Kryptos: The Cipher the CIA Can't Crack in Its Own Courtyard
In a small courtyard outside the cafeteria at CIA headquarters in Langley, Virginia, stands a wave of copper rising out of a petrified tree. It is curled like a scroll caught mid-unfurling, pierced with roughly 1,800 letters. It is called Kryptos. It was dedicated in November 1990, and it carries four separate encrypted messages. Thirty-five years later, one of them has still never been read by anyone doing the work of decryption.
The artist was Jim Sanborn, a sculptor from Washington who was not a cryptographer. To learn the craft he worked with Ed Scheidt, a recently retired chairman of the Agency's own Cryptographic Center. Together they designed four ciphers and set them into the metal, in four sections that solvers came to label K1, K2, K3 and K4. Three of them were meant to be hard. The fourth was meant to be, for a while, impossible.
The first three eventually fell. In 1998 a CIA analyst named David Stein cracked the opening three sections by hand, working through his lunch breaks with pencil and paper, and the Agency kept his achievement quiet in-house. A year later a California computer scientist, Jim Gillogly, solved the same three passages using a computer and announced it publicly. That announcement is how the outside world first learned that any part of Kryptos could be read.
The plaintexts turned out to be a mixture of poetry, geography and archaeology. K1 was a short passage of Sanborn's own writing about the play of light and shadow, ending on a deliberate misspelling: iqlusion, for illusion. K2 described information gathered using the earth's magnetic field and transmitted to somewhere buried and unknown, then gave a set of coordinates a short distance from the Agency's own grounds, and signed off with the initials WW, generally read as William Webster, the CIA director at the time of the dedication. K3 was a near-verbatim borrowing from archaeologist Howard Carter's account of the moment in 1922 when he first looked through the breached door of Tutankhamun's tomb and saw, by candlelight, wonderful things.
Those sections carried other oddities as well: undergruund in K2, desparatly in K3. For years Sanborn described the anomalies as intentional, artistic choices seeded to mislead. When his working charts eventually surfaced, however, some of them looked less like art than like drafting slips made while the sculpture was being fabricated, transcription errors set permanently into copper. One passage, long read as ending WESTIDBYROWS, turned out to be missing a letter Sanborn had simply dropped while transferring the text. The intended ending was WEST, then X, then LAYERTWO.
Then there is K4. Ninety-seven characters. A single unbroken block of ciphertext that has now stood for thirty-five years against the National Security Agency, the CIA's own analysts, university teams and a global community of thousands of amateurs. Vigenere variants, columnar transposition, matrix systems, statistical and frequency attacks, custom software written for this one wall of letters: none of it has produced a plaintext that anyone can confirm.
At the center of that community sits Elonka Dunin, an American video-game developer turned cryptologist who has spent more than two decades as the sculpture's unofficial archivist. She maintains a widely cited catalogue of the world's great unsolved codes, and she co-runs an online discussion group, thousands of members strong, that functions as a standing war room for K4. There, solvers dissect every public remark Sanborn makes and test each other's proposed cracks in real time. Dan Brown, looking for a name for his novel The Lost Symbol, hid hers in the book: the character Nola Kaye is an anagram of Elonka. In all those years, the group has never confirmed a single letter of K4 that Sanborn did not first hand over himself.
Sanborn did hand over four fragments. In November 2010 he told The New York Times that letters 64 through 69 of K4, the ciphertext cluster NYPVTT, decrypt to BERLIN. In November 2014 he gave the next word: the letters MZFPK, positions 70 through 74, become CLOCK. In 2020 he released two more cribs, EAST and NORTHEAST. For years the community assumed BERLIN CLOCK referred to the Mengenlehreuhr, the set-theory clock that tells the time in rows of colored lamps. In 2025 Sanborn corrected the record: the clock he had in mind was the Weltzeituhr, the World Clock on Berlin's Alexanderplatz, which stands on a mosaic compass rose, an echo of the compass rose worked into Kryptos itself. Four islands of readable text, and no one has connected them into a sentence.
In 2025 the story turned. Sanborn, approaching eighty and unwilling to let the answer die with him, decided to auction it. Weeks before the sale, two researchers noticed something in the auction listing: the novelist Jarett Kobek and the writer Richard Byrne saw that Sanborn's original coding charts were catalogued as part of an archive he had years earlier deposited with the Smithsonian. Byrne went and photographed the papers. Kobek, studying the images afterward, realized that a set of taped-together scraps laid the plaintext bare, with the already-published cribs BERLIN CLOCK and EAST NORTHEAST sitting there in context alongside the rest of the message.
On September 3 the two men emailed Sanborn the full decoded text. They had not broken the cipher; they had found the answer in the artist's own filing cabinet. Sanborn, alarmed that the secret might leak before it could be sold, moved to have the Smithsonian seal the relevant materials, by some accounts until 2075, and lawyers for the auction house warned Kobek and Byrne against publishing what they had found. The two agreed to stay silent.
On November 20, 2025, at RR Auction in Boston, in a sale titled Decoding History, Sanborn's complete private Kryptos archive went under the hammer. The lot included the K4 solution, the underlying coding system, and material touching on a further secret Sanborn calls K5. It sold for $962,500, nearly double the high estimate and roughly triple the low, to an anonymous bidder now publicly styled the new keeper of Kryptos. The buyer committed to keeping the answer hidden so that the puzzle can continue.
Sanborn has been careful with his words since. K4, he says, has not been solved; it has been discovered, and it points in the direction of K5. The answer now exists in at least three sets of hands: his own, the two researchers who found it in the archive, and the anonymous buyer. None of them will say it aloud. The ciphertext on the copper is exactly as unbroken today as it was in 1990, and the spies at Langley still walk past it on their way to lunch.
Conclusions and Open Questions
Three explanations compete for what K4 actually is, and each has a clear weakness.
The first, held by most of the solver community around Dunin's group, is that K4 is a sound cipher that simply uses a trick nobody has tried in the right combination: a masking or transposition step layered over a Vigenere-style substitution, keyed perhaps to the Berlin clock itself. Its strength is that Sanborn insists the thing is solvable, and his four cribs decrypt to real words at fixed positions, which is what a consistent system would produce. Its weakness is thirty-five years of failure by extremely capable people, which strains the idea that it is merely well hidden.
A second theory, argued by solvers who have studied the surfaced charts, holds that K4 is broken, either deliberately or by accident. On this reading a transcription error, or a masking layer Sanborn did not fully control, means no algorithm can recover a clean plaintext from the copper alone, and the released cribs function as patches rather than as proof of a clean system. Its strength is the documented, real mistakes elsewhere on the sculpture. Its weakness is that Sanborn, who holds the answer, denies it flatly and has repeatedly validated partial work.
A third position holds that K4 was never a purely cryptographic puzzle but an art object with a cryptographic surface, and that the true solution leans on outside knowledge: the Weltzeituhr, the compass rose, perhaps a physical act of standing or pointing in the courtyard. Its strength is Sanborn's own statement that a solved K4 only opens onto K5, another riddle folded into the work and tied back to K2. Its weakness is that it cannot be falsified, since any failure can always be blamed on a missing real-world key.
There are also open theories about the sale itself. Some argue that the auction was less about preserving a mystery than about monetizing one at the last possible moment, and that sealing the Smithsonian papers protected a price rather than a puzzle. Others point out that the archive was publicly accessible for years before anyone thought to look, and read the sealing as an ordinary reaction to an ordinary panic. Neither reading can be tested from outside, because the only documents that would settle it are the ones now locked away.
What remains genuinely unexplained is narrower and more interesting than any of that. Nobody has produced a decryption method that turns the ciphertext on the wall into the four known cribs and then keeps working across the remaining letters. Nobody outside a very small circle knows whether the plaintext, once read, is even self-explanatory, or whether it is another instruction pointing somewhere else. And nobody has established whether the errors frozen into K1 through K3 have a counterpart in K4, which is the difference between a puzzle that is hard and a puzzle that is unsolvable as carved.
The open questions follow from that. If the plaintext sat in a public archive for years, what exactly was the cipher protecting? Can a solution that was found in a filing cabinet, rather than derived from the ciphertext, count as an answer at all? If the buyer never speaks, does K4 remain an open cryptographic problem, or has it quietly become a private document with a copper illustration in a courtyard in Virginia? And what is K5, a real fifth layer or a way of ensuring that no reading of K4 is ever the last word?