Frequency
Every language has a characteristic letter distribution, and simple substitution leaves it visible in the ciphertext.
The fingerprint that cipher cannot erase
English text, in any quantity, tells a predictable story in its letters. E dominates, followed at some distance by T, A, O, I and N. At the other end, Z, Q and X appear rarely enough that a few hundred characters of ciphertext will barely show them. The exact proportions shift by author and subject, but the shape — a steep peak, a long tail — is remarkably stable.
One alphabet for another does nothing to this shape. Every E is now, say, K; every Z is now W; but the frequency of K in the ciphertext exactly mirrors the frequency of E in the original language. The cipher renames every letter and renames nothing else. Count the symbols in the ciphertext, rank them by frequency, and the fingerprint of the underlying language stares back at you.
The Arab polymath al-Kindi understood this in the ninth century and described it clearly: a ciphertext long enough to be statistically representative could be compared against the known frequency order of the plaintext language, and the substitution recovered letter by letter. This is the first recorded method of cryptanalysis in history. It would not be bettered for seven centuries.
The practical threshold matters. A ciphertext of thirty letters is too short; coincidence can distort the tallies badly. By a few hundred letters the peaks and troughs stabilise, and a skilled analyst can recover a simple substitution without guessing a single word. The longer the intercept, the more mechanical and reliable the process becomes.
Attempts to defeat frequency analysis drove every major cipher innovation that followed. Homophones gave common letters multiple substitutes to flatten the count. Polyalphabetic systems changed the substitution alphabet at intervals, so a single E might map to a dozen different symbols across a long message. Codebooks replaced words and phrases with groups, breaking the letter-level pattern entirely. None of these was tried in isolation; real systems layered several countermeasures at once, always in response to the same stubborn fact: the language underneath keeps trying to show through.
