What Is Kryptos, the CIA's Unsolved Sculpture Cipher?

Background

Kryptos is a sculpture by American artist Jim Sanborn, commissioned through the US General Services Administration's Art-in-Architecture programme for $250,000 and dedicated on 3 November 1990 at the CIA's George Bush Center for Intelligence in Langley, Virginia. The piece centres on a large, curved S-shaped copper screen, designed to resemble a sheet of paper emerging from a printer, set among petrified wood, water, and red and green granite in the agency's courtyard. Cut into the copper are 1,735 letters arranged into four separate encrypted passages, K1 through K4, alongside a Vigenère tableau that gives solvers one of the tools needed to attack them.

Sanborn did not design the encryption alone. Beginning in late 1988, he worked "more or less in secret" with Ed Scheidt, the CIA's then-recently retired chairman of its Cryptographic Center, who taught Sanborn a range of historical and unconventional encoding techniques over roughly a year of private meetings. The result was deliberately layered: Scheidt has said he gave Sanborn more encryption systems than the sculpture ultimately used, specifically so that no single leaked or guessed method would crack the whole piece at once.

How the First Three Passages Were Solved

K1 and K2 both use variants of the Vigenère cipher, a centuries-old technique that shifts each letter of a message using a repeating keyword, here "PALIMPSEST" for K1 and "ABSCISSA" for K2. K1 decrypts to a short, deliberately misspelled statement about subtlety and illusion; K2 decrypts to a passage referencing something buried underground and includes a set of geographic coordinates pointing to a spot near the sculpture itself. K3 uses a transposition cipher, which rearranges a message's existing letters rather than substituting new ones, and decrypts to a near-verbatim quotation from Howard Carter's 1922 account of first looking into Tutankhamun's tomb.

An NSA team led by Ken Miller privately solved all three passages by late 1992, but the results stayed internal to US intelligence. The first public solution came from CIA analyst David Stein, who cracked K1 through K3 by hand in 1998 using pencil, paper, and his own free time, a personal project the agency's in-house newsletter reported on afterward. Independently, California computer scientist Jim Gillogly used custom-written software to solve the same three passages and announced his results publicly in 1999, beating any official CIA acknowledgement of Stein's earlier work into the open record.

The Unsolved Fourth Passage

K4 is short by cryptographic standards, 97 characters, but has outlasted every other passage by decades. Sanborn has released four official clues since 2010, each confirmed by decrypting a handful of specific character positions: in 2010, positions 64–69 spell "BERLIN"; in 2014, positions 70–74 spell "CLOCK," which Sanborn confirmed refers to Berlin's Weltzeituhr, the World Clock in Alexanderplatz; and in January and August 2020, further positions spell "NORTHEAST" and "EAST." None of these fragments, on their own, have been enough for any solver to reconstruct the rest of the passage or Sanborn's method.

The 2025 Discovery and Auction

In September 2025, journalists Jarett Kobek and Richard Byrne, researching Sanborn's donated papers at the Smithsonian's Archives of American Art, found scraps containing what appeared to be K4's complete plaintext. Sanborn confirmed the text was accurate but said he had included it by accident while compiling documents during cancer treatment, and asked the Smithsonian to seal the file until 2075; the institution agreed. He was emphatic that this discovery does not count as solving the puzzle: the plaintext leaking is not the same as someone independently deriving it through cryptanalysis, which was always the actual test the sculpture posed.

The following month, Sanborn released a final round of clues, tying the K4 solution to two events in his own life, a 1986 trip to Egypt and the fall of the Berlin Wall in 1989, and confirmed the long-rumoured existence of a fifth passage, K5, thematically linked to K2's buried-object phrase and reserved for release only after K4 is legitimately solved. In October and November 2025, he auctioned his personal Kryptos archive, including the K4 solution, prototype materials, and his original encryption tables, through RR Auction in Boston. The sale, part of an auction titled "Decoding History: Kryptos, Enigma and the Rosetta Stone," closed at $962,500 to an anonymous bidder.

Common Misconceptions

Kryptos is sometimes described as a purely mathematical puzzle, but Sanborn has repeatedly pushed back on that framing, at one point deflecting a solver's algebraic approach by asking, "Who says it is even a math solution?" His clues about a personal trip to Egypt and the Berlin Wall's fall suggest the final layer may depend on biographical or historical knowledge specific to Sanborn rather than on cryptanalysis alone, which is part of why four decades of dedicated codebreakers, including NSA and CIA cryptanalysts working on their own time, have not reconstructed it through mathematics alone.

It is also a common assumption that the 2025 Smithsonian discovery and auction mean Kryptos is now, in any meaningful sense, "solved" or "over." Sanborn's own position, stated repeatedly and publicly since the story broke, is the opposite: the puzzle's actual challenge was always the method, not the plaintext, and until someone publishes a derivation that gets from the K4 ciphertext to its message using nothing but the sculpture's own clues, the passage remains formally unbroken.

Current Consensus

Cryptographers and Kryptos researchers agree the first three passages are conclusively solved and independently verified through two separate solution routes, the NSA's internal 1992 work and the public 1998–1999 solutions from Stein and Gillogly. K4 remains an open cryptographic problem by the field's own standards: a text can be known without being solved if no one can show how the ciphertext produces it, and as of 2026 no such derivation has been published. Whether the 2025 auction winner, or anyone building on Sanborn's final clues, eventually produces a genuine solution remains an open question the CIA has no role in resolving, since Sanborn, not the agency, owns and controls the answer.

Why This Mystery Endures

Kryptos endures for a reason most of this site's unsolved cases lack: its creator is alive, communicative, and has spent thirty-five years deliberately managing how much the world gets to know, releasing clues in carefully timed increments rather than staying silent or disclosing everything at once. That combination, a real cryptographic problem embedded in a public sculpture at the heart of America's intelligence establishment, designed by a working artist rather than a state cryptographer, has made it a genuine crossover case: taken seriously by professional cryptanalysts at the NSA and CIA, and obsessively pursued for decades by amateur solver communities who treat it as one of the most prestigious open ciphers in the world.

The 2025 developments deepened rather than resolved that appeal. A leaked answer that its own author refuses to validate, an auction that turned the solution into a collectible object rather than a public disclosure, and a confirmed fifth passage still withheld, all extended the story exactly as Sanborn seems to have intended. Where the Zodiac Killer's 340-character cipher was solved in December 2020 by an independent team working the ciphertext itself, a resolution FBI-confirmed and accepted as final, Kryptos offers the opposite case: a plaintext now sitting, apparently correct, in an archive nobody is allowed to read for another five decades, while the actual puzzle keeps circulating unsolved. Kryptos is part of this site's intelligence operations cluster, within the broader secret societies and covert operations coverage.