How Much Ciphertext Does a Vigenère Cracker Need? A Controlled Benchmark

There is no universal minimum amount of ciphertext that guarantees a Vigenère key can be recovered.

The amount of text needed depends on the key period, the plaintext language, how typical that text is, whether the period is already known, and the scoring method used by the cracker.

A 100-letter ciphertext can be generous for a three-letter key and inadequate for a twelve-letter key.

That difference is easy to explain but rarely measured.

So this article tests it.

Under one fixed benchmark, a simple chi-squared key-recovery method was run 2,444 times against English Vigenère ciphertexts ranging from 30 to 800 letters. Four keys were used, with fundamental periods 3, 5, 8, and 12.

The most useful result was not a magic ciphertext length. It was this:

the amount of evidence available to each key position matters more than the raw ciphertext length by itself.

In this benchmark, the first tested size to exceed 90% exact-key recovery ranged from 75 ciphertext letters for period 3 to 500 letters for period 12.

If you already have ciphertext and want to work with it directly, use the Vigenère Cipher Decoder and Encoder. The benchmark below is about understanding when statistical key recovery becomes reliable, not about replacing the tool with a fixed threshold.

The controlled question

A full Vigenère attack has at least two statistical problems:

1. determine or strongly estimate the repeating key period;
2. recover the Caesar-style shift used by each key position.

This benchmark isolates the second problem.

The true key period is supplied to the cracker in every trial.

That choice is deliberate.

If period detection and key recovery were mixed into one score, a failed crack could come from either stage. We would not know whether the ciphertext was too short to reveal the period, or whether the period was correct but each column contained too little language data to recover its shift.

By supplying the period, we can ask a cleaner question:

Once the repeating period is known, how much ciphertext does a simple frequency-based Vigenère cracker need to recover the exact key?

These results should therefore be treated as a benchmark of the key-recovery stage, not as a promise that an unknown-key ciphertext of the same length will always be fully cracked.

The broader attack sequence is explained in How to Break the Vigenère Cipher.

Benchmark setup

The experiment uses ordinary English prose and standard A–Z Vigenère encryption.

Plaintext corpus

The source text is an excerpt from Chapter I of Lewis Carroll’s Alice’s Adventures in Wonderland, using Project Gutenberg eBook #11.

The benchmark span begins:

Alice was beginning to get very tired...

and ends:

...she very soon finished it off.

The text was normalized by:

converting letters to uppercase
keeping A–Z only
removing spaces
removing punctuation
removing all other characters

The resulting benchmark corpus contains exactly:

6,498 letters

Its SHA-256 fingerprint is:

3070aad2cd74ac31a8a6a39c2ecc780392bbe9291904b599d41a352585b0957e

The hash is included so a reproduction can verify that it is using the same normalized corpus.

Keys

Four repeating keys were tested:

None has a shorter repeating subperiod than the length shown.

Ciphertext lengths

The tested normalized ciphertext lengths were:

30
50
75
100
150
200
300
500
800

For each length, the 6,498-letter corpus was divided into consecutive non-overlapping full blocks of exactly that size.

Any incomplete remainder at the end was discarded.

That produced:

Each block was encrypted independently, starting from the first letter of the relevant key.

Across four keys, the benchmark contains:

2,444 exact-key recovery trials

How the cracker recovered each key

Once the period is supplied, the ciphertext is separated into one stream for each key position.

For a period-5 key, for example:

stream 1 = positions 1, 6, 11, 16...
stream 2 = positions 2, 7, 12, 17...
stream 3 = positions 3, 8, 13, 18...
stream 4 = positions 4, 9, 14, 19...
stream 5 = positions 5, 10, 15, 20...

Each stream was encrypted with one fixed Caesar shift.

For every stream, the cracker tried all 26 possible shifts and compared the resulting letter counts with a fixed English monogram model using Pearson’s chi-squared statistic:

χ² = Σ (Observedᵢ - Expectedᵢ)² / Expectedᵢ

The shift with the lowest score was selected for that key position.

The reference frequencies used were:

A .082  B .015  C .028  D .043  E .127  F .022  G .020
H .061  I .070  J .002  K .008  L .040  M .024  N .067
O .075  P .019  Q .001  R .060  S .063  T .091  U .028
V .010  W .023  X .001  Y .020  Z .001

Because those rounded values total 1.001, they were normalized to sum to exactly 1 before expected counts were calculated.

A trial counted as a success only when every key letter was recovered correctly.

Near-misses did not count.

For example, if the true key was:

COMPUTER

then:

COMPUTXR

was recorded as a failed exact recovery even though seven of eight key letters were correct.

This makes the benchmark deliberately strict.

Exact-key recovery results

Here are the complete results:

The trend is clear, but it is not controlled by ciphertext length alone.

At 100 letters:

period 3  → 98.4% exact recovery
period 5  → 82.8%
period 8  → 23.4%
period 12 → 0.0%

The same 100-character sample gives dramatically different results depending on how many key positions divide the available evidence.

Same 100-letter plaintext, four very different outcomes

The aggregate table can make the effect feel abstract, so it is useful to hold the plaintext constant.

Take the first 100 normalized letters of the benchmark corpus and encrypt exactly that same text four times, changing only the key:

ALICEWASBEGINNINGTOGETVERYTIREDOFSITTINGBYHERSISTERONTHEBANKANDOFHAVINGNOTHINGTODOONCEORTWICESHEHADP

With period 3:

True key:      SUN
Recovered key: SUN
Correct:       3 / 3

With period 5:

True key:      ORBIT
Recovered key: ORBIT
Correct:       5 / 5

With period 8:

True key:      COMPUTER
Recovered key: QOMXUTER
Correct:       6 / 8

With period 12:

True key:      CRYPTOGRAPHY
Recovered key: CRYKGHGBXPCY
Correct:       6 / 12

Nothing about the underlying English passage changed.

The difference is how thinly those 100 letters were divided across key positions.

The period-3 case gave each shift about 33 observations. The period-12 case gave each shift only eight or nine.

That is the central mechanism behind the benchmark results.

Why key length changes the answer so much

A period-3 key divides 100 ciphertext letters into roughly three streams:

100 / 3 ≈ 33 letters per key position

A period-12 key divides the same ciphertext into twelve much smaller streams:

100 / 12 ≈ 8 letters per key position

The cracker is not really trying to recognize English from all 100 letters at once.

It is trying to identify twelve separate Caesar shifts from samples averaging only eight or nine letters each.

That is a much weaker statistical problem.

The same comparison at 300 ciphertext letters looks very different:

period 3  → about 100 letters per column
period 5  → about 60
period 8  → about 37 or 38
period 12 → about 25

At 300 letters, the benchmark recovered:

SUN          21/21
ORBIT        21/21
COMPUTER     21/21
CRYPTOGRAPHY 16/21

The period-12 case is still harder, but it is no longer starved of evidence.

The first tested point above 90%

For each key, the first tested ciphertext length reaching at least 90% exact recovery was:

This table is useful, but it should not be converted into a rule such as:

40 letters per column always crack Vigenère

The experiment does not support that claim.

It supports a narrower observation: under this corpus, frequency model, and chi-squared recovery method, exact recovery became strong when the individual key-position streams contained a few dozen letters rather than only a handful.

Different plaintext can move that point substantially.

Why the results are not perfectly monotonic

One row deserves attention.

For the period-5 ORBIT key:

150 letters → 43/43 exact recoveries
200 letters → 31/32 exact recoveries

More ciphertext did not produce a higher measured success percentage in those two rows.

That is not evidence that 150 letters are intrinsically better than 200.

The benchmark partitions the corpus separately at every tested length. A 150-letter trial and a 200-letter trial are not the same plaintext with 50 extra letters appended. They are different sets of non-overlapping samples.

One 200-letter block happened to contain a frequency distribution that caused one key position to be misranked.

Finite-sample benchmarks can move slightly up or down for this reason.

The broader pattern matters more than insisting that every adjacent row must increase.

What happens when there are only a few letters per column

The 30-character results show the problem clearly.

With SUN, period 3:

30 / 3 = 10 letters per stream

The exact key was recovered in:

85 of 216 trials
39.4%

That is weak, but success is still possible.

For ORBIT, period 5:

30 / 5 = 6 letters per stream

Exact recovery fell to:

7 of 216
3.2%

For COMPUTER, period 8:

30 / 8 ≈ 3.75 letters per stream

and for CRYPTOGRAPHY, period 12:

30 / 12 = 2.5 letters per stream

Neither produced a single exact-key recovery in the 216 trials.

With two, three, or four observations in a column, ordinary English frequency expectations have very little room to stabilize. Several Caesar shifts can look equally plausible or a wrong shift can happen to fit the tiny sample better.

The limitation is statistical, not computational.

Trying all 26 shifts is easy. Deciding which shift is supported by the data is the hard part.

Exact-key recovery is harsher than partial recovery

A long key can be almost correct and still fail the metric.

Suppose a twelve-letter key has eleven positions recovered correctly and one position wrong.

The exact-recovery score is:

failure

even though the cracker has already recovered:

11 / 12 = 91.7%

of the key letters.

This is one reason the period-12 results appear severe at intermediate lengths.

At 200 ciphertext letters, CRYPTOGRAPHY was recovered exactly in only:

13 / 32 trials
40.6%

but the average individual key-letter accuracy across those trials was approximately:

92.97%

So the cracker was often close long before it reproduced the entire twelve-letter key exactly.

That distinction matters in practical cryptanalysis because a nearly correct key may produce enough readable plaintext for a human or a stronger language scorer to repair the remaining positions.

This benchmark intentionally refuses that assistance so the measurement stays objective.

A 100-letter ciphertext is not one difficulty level

The phrase “a 100-letter Vigenère ciphertext” hides an important variable.

In this benchmark:

This is why a useful estimate should consider at least:

ciphertext length / key period

rather than ciphertext length by itself.

The ratio is still not a complete predictor. It does not capture language irregularity, scoring quality, or period uncertainty.

But it describes the amount of statistical evidence available to each shift far better than total length alone.

Why unusual plaintext can change the result

The benchmark uses continuous English literary prose.

Frequency-based cracking becomes less reliable when the underlying text differs strongly from the reference model.

Examples include:

lists of names
source code
abbreviations
coordinates
technical identifiers
short slogans
deliberately constrained writing
another language

Imagine a key column containing 35 letters from normal prose and another containing 35 letters from a list dominated by unusual proper names.

The samples have the same length.

They do not necessarily provide the same quality of frequency evidence.

So a statement such as:

200 characters are enough

is incomplete without describing the kind of plaintext and the attack being used.

Why an unknown period requires more caution

This benchmark gives the cracker the correct key period.

A real ciphertext-only attack often has to infer that period first.

That adds another source of failure.

A message may contain enough text to recover the shifts if the correct period were known, while still being too short for period-estimation evidence to identify that period confidently.

The reverse can also happen: a period may be strongly suggested, but each resulting column can remain too short for reliable shift recovery.

Those are different data requirements.

The site’s Vigenère frequency-analysis guide explains the second stage in depth. This benchmark measures that stage under controlled conditions rather than blending it with period estimation.

Why a stronger cracker can need less ciphertext

The benchmark deliberately uses a simple monogram chi-squared scorer.

It asks only whether the individual letter frequencies after a candidate Caesar shift resemble expected English frequencies.

A stronger cracker can use additional evidence:

bigrams
trigrams
tetragrams
word probabilities
multiple candidate shifts per column
global plaintext scoring
contextual guesses
known plaintext

Those methods may recover keys from samples where the simple benchmark fails.

That does not make this experiment obsolete.

It gives us a baseline.

If a more sophisticated cracker succeeds with 100 letters where this one succeeds only half the time, the difference can be attributed to the better scoring method instead of vague claims about “AI” or “advanced algorithms.”

Later cryptanalysis can then be compared against a documented starting point.

Why a weaker cracker can need much more

The opposite is also true.

A method that simply maps the most common ciphertext letter in each column to plaintext E discards most of the frequency distribution.

It can fail even when a full chi-squared comparison succeeds.

An implementation can also lose reliability through:

poor English reference frequencies
incorrect key alignment
wrong treatment of punctuation
too many candidate periods
bad normalization
failure to handle negative modulo correctly

“How much ciphertext is needed?” is therefore partly a question about the cracker itself.

The benchmark does not prove a universal threshold

The experiment is controlled, not universal.

Its measured results apply directly to this setup:

English literary prose
A–Z normalization
four stated repeating keys
known true period
Pearson chi-squared shift scoring
fixed monogram reference frequencies
exact-key success criterion

Change those conditions and the recovery curve can move.

The safest interpretation is not:

Vigenère needs 300 letters

It is:

short-period keys can become statistically recoverable from much less
ciphertext than long-period keys because every key position receives
more observations.

As the period grows, the cracker needs more total ciphertext to give
each column enough language evidence.

That conclusion is visible throughout all 2,444 trials.

Practical expectations from this benchmark

If the plaintext is ordinary English and the period is already known, these results suggest a useful way to think about ciphertext quantity:

fewer than about 10 letters per key position
→ expect unstable frequency recovery

around 20 letters per key position
→ useful evidence may exist, but exact recovery can still be unreliable

around 25–40 letters per key position
→ this benchmark moved into strong exact-recovery territory,
   depending on the period and sample

more evidence per position
→ generally improves reliability, but never creates a mathematical guarantee

These are observations from this experiment, not hard cryptographic cutoffs.

For an unknown real-world ciphertext, treat them as planning guidance rather than proof.

The answer to “how much ciphertext is enough?”

The most accurate answer is:

enough to give every recurring key position a statistically useful sample, plus enough information to establish the period if the period is not already known.

That amount is not fixed.

In this controlled benchmark, a three-letter key crossed 90% exact recovery with 75 ciphertext letters, while a twelve-letter key needed 500 letters to cross the same mark.

At 100 letters, exact recovery ranged from 98.4% to 0% solely as the tested key period changed from 3 to 12.

So the useful unit is not merely:

ciphertext letters

It is also:

ciphertext letters per key position

That is the main practical lesson of the experiment.

A Vigenère cracker does not become reliable because the message passes one universal length. It becomes reliable when the ciphertext contains enough repeated-key evidence for the specific attack being used.

---

Written by Marcus Hale

Editorially reviewed by VigenereDecoder.com editorial team