Kryptos K4
Three sentences solved and 97 characters remaining
▲ Cover of the incident – Unfolding the records
The sculpture ‘Kryptos’ installed at the CIA headquarters contains four code sections. K1-K3 have been solved, but there has been no agreed-upon decipherment of the last one, K4, over 30 years after its release.
The difficulty of K4 lies not only in its complexity, but also in its short length and unknown rules. The correct answer must explain the entire string and the revealing clue simultaneously.
Prologue: The night that broke records
When I laid out the case data on my desk, the first thing I noticed was not the correct answer but an imbalance. Some scenes were overly clear, and some time periods were completely blank. People try to explain the entire incident by focusing on one clear scene, but I instead marked the blank section first. Mysteries can arise because there are many clues, but they can also arise because the distance between clues is too great.
Artist Jim Sanborn installed the sculpture in 1990 and enlisted the help of former CIA cryptographer Ed Shayt. The piece contains a combination of cipher text and visual structure.
I did not view this incident as confirming an already known conclusion. The records were arranged chronologically, the movement paths of objects were drawn separately, and sightings and interpretations were indicated in different colors. The most popular explanations were then deliberately reviewed last. Because when you first read a famous hypothesis, all the clues seem to exist for that hypothesis.
▲ On-site reconstruction — last confirmed movement route
Case Files: What I Could Believe
| number | confirmed record | current reliability |
|---|---|---|
| 1 | K1 and K2 were solved using a modified Vigener series method. | high |
| 2 | K3 quotes Howard Carter's account of Tutankhamun's tomb by way of transposition. | high |
| 3 | K4 is short at 97 characters, making statistical analysis difficult. | middle |
| 4 | Sanborn released plaintext clues like BERLIN, CLOCK, NORTHEAST, and EAST. | middle |
The exact encryption scheme of K4, the key, its connection to the overall structure of the piece, and the final meaning of the plaintext remain to be determined.
The sentence ‘It is not explained’ is not the same as the sentence ‘It is supernatural’ or ‘Someone intended it’. I didn't use the blank space as evidence.
▲ Timeline – Flow before and after the event
Reconstructing the Scene: Finally, a Certain Point
I changed the location where the incident took place to the actual route rather than the stage in my head. We divided the starting point, final confirmation point, and discovery location and calculated the time needed in between. In the process, several later dramatic depictions were omitted. Instead, the recorded sounds, weather, means of transportation, and locations of objects came to the fore. The novelistic atmosphere arose from the very texture of the facts. There was no need to add unidentified secret passageways or nameless accomplices.
When reconstructing the last scene, I did not determine the character's feelings. The same behavior can be caused by fear, planning, mistake, or fatigue. So, I wrote down the actions first and left the emotions to the extent possible. Thanks to this principle, events became less flashy but more concrete.
Clue 1. K1 and K2 were solved using a modified Vizner series method.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried it against the next record, “K3 quotes Howard Carter’s account of Tutankhamun’s tomb by way of transposition.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Is the BERLIN CLOCK a world clock or a specific clock device?” will ignore the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 1 — Traces left by records
Clue 2. K3 quotes Howard Carter's account of Tutankhamun's tomb by way of transposition.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. However, I immediately tried the next record, “K4 is short at 97 characters, making statistical analysis difficult.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Are NORTHEAST and EAST directions or text manipulation commands?” will ignore the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 2 — Pieces that do not fit together
Clue 3. K4 is short at 97 characters, making statistical analysis difficult.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried it against the next record: “Sanborn Reveals Plaintext Clues Like BERLIN, CLOCK, NORTHEAST, EAST.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Could the letter that appears to be an error in K1~K3 be the key to K4?” ends up ignoring the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
▲ Key Clue 3 — Evidence that shakes the hypothesis
Clue 4. Sanborn revealed plain text clues: BERLIN, CLOCK, NORTHEAST, EAST.
I placed this sentence in the middle of the case record and checked the tense first. It was differentiated from who observed it and when, and whether it was written down on the spot or added from memory later. The older the clues to an unsolved case, the more seamless the story becomes. However, what is needed in an investigation is not smoothness but provenance. The moment I discerned whether this clue was a direct observation, a trace left by an object, or someone's interpretation, the outline of the incident changed.
If we leave out this clue, a one-way conclusion seems very plausible. But I immediately tried it against the next record, “K1 and K2 solved in a modified Vigener series method.” If the two do not naturally coexist in the same explanation, the explanation is still just a story. In particular, a hypothesis that does not pass the question “Is the BERLIN CLOCK a world clock or a specific clock device?” will ignore the rest of the record instead of explaining one clue.
So I created three spaces in my case notes. The first is a confirmed fact, the second is an inference that goes one step further from the facts, and the third is a possibility that cannot be selected without additional evidence. This clue is a mixture of parts that are close to the first space and parts that stay in the second space. I didn't erase that boundary. Leaving boundaries is the only way to modify your reasoning later when new records emerge.
put three hypotheses on the same scale
Hypotheses were not evaluated in fancy sentences. We wrote down the number of explanatory clues, the number of new assumptions required, and the degree to which they can withstand contrary evidence. Even if one clue is completely explained, if the remaining three clues have to be discarded, it is not a good hypothesis.
Hypothesis A. Multi-step encryption that modified the rules of the previous section
The advantage of this explanation is that it accepts the proviso that “K1 and K2 were solved using a modified Vizner series method” with relatively few assumptions. I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “K4 is short at 97 characters, making statistical analysis difficult.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis B. Cryptography using the direction/shadow of the physical piece as the key
The beauty of this explanation is that it makes relatively few assumptions about the proviso “K3 quotes Howard Carter’s account of Tutankhamun’s tomb by way of transposition.” I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “Sanborn released plaintext clues such as BERLIN, CLOCK, NORTHEAST, and EAST.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
Hypothesis C. How to combine public words with coordinates or time devices
The advantage of this explanation is that it accepts the proviso “K4 is short at 97 characters, making statistical analysis difficult” with relatively few assumptions. I first assumed that this hypothesis was true and re-traced the event from beginning to end. Each sentence linked where and what the character saw, what judgment he made, and then moved to the next location. There was always a hidden assumption at the point where the connection was lost.
The biggest weakness is that it does not sufficiently explain “K1 and K2 were solved using a modified Visner series method.” If you keep adding exceptions to your hypothesis, you can explain anything, but such an explanation predicts nothing. I lowered the score of the hypothesis the moment there were more than two exceptions. Conversely, scores were increased only when two independent clues pointed in the same direction.
In the end, this hypothesis cannot be completely discarded, but it cannot be taken as a conclusion either. If you read the incident like a novel, the blank spaces will be filled in naturally. If you read it like an investigation record, the blank spaces remain. I chose the latter. Even if the blank space left is inconvenient, that inconvenience protects the scope of what the evidence can say.
▲ Comparison of hypotheses – explanatory power and gaps
Conclusions I threw away
When I began my investigation, I too was drawn to the most popular explanation. It summed up events in one sentence and gave intention to every object. But when the data was collated, the explanation required a new coincidence for every blank space. I erased that conclusion and started again. Good reasoning is less about adding things and more about removing unnecessary assumptions.
The fact that the cue word falls into the correct position is a strong criterion for validating a decoding candidate. However, a rule that only matches some words may be overfitting and must reproduce all 97 characters.
In particular, details repeated in later testimonies and on the Internet were separated from the original records. Just because the same sentence appears in multiple places does not mean there are multiple independent sources. First, we checked the possibility that a single incorrect sentence was duplicated. After going through this process, the size of the case decreased, but the weight of the remaining clues actually increased.
▲ Counterevidence check — the conclusion I discarded
Final Reason: What I arrived at
The difficulty of K4 lies not only in its complexity, but also in its short length and unknown rules. The correct answer must explain the entire string and the revealing clue simultaneously.
This conclusion is not a completely definitive ruling. This is a direction that requires the fewest assumptions and simultaneously explains the most clues within the currently available records. It may be revised as new physical evidence emerges. However, it is also clear that the conclusion may change depending on what comes out. Reliable original records, verifiable forensic data, and independent evidence directly linking objects and people are needed.
I do not write that the case is closed. Instead, write down how far you can close it. That boundary is the result of this investigation. The fun of mystery is not that anything is possible. The goal is to find out which of the possible explanations can be discarded.
▲ Final judgment – explanation that requires the fewest assumptions
Additional Investigation Records 1. Redraw the timeline
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only the record was “K1 and K2 were solved using a modified Visner series method.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis of “a multi-level cipher that modified the rules of the previous section.” At first everything seemed to fall into place. However, when asked the question “Is the BERLIN CLOCK a world clock or a specific clock device?” a weak point in the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 2. The missing link
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the following record: “K3 quotes Howard Carter’s Tutankhamun tomb record by way of transposition.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
On top of that, I put the hypothesis of “a cipher that uses the direction and shadow of the physical piece as a key.” At first everything seemed to fall into place. However, when we substituted the question “Are NORTHEAST and EAST directions or text manipulation commands?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 3. Witness distance
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only a record was left: “K4 is short at 97 characters, making statistical analysis difficult.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “a method of combining public words with coordinates or time devices.” At first everything seemed to fall into place. However, a weak part of the explanation was revealed when we substituted the question, “Could the letter that appears to be an error in K1~K3 be the key to K4?” Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation record 4. The path the object took
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only the record was “Sanborn revealed plaintext clues such as BERLIN, CLOCK, NORTHEAST, and EAST.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put the hypothesis of “a multi-level cipher that modified the rules of the previous section.” At first everything seemed to fall into place. However, when asked the question “Is the BERLIN CLOCK a world clock or a specific clock device?” a weak point in the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional investigation records 5. Temptation of false clues
At dawn, I opened the case sheet again. This time, the conclusion was obscured and only the record was “K1 and K2 were solved using a modified Visner series method.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
On top of that, I put the hypothesis of “a cipher that uses the direction and shadow of the physical piece as a key.” At first everything seemed to fall into place. However, when we substituted the question “Are NORTHEAST and EAST directions or text manipulation commands?” a weak part of the explanation was revealed. Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
Additional Investigation Record 6. Reconstruction of the final scene
At dawn, I opened the case sheet again. This time, the conclusion was obscured, leaving only the following record: “K3 quotes Howard Carter’s Tutankhamun tomb record by way of transposition.” Even events you thought you already knew reveal a completely different picture if you erase the conclusion. I lined up the locations and times and wrote down the minimum travel time. The gaps between records were not filled by imagination but were marked with empty squares. As the square grew, the reliability of the hypothesis explaining that section decreased.
Above that, I put a hypothesis called “a method of combining public words with coordinates or time devices.” At first everything seemed to fall into place. However, a weak part of the explanation was revealed when we substituted the question, “Could the letter that appears to be an error in K1~K3 be the key to K4?” Hypotheses must withstand questioning. If you keep bringing in new characters or coincidences to avoid questions, from that moment on, it becomes creation rather than reasoning. I used my creative sense only for the mood of the sentence and did not place it in the place of facts.
The results I got from this section are neither a definitive name for the culprit nor a complete decipherment. Instead, it became clear which explanations required fewer assumptions and which ones flipped when new discoveries were made. Even if the case cannot be closed, it is possible to narrow the scope of the investigation. This record is intended to leave behind that narrowed boundary.
▲ End of investigation record — Questions still remaining
· CIA Museum — Kryptos Sculpture
· Jim Sanborn Official Kryptos Resources
※ This article is a commentary in the form of a personal investigation record based on public records and reliable data. We distinguish between facts and inferences, and we update our judgments when new official announcements are made.
Image sources and editing
Openly licensed material from Wikimedia Commons was used by cropping, scaling, and color correcting to fit the flow of the text. Episodes with mixed generated images are not included in the list below.
- Kryptos sculptor.jpg — Jim Sanborn, CC BY-SA 3.0
- Kryptos01 1, background removed.png — Kryptos01_1.jpg : Jim Sanborn derivative work: Minh Nguyễn ( talk , contribs ), CC BY-SA 3.0
- Kryptos background.png — Kryptos01_1,_background_removed.png : * Kryptos01_1.jpg : Jim Sanborn derivative work: Minh Nguyễn ( talk , contribs ) Kryptos01_1.jpg : Jim Sanborn derivative work: Minh Nguyễn ( talk , contribs ), CC BY-SA 3.0
- Art made of "code" named Kryptos sits on the grounds of the C.I.A. Headquarters in Virginia LCCN2011631531.tif — Carol M. Highsmith, Public domain
'Symbols' 카테고리의 다른 글
| Cicada 3301: An anonymous organization that identifies real puzzles with PGP signatures (0) | 2026.07.27 |
|---|---|
| Voynich Document: Five things to check before claiming to have deciphered it (0) | 2026.07.27 |
| 니힐리스트 암호, 두 개의 키를 빼야 숫자가 글자가 된다 (0) | 2026.07.26 |
| 포스퀘어 암호, 네 개의 표 중 하나라도 바뀌면 (0) | 2026.07.26 |
| 트리피드 암호, 한 글자를 세 좌표로 나누는 순간 (0) | 2026.07.26 |