In a courtyard at the headquarters of the Central Intelligence Agency stands a sculpture with a secret message written on it that the Central Intelligence Agency cannot read. It has been there since 1990. Employees walk past it on the way to lunch. The most sophisticated codebreaking outfit in human history installed a puzzle in its own backyard and then failed to solve it for the next thirty-five years.
The sculpture is called Kryptos. A curving copper screen about ten feet tall, with roughly 1,800 letters cut clean through it. Those letters hold four separate encrypted messages. Three of them have been solved. The fourth has beaten everyone — the amateurs, the public, the CIA, and the National Security Agency, which is, on paper, the finest collection of codebreakers on Earth. They eat lunch next to it too.
It was beaten in the end. Just not by anyone who could read it.
An Artist and a Wizard
Kryptos was commissioned in the late 1980s for the CIA's new headquarters building at Langley, Virginia, and the man who made it was an artist named Jim Sanborn. Sanborn was not a cryptographer. So the agency loaned him one — Ed Scheidt, the retiring chairman of the CIA's Office of Communications Security, informally called the Wizard of Codes — who walked him through a stack of classical encryption techniques. Sanborn took those techniques home and deliberately made some of them harder. He was handed the keys by the CIA and used them to lock the agency out.
He didn't even hide the method. Part of the decryption key is carved into the sculpture itself, in plain sight, as a lettered table running down one side. The instructions are printed on the lock. It helped considerably less than you'd think.
Encrypted art is Sanborn's entire medium. He makes sculptures that project secret Russian text across gallery walls, cylinders wrapped in code, pieces whose subject is information you are specifically not allowed to have. Kryptos is just the one he installed inside the building most annoyed by it.
It became famous well beyond the spy world. Dan Brown tucked references to it onto the dust jacket of The Da Vinci Code. An online community has been picking at it for decades. Kryptos turned into that rare thing — a government art commission with a fan base. Most public sculpture gets ignored. This one has people who have given it years of their lives and received, in return, a sealed envelope's worth of nothing.
Three Out of Four
The first three sections fell, eventually. And this is the part the agencies would rather you didn't dwell on. The NSA quietly cracked the first three in 1992 and told no one. A CIA analyst named David Stein solved them on his own in 1998, with a pencil, and told almost no one. The public got there in 1999, a year behind, by way of a computer scientist named Jim Gillogly, working from his house in California. The spy agencies beat the public by years, solved three-quarters of the sculpture, and earned the exact same reward as everyone else. They got stuck on part four.
The first message is almost gentle. Decoded, it reads: Between subtle shading and the absence of light lies the nuance of iqlusion. "Iqlusion" is not a typo — it is a deliberate misspelling, one of several salted through the plaintext for reasons Sanborn declines to fully explain. He wrote the passage himself. It is the sculpture, quietly, describing what it does to you. You are meant to stand in the nuance between knowing and not knowing. Most people just stand there not knowing.
The second message describes something invisible, "gathered and transmitted undergruund" — also on purpose — and gives a set of latitude and longitude coordinates. A location on the CIA's own grounds. A coded message on a CIA sculpture telling CIA employees that something is buried nearby. As far as anyone will admit, no one has gone and dug.
The third message isn't even original. It is a paraphrased passage from the diary of Howard Carter, the archaeologist who opened the tomb of Tutankhamun, describing the moment he first peered inside the chamber. A secret code, guarded for years by the world's best cryptanalysts, decrypted at last into a man asking "can you see anything?" — which, for everyone still stuck on part four, is a slightly pointed question.
At the dedication in November 1990, the director of the CIA was handed a sealed envelope said to hold the solution. Sanborn later admitted the envelope never contained the full answer in the first place. So the agency has, technically, been holding a cheat sheet to this puzzle since 1990. It's incomplete, it didn't matter, and they still couldn't finish.
There is also the correction. In 2006, Sanborn quietly admitted he'd made an error carving one section — dropped a letter — which had thrown off everyone trying to decode the passage using the surrounding characters. The man who built the puzzle had put a bug in it and hadn't noticed for sixteen years. Even the author, it turns out, couldn't entirely read his own sculpture.
Part Four
Part four is 97 letters long. That's the whole thing. Ninety-seven letters. It has not been solved by anyone, by any method, in public, since the sculpture went up in 1990. Whatever Sanborn did to those last ninety-seven characters, he did it well enough to outlast thirty-five years of the smartest people alive, using a system that, to this day, no one else has identified.
Over the decades, Sanborn has, out of a mixture of pity and self-preservation, let slip a few clues. In 2010 he confirmed that a stretch of letters, decrypted, spell BERLIN. In 2014 he added CLOCK. In 2020 he added NORTHEAST and EAST. "Berlin Clock" refers to the Mengenlehreuhr — an actual clock in Berlin that tells the time in stacked rows of colored lights, using set theory, because naturally it does. These clues have helped the public arrive at precisely nowhere, but with noticeably more confidence.
The clues are partly self-defense. For decades Sanborn has been buried in wrong solutions from people utterly certain they've cracked it. So he set up a system. If you want him to check your answer, you pay him $50. He is a man so relentlessly informed that he's wrong about his own sculpture that he began charging admission to the experience of being told no.
The effort thrown at those 97 letters is hard to overstate. Professional cryptographers. University teams. A devoted online community running the ciphertext through every method in the literature. Decades of computing power aimed at a sculpture outside a cafeteria. And the breakthrough, when it came, would come from a man reading the artist's mail.
Riddle Inside a Riddle
Here is the detail that quietly breaks people. Even if you solve part four, you don't get an answer. You get another puzzle. Sanborn has confirmed that the plaintext of part four, once decrypted, is itself a riddle — pointing to a further stage he refers to as part five. The prize for cracking the most famous unsolved code on Earth is more homework. Set by the same man. Who will, presumably, charge you $50 to grade it.
No one really knows how deep it runs. Part five may not be the bottom either. Sanborn built the thing in 1990 and has spent every year since as the only person alive who knows where it ends. He is the single human being who can confirm the puzzle even has a final answer.
The Filing Cabinet
Which brings us to 2025, when the code was finally beaten. Sort of.
Getting on in years, Sanborn decided to sell the solution and his supporting archive at auction. The listing noted that his original papers were held at the Smithsonian American Art Museum, where he had deposited them over the years. Two writers asked to look at those papers. And there, sitting in the donated files, in the artist's own folders, was the plain, unencrypted answer to part four.
The code that beat the NSA, the CIA, and thirty-five years of obsessive amateurs had been sitting in a labeled folder in a museum archive the entire time. Nobody broke the cipher. Somebody asked a librarian. The encryption held perfectly for three and a half decades. It was the filing that finally gave out.
Sanborn was not thrilled. He confirmed the journalists had it right, asked them not to publish the solution, and the archive was resealed. The auction went ahead regardless. In November 2025, the solution and Sanborn's papers sold for $962,500. Nearly a million dollars for the answer to a riddle — on the understanding, more or less, that the buyer would keep the answer to themselves.
The buyer was anonymous, and reportedly agreed to become the puzzle's new keeper: to hold the solution and leave the public challenge standing. So somewhere out there is a person who paid the price of a house to own the ending of a riddle and promise not to spoil it. Which may be the most anyone has ever spent on the right to keep a secret they didn't make.
Unreadable, Technically
Part of why Kryptos gripped people for so long is that it sat in a perfect blind spot. Famous enough to matter. Solvable-looking enough to attempt. And just barely too hard to finish. For thirty-five years it offered exactly enough hope to keep brilliant people coming back, and exactly nothing to hand them. And then, in the end, it wasn't solved at all. It was just found.
The situation today is genuinely absurd. The answer to part four exists. A private buyer owns it. A few journalists have read it. Almost no one else is permitted to. The cipher itself has still never been cracked. The sculpture still stands in the courtyard, unreadable, in front of the agency that paid for it.
Thirty-five years on, the CIA still walks past a secret it cannot read, on the way to the cafeteria, every single day.
