whole alphabet randomly. There are more possible keys than grains of sand on Earth. Is it safe? How would you attack it?”

Why Teaching This Early Pays Off

A child who has brute-forced a Caesar cipher by hand carries a physical memory of what “number of possible keys” means. That lands later in three places: the chapter on modular arithmetic in secondary maths, the first time they are told to use a long password, and the first time someone tries to sell them a security product that sounds impressive and explains nothing.

The honest version of the learning claim is narrow. One afternoon with paper strips does not make a cryptographer, and the research is clear that children left to explore unaided learn less than children who explore alongside an adult. Alfieri and colleagues’ 2011 meta-analysis found unassisted discovery produced no benefit over direct instruction, while guided discovery, with explanation and feedback woven into the doing, beat both. Kirschner, Sweller and Clark put it more bluntly: minimal guidance during instruction does not work. So the value is not the paper. It’s you sitting beside them, asking how many keys there are, and not answering.

What the activity does reliably is give an abstraction a concrete referent. When a teacher writes mod 26 on a board, your kid will not be meeting it cold.

Before You Start: What Parents Should Know

Best age	7 and up. Below 7, finding a letter’s position in the alphabet is still effortful, so the attention goes to the alphabet and none to the idea. A six-year-old can enjoy decoding their own name with you doing the lookups.
Supervision	Adult does the cutting. After that you are a partner, not a supervisor: you have to write the note they must break.
Real hazards	None beyond the scissors. This is a table-and-pencil activity.
Setup	A clear table about a metre wide. The 54 cm strip needs room to slide and does not work on a lap.
Frustration point	Step 6. Some children try shift 1, get nonsense, and decide they can’t do it. Sit beside them for the first four shifts, then let go.
Don’t	Don’t skip writing the alphabet twice on the long strip. The single-alphabet version forces wrap-around into the child’s head, and that is where most give up.

When It Doesn’t Work

• Every message decodes to garbage. One letter is wrong on a strip, nearly always in the second alphabet of the long strip where attention had faded. Lay the strips side by side and check them letter by letter.
• The two of you encode in opposite directions. One shifts forward, the other backward, and nothing matches. Fix the convention out loud before step 4: to encode, read downward; to decode, read upward.
• The brute-force attack stalls. The breaker is decoding the whole message at each shift, which kills momentum. Tell them to decode only the first four letters per shift. Twenty minutes becomes three.
• Frequency analysis gives the wrong key. The message is too short. That is not a mistake, it is the result. Ask them to predict how long a message needs to be, then test it with 300 letters.
• They write a message so long they lose interest halfway. Cap the first one at eight words.

Take It Further

Vary the message length and measure the attack. Encode texts of 20, 50, 100, 200 and 400 letters with the same key. Run the frequency attack on each and record whether it found the right key first time. Plot length against success. You have measured a sample-size threshold, not made a craft project.

Build the wheel version and find out why it’s worse. Two concentric card circles on a split pin is the classic cipher disc. Marking 26 equal sectors means 13.85° each, which needs a protractor and real patience. Build one, time it, compare with the strips.

Switch to a keyword cipher. Instead of shifting, write a keyword at the start of the alphabet and fill in the unused letters after it. The key space explodes. Run the frequency attack again and watch it still work.

What to Watch For Over the Next 3 Months

• Week 4: They leave a coded note for you to find, usually with a deliberately awkward shift. Decode it in front of them and narrate your method.
• Month 2: The word “key” shows up in a new context: a game password, a Wi-Fi code, a diary lock. That transfer is the sign the concept generalised.
• Month 3: The question worth encouraging arrives as “how does the internet do it then?” You don’t need to explain public-key cryptography. Say that the clever part is that two people can agree on a key without ever sending it, and let the question sit.

Frequently Asked Questions

How is a Caesar cipher different from a code?

A cipher replaces individual letters according to a rule. A code replaces whole words or phrases using a shared lookup list, like a flag signal meaning “enemy in sight.” Ciphers work on any message; codes need both sides to hold the same book. The NIST glossary keeps these terms separate.

My seven-year-old loses track of where they are on the strip. Fix?

Give them a paper clip to slide along the top strip as a place marker. Nearly all lost-place problems are two-hands problems: one hand holds the message, one holds the strip, and there is no hand left to point with.

Is there any point learning this when real encryption can’t be broken by hand?

The point is not the cipher, it is the counting. Key space, sample size and attacker effort are the ideas that carry forward, and they are far easier to grasp at 25 keys than at 2²⁵⁶.

She says it’s boring compared to a puzzle app. Should I push?

Possibly. Deslauriers and colleagues found students in active learning conditions consistently felt they had learned less than students watching a polished lecture, while actually learning more. The feeling of effort gets misread as the feeling of failure. Say so out loud, then finish.

Can we do this with a Spanish alphabet?

Yes, and it is a good variation. A 27-letter alphabet including ñ gives 26 keys instead of 25, and the frequencies differ: E and A dominate Spanish text more strongly than English.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Suetonius. The Lives of the Twelve Caesars, Julius 56 (translated by J. C. Rolfe). LacusCurtius, University of Chicago. https://penelope.uchicago.edu/Thayer/E/Roman/Texts/Suetonius/12Caesars/Julius*.html
2. Alfieri, L., Brooks, P. J., Aldrich, N. J., & Tenenbaum, H. R. (2011). “Does discovery-based instruction enhance learning?” Journal of Educational Psychology, 103(1), 1–18. https://doi.org/10.1037/a0021017
3. Kirschner, P. A., Sweller, J., & Clark, R. E. (2006). “Why Minimal Guidance During Instruction Does Not Work.” Educational Psychologist, 41(2), 75–86. https://doi.org/10.1207/s15326985ep4102_1
4. Deslauriers, L., McCarty, L. S., Miller, K., Callaghan, K., & Kestin, G. (2019). “Measuring actual learning versus feeling of learning in response to being actively engaged in the classroom.” PNAS, 116(39), 19251–19257. https://doi.org/10.1073/pnas.1821936116
5. National Institute of Standards and Technology. Computer Security Resource Center Glossary, “cipher.” https://csrc.nist.gov/glossary/term/cipher
6. CS Unplugged, University of Canterbury. “Error Detection and Correction.” https://www.csunplugged.org/en/topics/error-detection-and-correction/
7. Wing, J. M. (2006). “Computational thinking.” Communications of the ACM, 49(3), 33–35. https://doi.org/10.1145/1118178.1118215

Related reading: computational thinking versus coding for kids, binary numbers taught with physical activities, and a binary search game for kids.