MYS0D7HT0ZC3ZTJ·Mystery · object

Kryptos

Carol M. Highsmith · Public domain

Where: Courtyard of CIA headquarters, Langley, Virginia, beside the New Headquarters Building⁠[1]
Artist: Jim Sanborn, with cipher systems devised with retired CIA officer Edward Scheidt⁠[1]
Dedicated: 3 November 1990⁠[1]
Left panel: 869 characters: 865 letters and 4 question marks, in four passages K1 to K4⁠[1]
K1 to K3: Solved by an NSA team by June 1993, by CIA analyst David Stein in 1998, and by Jim Gillogly in 1999⁠[3]
K4: 97 characters; 24 plaintext letters released by Sanborn (EAST NORTHEAST at 22-34, BERLIN CLOCK at 64-74)⁠[1]
K4 solution sold: RR Auction, 20 November 2025, $962,500⁠[8]
Buyer: Paradigm, a venture capital firm, disclosed 12 June 2026⁠[9]
Status: Partly explained
Questions: 1 of 4 answered

People Jim SanbornSculptor; author of the ciphers and sole holder of the K4 method until 2025 Jarett KobekWriter; identified the K4 plaintext in archive photographs in 2025 Richard ByrneJournalist and playwright; photographed the archive folders in 2025 Edward ScheidtCIA Office of Communications officer, retiring in the late 1980s; devised the cipher systems with Sanborn David SteinCIA analyst; solved K1 to K3 in 1998

All 6 people ›

Jim GilloglyComputer scientist; published K1 to K3 in 1999

Catalog keyMYS0D7HT0ZC3ZTJ

Kryptos stands in a courtyard at CIA headquarters in Langley, Virginia. Jim Sanborn made it under a federal art commission and it was dedicated on 3 November 1990. Its main element is an S-shaped copper screen cut with 869 characters of ciphertext on the left and a keyed Vigenère tableau on the right⁠[1]. Sanborn devised the cipher systems with Edward Scheidt, an officer of the CIA's Office of Communications who was about to retire⁠[2]⁠[1].

The ciphertext falls into four passages. K1 and K2 are Vigenère ciphers on a tableau keyed with KRYPTOS; K3 is a transposition. An NSA team had solved all three by June 1993, the CIA analyst David Stein solved them by hand in 1998, and the computer scientist Jim Gillogly announced his own solution in June 1999⁠[3]⁠[2]⁠[4]. The fourth passage, K4, has 97 characters. Sanborn has released four fragments of its plaintext since 2010, totalling 24 letters, and nobody has broken the rest⁠[1]⁠[5].

In 2025 the question changed. Sanborn put his archive, including the K4 plaintext and the method used to encipher it, up for auction; in September two journalists, Jarett Kobek and Richard Byrne, found the plaintext on scraps among papers Sanborn had given to the Smithsonian's Archives of American Art, and Sanborn confirmed it⁠[6]⁠[7]. The archive sold for $962,500 on 20 November 2025. The buyer, the venture firm Paradigm, revealed itself in June 2026 and says it has arranged not to see the plaintext itself⁠[8]⁠[9]. K4 is therefore known to a few people and unpublished, and the method remains unknown to everyone outside Sanborn, Paradigm's archive and, possibly, Scheidt. Of the 4 questions on this site, 1 are answered. The most likely answer to “What kind of cipher is K4?”, not yet confirmed: k4 uses a Gromark-type cipher (a keyed alphabet with a running numeric key generated by chain addition) or a….

Key questionsset by the editors

Is K4 solved, known but withheld, or open?Answered: k4 is solved; its plaintext has been recovered and confirmed by its author.

What kind of cipher is K4?Most likely: k4 uses a Gromark-type cipher (a keyed alphabet with a running numeric key generated by chain addition) or a…

All 4 questions

The object

The sculpture has a petrified tree, a pool and stone slabs in addition to the copper screen. Near the entrance to the New Headquarters Building, granite slabs with copper sheets carry Morse code fragments (VIRTUALLY INVISIBLE, DIGETAL INTERPRETATIT, SHADOW FORCES, LUCID MEMORY, T IS YOUR POSITION, SOS, RQ), and a compass rose points toward a lodestone⁠[1]. The left panel holds 865 letters and four question marks; three letters (YAR) are raised above the line. The right panel is a Vigenère tableau of 867 letters in which one row carries an extra L⁠[1]⁠[10].

Kryptos (copper screen, petrified wood, granite and pool)Jim Sanborn, 1990. CC BY-SA 3.0Artifact

The solved texts are: K1, BETWEEN SUBTLE SHADING AND THE ABSENCE OF LIGHT LIES THE NUANCE OF IQLUSION (key PALIMPSEST); K2, a message about information "transmitted undergruund to an unknown location" ending with the coordinates 38 57 6.5 N, 77 8 44 W (key ABSCISSA); and K3, a paraphrase of Howard Carter's account of opening Tutankhamun's tomb in 1922⁠[1]⁠[2]. In April 2006 Sanborn said an S had been left out of K2 on the sculpture, so that its last words read WEST X LAYER TWO rather than the WEST ID BY ROWS that every solver had found⁠[11]. The misspellings IQLUSION, UNDERGRUUND and DESPARATLY are on the sculpture; Sanborn has said they are deliberate⁠[1].

K4 reads OBKRUOXOGHULBSOLIFBBWFLRVQQPRNGKSSOTWTQSJQSSEKZZWATJKLUDIAWINFBNYPVTTMZFPKWGDKZXTJCDIGKUHUAUEKCAR. Sanborn's clues give its plaintext at four places: EAST at 22 to 25, NORTHEAST at 26 to 34, BERLIN at 64 to 69 and CLOCK at 70 to 74⁠[12]⁠[13]⁠[14]⁠[1]. In November 2025 he added that BERLINCLOCK means the World Clock at Alexanderplatz, that the text concerns a 1986 trip to Egypt and the fall of the Berlin Wall, and that it is about "delivering a message"⁠[15].

Map of the areaOpen the full map

Area Continent

+−

Courtyard of CIA headquarters, LangleyBuilding courtyard

Mapped

Langley, VirginiaCommunity

Within 10 km

Archives of American Art, Smithsonian Institution, Washington DCArchive

Within 1 km

MappedWithin 1 kmA regionNatural Earth

Timeline

Timeline

Squeezed where little happened. Each mark is a published claim, by how it stands:AcceptedMost likelyStill possibleDisputedRuled out

What is known

The K1 to K3 systems are fully understood and the published ciphertext reproduces their plaintexts exactly; this project's data file checks that. Scheidt has said the encryption was meant to take five to ten years and that the method changes between passages⁠[1]. Sanborn's released K4 letters show that the cipher can map a letter to itself (the K of CLOCK enciphers to K) and, under a simple Vigenère reading, do not give a consistent key, which is why solvers believe K4 adds a further layer⁠[1]⁠[5].

First page of David Stein, "The Puzzle at CIA Headquarters: Cracking the Courtyard Crypto" (Studies in Intelligence, 1999) — David Stein, "The Puzzle at CIA Headquarters: Cracking the Courtyard Crypto" (Studies in Intelligence, 1999)Central Intelligence Agency (declassified release), 1999. Public domainArtifact

The plaintext exists outside Sanborn's head. On 2 September 2025 Richard Byrne photographed folders in the Jim Sanborn papers at the Archives of American Art; Jarett Kobek found among the images cut-up strips that, put together with the released clues, gave the K4 plaintext. They emailed it to Sanborn on 3 September and he confirmed it⁠[16]⁠[6]. Sanborn said the five scraps were copies of texts he had prepared in 1990 to show the CIA that the sculpture said nothing offensive, and that he had put them in the archive boxes by mistake. He stressed that they gave the plaintext "without the coding method or the key"⁠[7]⁠[17]. At his request the Smithsonian sealed the files for fifty years⁠[18]. Kobek and Byrne refused non-disclosure agreements, received letters from the auction house's lawyers, and have said they will not publish⁠[17]⁠[6].

RR Auction sold the archive on 20 November 2025 for $962,500 against an estimate of $300,000 to $500,000. The lot comprised Sanborn's handwritten K4 plaintext, the original K4 coding system, an unpublished alternative K4 of 1988 now called K5, the coding charts for K1 to K3, and a private session with Sanborn⁠[8]. On 12 June 2026 Paradigm announced it was the buyer. It said Sanborn typed the plaintext into a fresh laptop, which hashed it and obtained an HMAC tag from a Google Cloud key so that submissions can be checked without anyone at Paradigm reading the answer; the laptop was then wiped. Paradigm also holds the 97-character K5 ciphertext and has said it will release it later. It has not published K4, K5, the method, or the hash or tag⁠[9]⁠[19].

What has been tested

Most published work on K4 is cryptodiagnosis: tests of which cipher families could have produced the text. Bauer, Link and Molle examined whether a Hill (matrix) cipher fits, prompted by the letters H I L L that the extra L creates in the tableau's right-hand column⁠[10]. Richard Bean ran Monte Carlo permutation tests on the ciphertext and the released plaintext and found strong evidence of a one-to-one relation between corresponding plaintext and ciphertext letters; he proposed the Gromark cipher as a system that would explain most of the observed properties⁠[5]. Neither paper claims a solution.

Many claimed solutions have appeared, most recently a wave of AI-assisted attempts and self-published preprints; Sanborn's 2025 letter describes the volume of mostly meaningless decrypts as one reason for the sale⁠[20]. None has been confirmed. Paradigm's verifier now offers the first independent check of a candidate plaintext since Sanborn stopped answering, at a fee of $1 a try⁠[9].

The readings

Three positions describe the state of K4. The first is that K4 is solved: its plaintext has been found and confirmed by its author⁠[6]. That is true of the plaintext only, and it rests on Sanborn's word and the journalists' account; no one outside the circle has seen the text.

The second is that K4 is known but withheld. Sanborn, Kobek and Byrne, and the archive's buyer all hold the plaintext or can check it, and Sanborn holds the method; Paradigm holds the method in the archive but says it has chosen not to look at the plaintext⁠[8]⁠[9]. On this reading the mystery is now one of disclosure, not of cryptanalysis.

The third is that K4 is open as a cryptographic problem. Sanborn's own position since the find is that K4 has not been solved, because a solution means recovering the method and the key from the ciphertext⁠[7]⁠[15]. Kobek agrees that the find was archival, not cryptographic⁠[16]. On this reading, which matches how the problem was set in 1990, K4 remains unbroken, and K5, which Sanborn says shares K4's method and some words in the same positions, will be a second test once released⁠[15].

Published claims

Published claims and their status

Year	Who	Claimed	Status	Reason
1999	David Stein (CIA)⁠[2]	K1 and K2 are Vigenère ciphers on the KRYPTOS-keyed tableau and K3 is a transposition, and all three decrypt to English plaintexts.	Accepted	An NSA team and Jim Gillogly reached the same plaintexts independently, and the published ciphertext reproduces them exactly⁠[3]⁠[4].
1999	Jim Gillogly (reported by John Markoff)⁠[4]	Computer search solves K1 to K3, with K2 ending WEST ID BY ROWS, while K4 resists.	Accepted	The solutions stand, except that in 2006 Sanborn said an S had been left off the sculpture, so K2 really ends WEST X LAYER TWO⁠[11].
2006	Jim Sanborn (reported by Kim Zetter)⁠[11]	An S was omitted from K2 on the sculpture, so its last words read WEST X LAYER TWO rather than WEST ID BY ROWS.	Accepted	The author's own correction of his text; solvers have used the corrected reading since⁠[1].
2013	Kim Zetter, from NSA documents released to Elonka Dunin⁠[3]	An NSA team had solved K1 to K3 by June 1993, years before the CIA's own analyst.	Accepted	The claim rests on NSA's own released documents⁠[3].
2016	Craig Bauer, Gregory Link and Dante Molle⁠[10]	K4 may be a Hill (matrix) cipher, hinted at by the extra L that spells HILL down the tableau's last column.	Disputed	Their tests of the matrix conjecture did not produce a decryption, and none has followed⁠[10]⁠[5].
2021	Richard Bean⁠[5]	Permutation tests show a one-to-one relation between K4's plaintext and ciphertext letters, and a Gromark-type cipher would explain most of its properties.	Still possible	The statistical result stands, but no Gromark decryption reproducing all the cribs has been published⁠[5].
2025	Jarett Kobek and Richard Byrne (reported by the New York Times)⁠[6]	The K4 plaintext is among Sanborn's papers at the Archives of American Art, and Sanborn has confirmed it.	Accepted	Sanborn and the auction house accept the find, while stressing that it gives the plaintext and not the method⁠[7]⁠[17].
2025	Jim Sanborn and RR Auction⁠[7]	K4 was discovered, not solved: the archive scraps give the plaintext without the coding method or the key.	Accepted	Kobek himself says the find is not a cryptographic solve, and no method has been published⁠[16]⁠[5].
2025	Jim Sanborn⁠[15]	BERLINCLOCK is the World Clock at Alexanderplatz, K4 concerns a 1986 trip to Egypt and the fall of the Berlin Wall, and K5 uses the same system with shared words in the same positions.	Still possible	The author's own clues; they cannot be checked until the method or K5 is released⁠[9].
2026	Paradigm⁠[9]	The buyer holds Sanborn's K4 plaintext in a hashed verifier that can check submissions without anyone at the firm reading it, and will release K5.	Still possible	It rests on the firm's own description; no hash, tag or K5 ciphertext has been published to let others check it⁠[19].

What would settle it

Publication of the plaintext together with the method, by Paradigm or by Sanborn, would settle what K4 says and how it was made; a cryptanalyst who recovers both from the ciphertext and passes Paradigm's verifier would settle it the way the 1990 puzzle intended. A published hash commitment from Paradigm would let anyone check a claim against the sold plaintext without trusting the verifier. Release of K5, if it uses the same method, would give a second 97-character text and a much stronger basis for cryptodiagnosis.