K4: The 97-Letter Riddle the CIA Has Walked Past Every Day for 35 Years Without Solving

In a world that trusts the CIA to keep secrets, the agency spent 35 years walking past four lines of code on its own lawn that no one inside Langley could break. The lines belong to Kryptos, the copper sculpture dedicated at CIA headquarters on November 3, 1990. Of its four encrypted passages, three were solved by the late 1990s. The fourth — known as K4, a mere 97 characters — is still open. It is arguably the most famous unsolved cipher on Earth, and it is bolted to the courtyard of the institution whose job is breaking exactly this.
The sculpture is the work of artist Jim Sanborn, who built its cryptographic machinery with Edward Scheidt, a man who had just retired as chairman of the CIA's Cryptographic Center. The agency's own public account of Kryptos confirms the basic, almost embarrassing facts: four messages, three solved, one — K4 — unsolved. When the government itself documents a coded message on its grounds that it cannot read, the conspiracy is no longer a theory. It's an exhibit.
That three of the four were cracked is what proves K4 is a real cipher and not decorative gibberish. K1 through K3 were solved by 1999 — by hand by a CIA analyst named David Stein, independently by computer by scientist Jim Gillogly, and reportedly by the NSA on its own track. They used different classical methods — a modified Vigenère for the first two, a columnar transposition for the third — and decrypted to real English, including a deliberately misspelled "iqlusion" and a paraphrase of the moment Howard Carter peered into Tutankhamun's tomb. The cipher systems are documented and the plaintexts are public. K4 is the same kind of beast, just smaller and meaner.
And small is the whole problem. K4 is only 97 letters long. Modern cryptanalysis — frequency analysis, hill-climbing solvers, neural networks — feeds on statistical mass, and 97 characters starve it. The same machine-driven brute force that eventually demolished the Zodiac killer's 340-character cipher has nothing like enough material to work with here. Worse, Sanborn appears to have used a non-standard or layered technique that defeats the assumptions solvers bring to a textbook cipher. The result is a passage short enough to print on a business card and hard enough to outlast its own author.
Which is why the most telling evidence comes from Sanborn himself. Now in his late seventies and worried the solution will die with him, he has released a trickle of confirmed cribs: letters 64 to 69 of K4 decrypt to BERLIN, the following letters to CLOCK, positions 22 to 25 to EAST, and 26 to 34 to NORTHEAST. He has also warned that even once K4 is decrypted, the plaintext will be a riddle of its own, pointing somewhere beyond the sculpture. A creator does not hand out clues to a puzzle people are about to solve. He hands them out when he has watched the planet fail at it for three decades and started counting his own remaining years.
The honest, skeptical read keeps the awe in proportion. "Unbreakable" is doing a lot of work in the headlines. K4's resistance is most plausibly explained by mathematics, not mystique: too few characters for statistical attack, plus one unconventional method that voids the standard playbook. It is entirely possible a single solver, on a single afternoon, will spot the trick and the whole thing will collapse like K1 through K3 did — at which point we'll wonder how it held out so long. The leaked clues, far from deepening the mystery, are an artist quietly de-risking the possibility that his secret outlives him.
Still, the image refuses to fade. The agency that reads the world's mail commissioned a monument to the unreadable, helped design it, set it in the dirt where its own cryptanalysts pass it daily — and lost to it on home ground for thirty-five years. Sanborn has said part of the point was to taunt that very institution. So the unresolved question is the same one carved, in effect, into the courtyard itself: if the people whose entire trade is secrets can't read the four lines outside their own windows, how much of what they tell us they've decoded should we take on faith?
Primary sources
Evidence & links (3)
See what people are saying about this story on X.
