The short version. Nothing on this list has an accepted reading. Five entries are genuinely open: a workable amount of
ciphertext and a method that could still be recovered. Five more need a source nobody has: a transcription, a codebook, a
book, or a better scan. Nine are too short for any reading to be proved, and several of those have been attacked to exhaustion.
Two probably hold no message, one is unbreakable without its key material, and three are undecided. The page ranks interest, not
difficulty: ranked by tractability, Debosnys, Kaliningrad and the diplomatic codes of 1917–21 would come first.
01 How it was ranked
Three things count, in this order. The thing must be a cipher, with a message hidden from readers who did not hold the key, which rules out every lost script (see below). There must be enough ciphertext on paper for a solution, if one turned up, to be proved against the text. And the story must be worth a reader’s time. The first two are checkable and the third is a judgement, so the order inside each band is mine. The tag on each row says why the cipher is still unsolved:
| tag | what it means |
|---|---|
| open | A genuine cipher of workable length where the method is plausibly recoverable. Effort can still pay. |
| needs a source | The ciphertext is real and long enough, but a transcription, a key, a codebook or a better scan is missing. Nothing more can be done from the text alone. |
| unprovable | Real encipherment, but so short, or with so much room in the key, that many readings fit and none can be demonstrated. |
| probably no message | Our tests, and most of the literature, point to a text that was constructed, botched or never enciphered. |
| unbreakable | Without the original key material the answer is not in the ciphertext. |
| undecided | Two live explanations, or a disputed claim, and no test yet separates them. |
02 The list
| # | Cipher | Why it holds out | Where it stands, 5 November 2026 |
|---|---|---|---|
| 1 | Kryptos K4 CIA, Langley, 1990 97 characters | open | The method is unbroken. Kobek and Byrne recovered the plaintext from Sanborn’s papers in 2025, which they say is not a cryptographic solve, and the archive sold in November 2025 for $962,500. Paradigm, the buyer, now runs a verifier that checks a candidate without revealing the answer. The plaintext is unpublished. |
| 2 | The Beale papers, B1 and B3 Virginia, pamphlet of 1885 520 and 618 numbers | probably no message | Only B2 decodes (with the Declaration of Independence). A book-cipher key scan here, over 4,254 English books, found no key, and the statistics of the numbers behave like random picks. We called it a fabrication in targets/beale. Online claims of a B1 breakthrough in 2026 give no verifiable method. |
| 3 | The Voynich manuscript Beinecke MS 408, c.1420 | undecided | Borderline for a list of ciphers. Plain and simply enciphered European language is excluded by our tests; a verbose cipher of glyph groups and structured meaningless text stay about even. Several 2026 preprints claim a reading (Italian anagrams, Elu-Sinhala, alchemy) and none is accepted. |
| 4 | Cicada 3301, Liber Primus Internet puzzle, 2012–14 | open | A book of runic pages, part solved by the community. Counts of solved pages differ between sources and this survey has not verified one: check the Uncovering Cicada wiki before quoting a number. A modern puzzle, included because it was built to be broken and has not been. |
| 5 | The Debosnys cryptograms Adirondacks, 1882–83 1,188 glyphs, 425 types | open | The 20-line cipher poem is rhyming couplets: nine of ten couplets match by their last glyph, which makes the plaintext phonetic French verse. A full transcription exists (Sektu, 2017) and was never released. The next step is a shape search for known French verse. |
| 6 | The Kaliningrad bottle post Baltiysk (Pillau), found 2015 about 1,000 characters in seven sections | needs a source | The most text of any open item on Schmeh’s list. There is no transcription, only two photographs of faint cursive in which n, u, v and w are nearly the same. An unpublished 2021 claim of a Russian Synodal Bible plaintext could be tested the day someone makes a clean transcription. |
| 7 | The D’Agapeyeff cipher Codes and Ciphers, 1939 392 digits, 196 pairs | probably no message | A 5×5 Polybius-style grid, and the book’s own worked example is a control that behaves like English. The challenge does not: its frequencies, repeats and periodicity all look like a near-uniform random sequence. The author said he could no longer decipher it. The likeliest reading is a botched encipherment (targets/dagapeyeff), which cannot be proved. |
| 8 | The Dorabella cipher Edward Elgar, 1897 87 symbols | unprovable | Wase (2023) finds it unlikely to be a monoalphabetic English or Latin text, which undercuts most claimed readings at the root. A 2025 paper offers a musical reading as a hypothesis. 73 rounds of attack here, the latest on 29 October 2026, were all negative. |
| 9 | The Scorpion letters S1 and S5 United States, 1991 70 and 180 symbols | unprovable | S5 behaves as 16 rotating alphabets, with every repeat at a multiple of 16. Both letters carry more key than the English text has redundancy (682 bits against 576), so a solver returns fluent false text. On matched controls the same annealer was only 3–13% correct. |
| 10 | The Koehler cryptograms Abwehr, New York to Hamburg to Paris, 1944 five messages, 140–237 letters | needs a source | Published by David Kahn (Cryptologia, 1981). We excluded every tractable hand system and any Enigma statistically. What survives is a mixed-tableau key from the Dutch prayer book Koehler was given, or a one-time pad, and neither can be attacked without the book or the FBI’s plaintexts (targets/abwehr). |
| 11 | The pigeon message Bletchingley, 1940s 135 letters, 27 five-letter groups | unbreakable | GCHQ’s 2019 statement: it cannot be decrypted without the original cryptographic material, and no claimed reading can be verified. A 2012 claim of a Normandy troop report was dismissed as nonsense by Bletchley Park’s adviser. |
| 12 | Urquhart’s Cyphral Distich Sir Thomas Urquhart, 1653 64 numbers, values to 70 | undecided | The numbers have the shape of an index into a book. On 31 August 2026 Vals AI announced that Claude Fable 5.1 solved it as a book cipher on the Proquiritations; a rebuttal a day later says the rule fails at 10 of 64 positions. Our own re-run on 23 October found no English (best −6.99 per character, controls to −6.22). The octastich, Urquhart’s longer cipher, is a separate matter and has a reading here. |
| 13 | Zodiac Z13 and Z32 California, 1969–70 13 and 32 symbols | unprovable | Z340 fell in December 2020. These two are too short for any answer to be proved, and 2026 has brought several confident forum and preprint readings that contradict one another. |
| 14 | The Somerton Man code Adelaide, 1948 about 45 letters | unprovable | Probably initials. The man is identified as Carl Webb (2022) but the identification did nothing for the code, and a 2021 claimed decipherment has not been verified by anyone independent. |
| 15 | German telegrams to Stockholm, July 1918 Foreign Office and Ludendorff NARA M367 | needs a source | Nine full copies in at least four numeric systems, and six Ludendorff telegrams of five-figure groups that are flat in every column. No key anywhere we could reach. Terminal-pair and page tests on 2 November were negative. |
| 16 | Bernstorff, Code 7500, second text Washington, 10 January 1917 430 groups | needs a source | The first 147 groups are Bernstorff’s telegram No. 205, matched to the German text he printed in 1920 (82 code groups). The other 430 groups use the same code and are a second text with no crib. |
| 17 | Kopp and Chicherin radiograms 1921, NARA M316 figure traffic | needs a source | No group value has been recovered for the figure traffic. Letter traffic in the same file was split off and several of its keys were recovered; the figures were not. |
| 18 | MysteryTwister “Double Column Transposition Reloaded” Parts 1–3, December 2013 | open | A modern challenge by Wacker, Esslinger and Schmeh, Level III, with no solver on record as of 24 September 2026. Closed here on 11 October 2026 with nothing to submit. |
| 19 | MysteryTwister “ASAC”, Part 4 Fendt’s series | open | Another modern challenge with no accepted solution. The keystream is the crux, and our list of key sources already ruled out is long. |
| 20 | Ricky McCormick’s notes St Louis, found 1999 | undecided | Two notes found in the victim’s pockets. The FBI’s cryptanalysis unit and the American Cryptogram Association both failed. Pelling argues it is private shorthand rather than a cipher, which no test has refuted. |
| 21 | The Moustier altar inscriptions about 100 characters on two altars | unprovable | Huylebrouck’s 2022 proposal ties it to Trithemius’s Ave Maria scheme, with each letter standing for a prayer word. The stonecutter used several L-shapes, so the published frequency counts may conflate distinct symbols. |
| 22 | The Lima, Ohio robbery cryptogram 1916 about 110 letters | unprovable | Variant transcriptions are the obstacle. Pelling proposed two alternating monoalphabets in April 2025, and the partial readings that followed disagree with one another. |
| 23 | The Copenhagen cryptogram Found behind a portrait of a Danish general three lines | unprovable | Two transcriptions, ten languages and six token conventions were tried as a simple substitution. Matched controls are recovered at 96–100% and the cryptogram never comes close (best −2.7 nats per letter), so it is not a simple substitution of any language tested, or both readings share an error. |
| 24 | The Rubin cryptogram United States, 1953 one typewritten slip | unprovable | Contains the plaintext names Dulles and Conant beside pseudo-words. No claimed solution has any standing. |
| 25 | The Shugborough inscription Staffordshire, c.1750 ten letters | unprovable | Famous, and far too short to settle anything. |
03 Left out
- Lost scripts: Linear A, the Phaistos disc, the Indus script and Rohonc. A cipher hides a message; these were written to be read by people who are gone.
- Zodiac Z340, read in December 2020. The Shanghai gold bars: 21 of 26 letters occur exactly ten times, which says they were constructed, not enciphered (gold bars).
- Not ciphers at all: the Rilke cryptogram (typewriter keys, Morse practice), Codex Seraphinianus (asemic by its author’s statement), the YOG’TZE case (closed as an accident), and the Riverbanks Ripper (an April Fools’ joke of 2017).
- Read since Schmeh’s list: Rivest’s timelock (2019), Bonus 22 (2018), the crypt cryptograms (2019), the silk dress cryptogram (2023), Ferdinand III’s letters (2017).
04 Claims to watch
Several readings have been announced in 2026 and none is accepted. A claimed reading counts when someone else can run it and when the same method, run on a matched control with no message in it, returns nothing readable. Urquhart’s distich, Zodiac Z13 and Z32, the Voynich preprints and the Beale “breakthrough” have not been shown to pass that test. A different kind of claim is real but not a solve: Kryptos K4’s plaintext surfaced from an archive, and the cipher that produced it is still unexplained.
05 Sources
- Klaus Schmeh, The Top 50 unsolved encrypted messages, with our status re-check in
research/top50/NOTES.md. - Elonka Dunin’s list of famous unsolved codes.
- RR Auction on the Kryptos K4 find and Paradigm’s Kryptos page.
- Vals AI on the Cyphral Distich and its rebuttal at lilting.ch.
- Zenodo preprint on Zodiac Z13 (a claim, not a result), the Art Newspaper on the Naibbe cipher, and the arXiv paper on a musical Dorabella.
- Working notes and reproducible code:
targets/andresearch/mtc3/in the repository. Entries 4, 20 and 22–25 rest on published sources only; no work has been done on them here.
Cite this page
Daniel Bourdeau, “Top 25 unsolved ciphers”, Cyphersolver, posted 5 November 2026, https://cyphersolver.com/top25.html.