Cryptogram Rules

Written and checked by hand. Last reviewed July 25, 2026.

A cryptogram is only solvable because the setter has agreed to a set of constraints and stuck to them. If you know exactly what those constraints are, several moves that look like guesses become deductions. Here is everything the puzzles on this site guarantee, and where the syndicated newspaper puzzles differ.

The four rules that make it solvable

1. One letter always stands for the same letter

Within a single puzzle the substitution never varies. If the third letter of the first word turns out to be E, then every appearance of that cipher letter anywhere in the puzzle is also E. This is what lets you write a discovered letter into every matching cell at once, and it is why doing so is the single most important habit in solving.

2. The pairing runs both ways

The key is a one-to-one matching of the alphabet onto itself. Two different cipher letters cannot both mean E. So when you place a letter, you have not only filled some cells — you have eliminated that letter from every cell you have not filled. Half of the information in a cryptogram comes from this rule, and beginners routinely leave it on the table.

3. No letter ever stands for itself

In our puzzles this is guaranteed by construction. When the key is generated, any arrangement in which some letter maps to itself is thrown away and a new one is drawn. Mathematicians call the result a derangement: a shuffle with no element left in place.

The practical value is real. It means that of the twenty-six possibilities for any cipher letter, one is always ruled out for free, and it means the puzzle can never contain a word that is accidentally already correct. If you are ever wondering whether cipher T might be plain T, on this site the answer is no.

Do not assume this everywhere

This is a promise we make, not a law of nature. Some published cryptograms permit fixed points. If you are solving a puzzle from another source, do not rely on this rule until you know that source makes the same promise.

4. Everything that is not a letter is printed unchanged

Spaces, commas, full stops, apostrophes, hyphens, digits, quotation marks: none of them are enciphered. Word lengths are therefore exact, and every apostrophe on the page is a free clue. Preserving the spaces is what separates a puzzle you can do over breakfast from a cipher that needs a computer.

What is deliberately not preserved

Capitalisation. The whole puzzle is set in capitals. A proper name in the middle of a sentence does not announce itself.
The identity of the speaker. On this site the author appears with the answer, not with the puzzle. Knowing that a quotation is by Mark Twain before you start would narrow the vocabulary considerably, which is precisely why it is withheld.
Any relationship to yesterday. Each puzzle gets a fresh key.

How the clue letter works, when there is one

Some cipher puzzles print a clue underneath, in the form Today's clue: D equals C. That means one cell of the key has been handed to you: wherever the cipher shows D, the answer is C.

It is worth more than one letter. It also removes C from every other cipher letter's list of possibilities, and it tells you what D is not everywhere else. The clue letter is a convention of the Cryptoquip rather than the Cryptoquote, and we have a page devoted to it: what the printed clue means and how to apply it.

We do not print a clue letter on the daily puzzle. The daily is a quotation, and quotations give you enough grammatical footing without one. The app offers a reveal instead, which does the same job at the moment you actually want it rather than before you have begun.

How difficulty is decided

Each puzzle carries a band — Easy, Medium, Hard or Expert. The band is not a guess. It is computed from measurable properties of the quotation before it is ever scheduled:

Length in letters, measured as distance from an ideal working length. Very short quotations give you nothing to grip; very long ones cost patience.
How many distinct letters appear. A quotation using twenty-three different letters is harder than one using seventeen, because more of the key has to be recovered.
How much each letter repeats. Repetition is leverage: a letter that appears six times confirms or destroys a guess six times over.
Whether the rare letters J, Q, X and Z turn up, since they resist the counting method.
How many footholds there are. One-letter words, words with an apostrophe, words containing a doubled letter, and words whose letter pattern is unique in a ten-thousand-word dictionary. This is the heaviest single term in the score, because it is what decides whether the puzzle has an obvious opening move.
How ordinary the vocabulary is, measured against that same dictionary.
How far the letter mix strays from ordinary English, measured as a chi-squared distance from standard English letter frequencies. A quotation whose frequencies look nothing like normal prose defeats the counting method, and that shows up in the score.

Because the band is computed the same way for every quotation, an Expert in September is the same difficulty as an Expert in December. The band means one thing and only one thing.

Everyone gets the same puzzle

The key for a puzzle is derived from that puzzle's own identifier by a fixed, deterministic procedure. There is no randomness at the moment you load the page and nothing that depends on your device, your location or your history. Two people in different states, one on this website and one in the app, working on the same date, see exactly the same cipher text.

That is a deliberate design choice rather than a technical accident. A daily puzzle that differs per person is not a daily puzzle; it is a puzzle generator. If you and a friend want to compare notes on today's, you are looking at the same thing.

One more rule, about the quotations themselves

We only publish a quotation when we can point at where it came from. If the attribution is merely traditional — the sort of line that gets confidently credited to Franklin or Einstein and appears in neither — it does not go on the site at all. Our reasoning is on the about page, and the source of every published quotation is printed with its answer.

Now that you know what the setter has promised, the step-by-step solving guide shows how to convert those promises into a finished puzzle, with a full worked example.

Questions we get

Can the same letter appear twice in the key?

No. The key is a one-to-one pairing across the whole alphabet. If cipher Q is plain E, then no other cipher letter is plain E, and Q is nothing but E for the rest of that puzzle.

Does the key change between puzzles?

Yes, every day. Nothing you learned about yesterday's key carries over to today. What carries over is your knowledge of English, which is the part that actually improves.

Are numbers enciphered?

No. Digits, if a quotation contains any, are printed as they are. So are hyphens, dashes and quotation marks.

Is the puzzle case sensitive?

No. The cipher is printed entirely in capitals, and capitalisation in the original is not preserved. That means the first word of a quotation gives nothing away, and neither do proper names.

Is everyone solving the same puzzle as me?

Yes. The puzzle for a given date is identical for every reader of this site and every user of the app, on every device, worldwide. It is generated from the puzzle's own identifier, not from anything about you.