Kryptos: The CIA's Unsolved Sculpture

Overview

There is a sculpture sitting in the courtyard of CIA headquarters in Langley, Virginia, that the most powerful intelligence agency on Earth cannot read. It has been there since 1990. It weighs roughly a ton and a half. It looks like a scroll of copper that someone partially unrolled and then left standing in a reflecting pool, its surface covered in nearly 1,800 characters of encrypted text cut straight through the metal. Three of its four encrypted sections have been cracked. The fourth — ninety-seven characters, barely a long text message — has defeated every cryptanalyst, mathematician, supercomputer, and amateur codebreaker who has thrown themselves at it for more than thirty-five years.

The sculpture is called Kryptos. Greek for “hidden.” And it is, by almost any measure, the most famous unsolved code in the world.

What makes Kryptos so maddening isn’t just its difficulty. It’s the context. This thing sits on the grounds of an organization whose entire reason for existing is breaking codes and keeping secrets. The people who walk past it every morning on their way to work are signals intelligence professionals, counterintelligence specialists, and cryptographic engineers. Some of them have spent their lunch breaks trying to crack it. Some have spent their careers. The answer is right there, hammered into copper, sitting in a courtyard pool where analysts eat their sandwiches. And it might as well be written on the surface of Mars.

The Artist and the Spymaster

Jim Sanborn’s Obsession

Jim Sanborn was not an obvious choice to create a monument for the Central Intelligence Agency. He was a sculptor, based in Washington, D.C., known for installations that played with the invisible forces of nature — lodestones, magnetic fields, the physics of spinning objects. His work lived in the space between science and art, which was part of the appeal. When the CIA commissioned a piece for the courtyard of its new headquarters building in the late 1980s, they didn’t want a bronze eagle or a granite slab etched with the agency seal. They wanted something that would embody the intelligence mission itself. Something about hidden knowledge. About the interplay between what can be seen and what can’t.

Sanborn got the commission. He’d never worked with encryption before. So he went looking for someone who had.

Ed Scheidt and the Cipher Machine

Enter Ed Scheidt, a career CIA officer who had recently retired as chairman of the CIA’s Cryptographic Center — the division responsible for developing and maintaining the encryption systems that protected the agency’s most sensitive communications. Scheidt was, in other words, one of the top cryptographic minds in the American intelligence community, a man who had spent decades designing systems intended to be unbreakable.

Sanborn approached Scheidt in 1988 and laid out his vision: a sculpture whose surface would contain encrypted text, a message hidden in plain sight at the headquarters of the world’s most prolific secret-keepers. The two men worked together over several months to develop the encryption methods that would be used. Scheidt taught Sanborn the fundamentals of classical cryptography — substitution ciphers, transposition ciphers, the Vigenère tableau. He was explicit about one thing: the encryption had to be solvable. This was art, not a safe. The whole point was that someone, eventually, would figure it out.

Whether Scheidt fully understood the encryption Sanborn ultimately used is a matter of some debate. Sanborn has said he added layers to the scheme that went beyond what Scheidt taught him. Scheidt has said the full solution was never shared with him. The two men’s accounts don’t perfectly align, which is fitting for a project born in the shadow of an agency that has elevated ambiguity to an institutional art form.

The Sculpture

Kryptos was dedicated on November 3, 1990. It consists of several elements, but the centerpiece is a large S-shaped copper screen, roughly twelve feet high and twenty feet long, that curves like a scroll or a wave frozen in metal. Cut through the copper, letter by letter, are 1,735 characters of ciphertext — the encoded message that would consume the obsessions of thousands of people over the next three and a half decades.

The sculpture sits in a landscaped courtyard between the old and new headquarters buildings, partially surrounded by a reflecting pool. Embedded in the surrounding granite are additional elements: a compass rose, a lodestone, and a Morse code message that reads “VIRTUALLY INVISIBLE” and “SHADOW FORCES” and other fragments of text that seem to offer thematic commentary on the encrypted sections. Petrified wood and copper elements surround the installation. The whole thing has the feel of an archaeological site transplanted into the bureaucratic heart of American intelligence — which is exactly what Sanborn intended.

The encrypted text is divided into four sections, known to the codebreaking community as K1, K2, K3, and K4. Each uses a different cipher method. Together, they were designed to be solved sequentially, with earlier sections potentially providing clues to later ones. In practice, that theory hasn’t worked out.

Breaking the Code: K1 Through K3

K1: The Nuance of Iqlusion

The first section, K1, consists of 63 characters. It was encrypted using a modified Vigenère cipher — one of the oldest and most elegant encryption methods in classical cryptography, dating to the sixteenth century. The Vigenère cipher uses a keyword to shift each letter of the plaintext by a different amount, making simple frequency analysis useless. Sanborn’s version included an additional twist: the standard 26-letter alphabet was scrambled before the Vigenère tableau was applied.

When decrypted, K1 reads:

BETWEEN SUBTLE SHADING AND THE ABSENCE OF LIGHT LIES THE NUANCE OF IQLUSION

That last word — “IQLUSION” — is a deliberate misspelling of “illusion.” Sanborn has confirmed this was intentional, not a cipher error. Whether the misspelling is itself a clue to K4, or simply an artistic choice, has been debated endlessly. In the world of Kryptos analysis, nothing is accidental, and everything is potentially significant.

The message itself reads like a statement of artistic philosophy, a meditation on the space between visibility and invisibility. It also doubles as a description of what Sanborn was doing with the sculpture: creating something that existed between shading and absence, between encrypted and clear, between hidden and exposed.

K2: Coordinates and a Director’s Name

K2, the second section, is 69 characters long and also uses a Vigenère cipher, though with a different keyword and a different alphabet arrangement. Its decrypted text is more concrete:

IT WAS TOTALLY INVISIBLE HOWS THAT POSSIBLE ? THEY USED THE EARTHS MAGNETIC FIELD X THE INFORMATION WAS GATHERED AND TRANSMITTED UNDERGRUUND TO AN UNKNOWN LOCATION X DOES LANGLEY KNOW ABOUT THIS ? THEY SHOULD ITS BURIED OUT THERE SOMEWHERE X WHO KNOWS THE EXACT LOCATION ? ONLY WW THIS WAS HIS LAST MESSAGE X THIRTY EIGHT DEGREES FIFTY SEVEN MINUTES SIX POINT FIVE SECONDS NORTH SEVENTY SEVEN DEGREES EIGHT MINUTES FORTY FOUR SECONDS WEST X LAYER TWO

The “WW” is widely understood to refer to William Webster, who was Director of Central Intelligence when Kryptos was created. The latitude and longitude coordinates (38°57’6.5”N, 77°8’44”W) point to a location just 150 feet southeast of the sculpture itself — somewhere on the CIA’s own grounds. The references to something being “buried out there somewhere” have driven treasure-hunt speculation for decades, though the CIA has never confirmed (or denied, naturally) that anything is actually buried at those coordinates.

The message also contains another deliberate misspelling: “UNDERGRUUND” instead of “underground.” Again, intentional. Again, a source of infinite speculation.

K3: King Tut’s Tomb

The third section is 336 characters and uses a transposition cipher — a method that doesn’t substitute letters for other letters but instead rearranges the order of the plaintext characters according to a specific pattern. When unscrambled, K3 produces a paraphrased passage from Howard Carter’s account of opening King Tutankhamun’s tomb in 1922:

SLOWLY DESPARATLY SLOWLY THE REMAINS OF PASSAGE DEBRIS THAT ENCUMBERED THE LOWER PART OF THE DOORWAY WAS REMOVED WITH TREMBLING HANDS I MADE A TINY BREACH IN THE UPPER LEFT HAND CORNER AND THEN WIDENING THE HOLE A LITTLE I INSERTED THE CANDLE AND PEERED IN THE HOT AIR ESCAPING FROM THE CHAMBER CAUSED THE FLAME TO FLICKER BUT PRESENTLY DETAILS OF THE ROOM WITHIN EMERGED FROM THE MIST X CAN YOU SEE ANYTHING Q

The final question — “CAN YOU SEE ANYTHING?” — is Carter’s famous moment, when Lord Carnarvon, standing behind him, asked what he could see through the breach in the tomb wall. Carter’s response, in the historical account: “Yes, wonderful things.” Sanborn omitted the answer. The message ends on the question itself — a deliberate suspension, an invitation that mirrors the sculpture’s larger project of encoding revelation inside mystery.

“DESPARATLY” is another deliberate misspelling.

K4: The Ninety-Seven Characters That Won’t Break

And then there’s K4.

Ninety-seven characters. That’s it. Ninety-seven characters of ciphertext, carved into copper, sitting in a reflecting pool at CIA headquarters since November 1990. Every serious cryptanalyst who has solved K1 through K3 has broken themselves against K4. The NSA has tried. The CIA’s own internal codebreaking talent has tried. Academic mathematicians have tried. Hobbyists armed with laptops and brute-force programs running for months straight have tried. The K4 community — and yes, there is a dedicated K4 community, complete with online forums, annual conferences, and the kind of obsessive attention to detail that makes the Zodiac cipher community look casual — has tried everything.

The characters are:

OBKRUOXOGHULBSOLIFBBWFLRVQQPRNGKSSOTWTQSJQSSEKZZWATJKLUDIAWINFBNYPVTTMZFPKWGDKZXTJCDIGKUHUAUEKCAR

Nothing works. Frequency analysis, Vigenère variations, Hill ciphers, polyalphabetic substitution, bifid ciphers, Playfair, transposition overlays, combined methods — the community has attempted every classical and modern cryptographic approach. None have produced coherent plaintext. K4 is not just hard. It appears to use a fundamentally different approach from the first three sections, or possibly a combination of methods layered on top of each other in ways that make the solution space practically infinite without the right key.

The Clues

Sanborn, who is the only living person confirmed to know the full solution (assuming Scheidt was truthful about not having it), has dropped breadcrumbs over the years. In 2010, he revealed that characters 64 through 69 of the K4 plaintext spell “BERLIN.” In 2014, he added that characters 70 through 74 spell “CLOCK.” The most obvious reference would be the Berlin Clock, a famous public timepiece in the city’s Europa-Center. Others have suggested the Berlin Wall clock — the countdown that marked the hours until the wall fell. Or that “CLOCK” refers to the direction of reading the cipher itself.

These clues have narrowed the search space, but not enough. Knowing six words of a ninety-seven-character plaintext is like knowing two pieces of a hundred-piece jigsaw puzzle when you don’t even know what the picture is supposed to look like. Every serious attempt to extend “BERLIN CLOCK” into a full solution has dead-ended.

In 2020, as the sculpture’s thirtieth anniversary passed with K4 still unsolved, Sanborn — who was then 75 years old — acknowledged publicly that he was in a race against mortality. He told reporters he had arranged a “fail-safe”: the solution had been entrusted to someone who would reveal it after his death if nobody cracked it before then. The identity of the fail-safe holder is, of course, undisclosed.

The Solvers

David Stein: Pencil, Paper, and Four Hundred Lunch Hours

The first known solver of any Kryptos section was David Stein, a CIA analyst who began working on the sculpture in 1998. Stein’s approach was pure old-school tradecraft: he sat down with pencil, paper, and the text, and worked through it by hand. No computer. No algorithm. Just pattern recognition and dogged persistence, four hundred lunch hours’ worth of it.

Stein cracked K1, K2, and K3. He announced his solutions internally at the CIA in February 1998, and the agency — characteristically — classified the achievement. For over a year, Stein’s solutions were treated as an internal secret. The world’s most famous unsolved cipher had been mostly solved, and the CIA decided that was classified information. You genuinely cannot make this stuff up.

The NSA Weighs In

Roughly a year later, in 1999, a team from the National Security Agency independently solved the same three sections using computational methods. The NSA’s approach was more systematic and less romantic than Stein’s — they threw computing power at the problem and worked through possible cipher methods algorithmically. They got the same answers. Their solutions were eventually declassified and published, finally giving the public access to the plaintext of K1 through K3.

Neither Stein nor the NSA team cracked K4. Both acknowledged it appeared to be a fundamentally different — and significantly harder — challenge.

Conspiracy Theories and Speculation

A sculpture encrypted by a retired CIA cryptographic chief, sitting on CIA grounds, unsolvable for thirty-five years, naturally generates its own gravity field of conspiracy theories. Some of the more persistent ones:

The K4 Solution Would Embarrass the CIA

One popular theory holds that the reason K4 remains “unsolved” is that it has been solved — by the CIA, the NSA, or both — and the solution contains information so damaging or embarrassing that the agencies have suppressed it. Proponents note that the CIA classified David Stein’s solutions for over a year and suggest a similar suppression could be permanent. What could K4 say that’s so dangerous? The theories range from the plausible (it references a real CIA operation by name) to the fantastical (it reveals the location of something buried at Langley that the agency doesn’t want found).

Sanborn has pushed back on this, saying the final message is “philosophical” rather than operational. But when the creator of an encrypted CIA sculpture tells you not to worry about what it says, the conspiracy-minded are unlikely to take that at face value.

The Recruitment Puzzle Theory

Another theory frames Kryptos as an elaborate recruiting tool — a permanent, public challenge designed to identify and attract cryptographic talent. Under this theory, the CIA monitors attempts to solve K4, and anyone who makes meaningful progress gets a tap on the shoulder and an invitation to Langley. It’s a nice theory, and it aligns with the intelligence community’s well-documented practice of using public puzzles to identify talent (see: Cicada 3301). But there’s no evidence for it beyond pattern-matching, and Sanborn has never described the sculpture in those terms.

The Buried Treasure Theory

K2’s reference to something “buried out there somewhere” at specific coordinates near the sculpture has spawned decades of speculation about a physical artifact hidden on CIA grounds. Some Kryptos enthusiasts believe K4’s solution will reveal what’s buried, turning the entire sculpture into an elaborate treasure map. Others think the buried object — whatever it is — contains the key to K4 itself. The CIA, naturally, has offered precisely zero comment on whether anything is buried at the indicated coordinates, which is exactly what they would say whether something was there or not.

The Sanborn Fail-Safe

Sanborn’s announcement of a post-mortem fail-safe has itself become a source of intrigue. Who holds the solution? What are the conditions for its release? Is it a sealed letter? A digital file? A safety deposit box? And what happens if Sanborn’s health fails suddenly, before the fail-safe mechanism can be activated? The possibility that the world’s most famous unsolved cipher could remain unsolved forever — not because it’s too hard, but because its creator died before the backup plan kicked in — is the kind of dark irony that the Kryptos community tries not to think about too loudly.

The Kryptos Community

What started as an intelligence community curiosity has expanded into a global subculture. Online forums like the Kryptos Group on Yahoo (later migrated to other platforms) have hosted decades of discussion, where amateur and professional cryptanalysts share approaches, debate clue interpretations, and occasionally announce breakthroughs that turn out to be false starts.

The K4 problem has attracted talent from academic cryptography, computer science, mathematics, and linguistics. PhD theses have been written. Conferences have been organized. Software tools specifically designed for K4 analysis have been developed and shared open-source. The sheer volume of failed attempts has its own value — the K4 community has effectively proven, by exhaustive trial, that the cipher doesn’t yield to any standard classical or modern method applied in isolation. Whatever Sanborn did, he (perhaps with Scheidt’s help, or perhaps going beyond it) created something genuinely novel.

This puts Kryptos in the rare company of codes that have resisted not just individual solvers but entire communities working in concert over decades. The Voynich Manuscript is perhaps the only other cipher that can claim a comparable history of organized, sustained, and frustrated effort.

What We Know and What We Don’t

Here’s what is established fact: Jim Sanborn created an encrypted sculpture. Ed Scheidt advised on the cryptographic methods. The sculpture contains four sections. Three have been solved. K4 has not. Sanborn knows the answer. He has a fail-safe. He’s dropped clues: BERLIN, CLOCK.

Here’s what isn’t established: what K4 says. What encryption method it uses. Whether the deliberate misspellings in K1 through K3 are clues to K4 or just artistic affectation. Whether the Morse code elements of the sculpture provide K4 hints. Whether the CIA or NSA has solved it internally. Whether anything is buried on the grounds of CIA headquarters.

And here’s what might be the most maddening thing about Kryptos: the answer is right there. It has always been right there, cut through copper, sitting in water, in the open air, at one of the most surveilled facilities on the planet. The plaintext exists. Someone, somewhere, knows what it says. Ninety-seven characters. Eighty-some words at most. Probably fewer. A sentence or two. A fragment. A whisper hammered into metal.

Thirty-five years, and counting.

Timeline

• 1988 — Jim Sanborn approaches Ed Scheidt to collaborate on an encrypted sculpture for CIA headquarters
• November 3, 1990 — Kryptos is dedicated at the CIA’s New Headquarters Building courtyard in Langley, Virginia
• 1992 — First known public attempts to solve the cipher begin circulating
• February 1998 — CIA analyst David Stein announces solutions to K1, K2, and K3 internally; the CIA classifies the achievement
• 1999 — An NSA team independently solves K1, K2, and K3 using computational methods; solutions are eventually made public
• 2005 — Sanborn confirms that the misspellings in the solved sections are deliberate
• 2010 — Sanborn reveals that K4 plaintext characters 64-69 spell “BERLIN”
• 2014 — Sanborn reveals that K4 plaintext characters 70-74 spell “CLOCK”
• 2020 — On the sculpture’s 30th anniversary, Sanborn discusses a “fail-safe” plan for revealing the solution after his death
• Present — K4 remains unsolved, with no credible public claim of a breakthrough

Sources & Further Reading

• Dunin, Elonka, and Klaus Schmeh. Codebreaking & Cryptograms: A Practical Guide. Robinson, 2020.
• Stein, David. “Solving the CIA’s Kryptos Sculpture.” Studies in Intelligence, CIA Center for the Study of Intelligence, 1999.
• Zetter, Kim. “The Untold Story of the Man That Cracked the Code at the CIA.” Wired, January 2005.
• Zetter, Kim. “Kryptos Creator Throws Codebreakers a Bone.” Wired, November 2010.
• Zetter, Kim. “Kryptos Creator Reveals New Clue.” Wired, November 2014.
• Sanborn, Jim. Interviews and public statements, 1990-2020.
• The Kryptos Group archives (online community discussion, 1999-present).
• “Kryptos,” CIA Museum Virtual Tour. Central Intelligence Agency, Langley, Virginia.
• Schmeh, Klaus. “Kryptos,” Cipherbrain blog, ongoing coverage and analysis.

Related Theories

• Cicada 3301 — another cryptographic puzzle of unknown origin, possibly connected to intelligence recruitment
• Voynich Manuscript — a medieval manuscript written in an undeciphered script that has resisted centuries of analysis
• Number Stations — mysterious shortwave radio broadcasts widely believed to be intelligence communications