Kryptos

Kryptos is a sculpture outside the CIA's headquarters in Langley, Virginia, covered in four coded messages. Three have been solved. The fourth, K4, is 97 letters long and has resisted every public attempt for more than thirty years, which makes it probably the most famous unsolved cipher in the world. This page explains how the solved parts work, what we know about the fourth, and why the story has no tidy ending yet.

What it is

The American sculptor Jim Sanborn made Kryptos in 1988 to 1990 for the courtyard of the CIA's new headquarters building. It's a curved panel of copper with letters cut through the metal, dedicated on 3 November 1990. The word is Greek for "hidden". Sanborn worked on the ciphers with Edward Scheidt, a retired CIA cryptography chief. The panel carries four messages, K1 to K4, and the first three were solved by the mid-1990s. An NSA group is reported to have done it first, in 1992 and 1993, and a CIA analyst, David Stein, solved them in 1998 with pencil and paper. The computer scientist Jim Gillogly announced the first public solution in 1999.

K1: a Vigenère cipher on a scrambled alphabet

K1 and K2 are Vigenère ciphers with a twist. Instead of the plain alphabet down the side and along the top of the table, Sanborn used an alphabet that starts with the word KRYPTOS: KRYPTOSABCDEFGHIJLMNQUVWXZ. The key for K1 is PALIMPSEST, a word for a manuscript that's been written over. The method is otherwise the same. Each key letter gives a shift, but the shift is counted along the scrambled alphabet.

Try it yourself. The box below is the keyed-alphabet Vigenère cipher, loaded with the real ciphertext of K1. Press "Load an example" and the tool decrypts it, with the key PALIMPSEST and the alphabet keyword KRYPTOS.

Nothing you type here leaves your browser.

The result is BETWEENSUBTLESHADINGANDTHEABSENCEOFLIGHTLIESTHENUANCEOFIQLUSION: "Between subtle shading and the absence of light lies the nuance of iqlusion". Sanborn has said the spelling "iqlusion" is a deliberate misspelling of "illusion". (This decryption is one of the project's tests, so the ciphertext and key above are checked.)

K2 and K3

K2 uses the same method with the key ABSCISSA. It speaks of information that was gathered and transmitted underground to an unknown location, of the Earth's magnetic field, and of something buried out there somewhere, and it gives a set of coordinates near the CIA headquarters. A mistake in the ciphertext, a missing letter S, made the last words read as "ID BY ROWS" for years, until Sanborn confirmed in 2006 that the message ends "X LAYER TWO".

K3 isn't a substitution at all. It's a transposition. The ciphertext letters are arranged in a grid and read in a different order, a technique like the columnar transposition but with an unusual path. Unscrambled, the plaintext paraphrases Howard Carter's account of looking into Tutankhamun's tomb for the first time in 1922, through a small hole, with a candle flickering in the draught. Carter wrote in his journal that the room was "wonderful", and in his later book he put it as "wonderful things".

K4: the part nobody has solved

The last passage is 97 letters, starting OBKRUOXOGHULBSOLIFBBWFLRVQQPRNGKSSOTWTQSJQSSEKZZWATJKLUDIAWINFBNYPVTTMZFPKWGDKZXTJCDIGKUHUAUEKCAR. Everything that works on K1 to K3 has been tried on it, and nothing public has been confirmed. Over the years Sanborn has released clues, to keep the puzzle moving and to prove it can be solved:

• 2010: letters 64–69 of the ciphertext, NYPVTT, decrypt to BERLIN.
• 2014: letters 70–74, MZFPK, decrypt to CLOCK. Sanborn has since said that this refers to the World Clock in Berlin.
• 2020: two further clues gave NORTHEAST for letters 26–34 and EAST for letters 22–25.

That's 24 of the 97 letters. The clues give a word at a fixed position, so any proposed method has to produce exactly those words there, which rules out most guesses. So far the plain Vigenère and plain transposition ideas haven't worked. Sanborn has also said that two events lie behind the solution: his trip to Egypt in 1986 and the fall of the Berlin Wall in 1989.

What happened in 2025 and 2026

The story took a new turn in 2025, and it remains disputed. In September 2025 two writers, Jarett Kobek and Richard Byrne, found pages in Sanborn's papers at the Smithsonian's Archives of American Art. They were copies Sanborn had made in 1990 with the text cut into strips and taped together out of order. From them, and from his public clues, the two assembled what appears to be the plaintext of K4. They say plainly that this isn't a cryptographic solution. They have no method, and they've chosen not to publish the text. Sanborn has said the same: K4 "has not been solved". In late 2025 Sanborn sold his private archive, which includes the solution and its method, at auction. Reports say it fetched $962,500 and that the buyer, revealed in June 2026, was a venture firm, Paradigm. Sanborn has said a fifth message, K5, will be revealed when K4 is solved.

So the situation is odd. A few people hold the plaintext privately, but the method, which is the point of a cipher, isn't public. A cryptanalyst would say it isn't solved until someone derives the plaintext from the ciphertext with a method that works on it, and nobody outside a small circle has done that. We haven't verified the details of the sale or the archive ourselves, so treat them as reported. This page reflects what was public in October 2026. If a method is published later, this is the page that should change.

What Kryptos teaches

• A good puzzle can be made from ordinary parts. K1 is a Vigenère cipher with a scrambled alphabet and K3 is a transposition. They're textbook ciphers, put together with care.
• Test the transcription. The K2 ending was misread for years because one letter was missing from the ciphertext as engraved. A cipher you can't check for errors is a puzzle of a different kind.
• Known fragments are valuable. The clues to K4 are known-plaintext attacks in everything but name. BERLIN and CLOCK at fixed positions tell you what any candidate method must produce there, and that has eliminated most of the obvious ideas.

Paste the K4 ciphertext into the frequency analysis tool and the index of coincidence comes out at 0.036, a little below the 0.038 of random letters. That doesn't say much on 97 letters, since K1, a plain Vigenère cipher, scores 0.038 too. It does show K4 isn't a simple substitution or transposition, whose scores would sit near 0.067.

Common questions