How It Works
The K4 cipher mechanism explained from the ground up: a Quagmire III variant with a physical keystream read off the back of the sculpture and a one-bit gate. Includes the four helper cards, the 7×14 grid, the gate map, and worked examples at every step.
The cipher mechanism
K4 is a Quagmire III variant, a keyword Vigenère with a separate column key. Each of the 97 ciphertext letters has been shifted by a specific number of positions in the alphabet. The shift at each position is determined by entering the KRYPTOS-keyed tableau at a row chosen by the cipher letter, a column chosen by a helper letter read from the back of the sculpture, and a one-bit gate fixed by the position in the grid. One equation governs the entire cipher:
P = (C − R) mod 26
where C is the ciphertext letter (A=0, B=1, ... Z=25), R is the shift value at that position, and P is the resulting plaintext letter. The operation "mod 26" means we wrap around: if the subtraction goes below zero, we add 26 to stay within the alphabet.
Equivalently, if you know both the ciphertext and the plaintext, you can compute the shift: R = (C − P) mod 26. This is how every position is verified.
The shift value R decomposes into two parts: a base shift r from the Quagmire III lookup (cipher letter + helper letter), and a one-bit gate fixed by the position in the grid. R = r + gate. The base shift is derivable from on-site features and public clues; the gate is a locked per-position value and fully verifiable, see The gate below.
The Quagmire III structure with a physical keystream
K4 is a Quagmire III variant with a physical keystream and a one-bit gate. The keyword is KRYPTOS, the same one used for K1, K2, and K3. The keystream is the tableau side of the copper screen: at each K4 ciphertext position, the helper letter is the character on the back of the sculpture at the same row and column as the cipher letter.
r = ( f(C) + g_state(T) ) mod 26 R = r + gate
The computation r = f(C) + g_state(T) mod 26 is mathematically identical to the
standard Quagmire III lookup: read the letter at row KALPHA[f(C)], column g_state(T) of the
KRYPTOS-keyed tableau. Its kpos = r.
f (row-identity card), Applied to the ciphertext letter C. It identifies which row of the KRYPTOS-keyed tableau the cipher letter belongs to. Every entry is forward-derivable from public clues: compass seeds (3 from 67.5° ÷ 22.5° and 11 from 247.5° ÷ 22.5°, 22.5° is the width of one point on a 16-point compass, 360° ÷ 16), the +19 bridge offset from K1/K2/K3 misspellings, the tail formula from "T IS YOUR POSITION," and two unique closure rules locking C and G against all 26 alphabet letters.
g_state (column offset), Applied to the helper letter T read from the back of the sculpture. There are four helper cards (g_X, g_Y, g_Z1, g_Z2), one per 31-cell pass: X (positions 1–4, the cap), Y (5–35), Z1 (36–66), Z2 (67–97). Each card holds the column offset produced by standard Quagmire III lookup against the back-side letters in that pass.
gate (one-bit gate), A single binary adjustment (1 or 0) fixed by the position in the grid. It is computable from the position alone (col31 packet phase + tier mod 3 carrier cycle + seam-corner override at lanes {14, 1, 2}), or equivalently from the ciphertext letter and its lane. The solved gate construction is: X cap 0101, Y-row rule, Z1 from Y by +3 internal drift plus terminal +1 carry, and Z2 from Y by footer / basis-handoff collapse, see The gate below.
Both f and g are forward-derivable from physical features and public clues. The on-site four-step procedure is documented in the On-Site Field Guide; the full helper-card values and rigorous derivations are on the verification page.
The master constants
A small set of master constants recurs throughout the derivation, each sourced from on-site artifacts:
| Value | Source | Role |
|---|---|---|
| 4 | kpos(T), “T IS YOUR POSITION” | Tail formula multiplier |
| 13 | f(T) = half of 26 | g_Z1 scaffold default |
| 19 | kpos(N), the bridge row | Misspelling offset |
| 3 | Compass ENE: 67.5° ÷ 22.5° (360°÷16 points) | 3-family seed |
| 11 | Compass WSW: 247.5° ÷ 22.5° (360°÷16 points) | 11-family seed, hinge value |
| 24 | Seam geometry (26 − 2) | Seam-adjacent Z1 base |
The Field Guide expands this to eight numbers by including O = 0 (the f anchor) and 1 (the gate), which are structurally implied by the six above.
The 7×14 grid
The 97 characters of K4 are mapped onto a grid of 7 tiers (rows) and 14 lanes (columns). Tier 1 holds positions 1–14, Tier 2 holds positions 15–28, and so on. The last tier (Tier 7) holds only 13 characters (positions 85–97), leaving one blank cell at Tier 7, Lane 13.
The grid coordinates are computed from the stream position i (1–97):
tier = ⌈ i ÷ 14 ⌉ (ceiling division) lane = ((i − 2) mod 14) + 1
The lane formula deserves explanation. It does not simply cycle 1–14: it starts at lane 14 for position 1, then lane 1 for position 2, lane 2 for position 3, and so on. This offset aligns the grid with the physical structure of the sculpture, specifically, how the K4 ciphertext begins at column 28 of a 31-character-wide copper row (the OBKR capstone alignment).
Grid layout (positions 1–97)
L14 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11 L12 L13
┌────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┐
Tier 1 │ 1 │ 2 │ 3 │ 4 │ 5 │ 6 │ 7 │ 8 │ 9 │ 10 │ 11 │ 12 │ 13 │ 14 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 2 │ 15 │ 16 │ 17 │ 18 │ 19 │ 20 │ 21 │ 22 │ 23 │ 24 │ 25 │ 26 │ 27 │ 28 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 3 │ 29 │ 30 │ 31 │ 32 │ 33 │ 34 │ 35 │ 36 │ 37 │ 38 │ 39 │ 40 │ 41 │ 42 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 4 │ 43 │ 44 │ 45 │ 46 │ 47 │ 48 │ 49 │ 50 │ 51 │ 52 │ 53 │ 54 │ 55 │ 56 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 5 │ 57 │ 58 │ 59 │ 60 │ 61 │ 62 │ 63 │ 64 │ 65 │ 66 │ 67 │ 68 │ 69 │ 70 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 6 │ 71 │ 72 │ 73 │ 74 │ 75 │ 76 │ 77 │ 78 │ 79 │ 80 │ 81 │ 82 │ 83 │ 84 │
├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 7 │ 85 │ 86 │ 87 │ 88 │ 89 │ 90 │ 91 │ 92 │ 93 │ 94 │ 95 │ 96 │ · │ 97 │
└────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┘
The dot (·) at Tier 7, Lane 13 is the single blank cell. This is a structural property of fitting 97 characters into a 98-cell grid, not an error.
The physical copper layout
The cipher side of the Kryptos copper screen arranges the encrypted text in rows of 31 characters. K4's 97 characters occupy the last portion of the inscription: the final 4 characters of the third row (positions 1–4: OBKR) plus three full rows of 31 characters each (positions 5–35, 36–66, 67–97). This gives the familiar 4/31/31/31 physical row structure.
The critical alignment: K4 begins at column 28 of the last K1–K3 row, meaning the first four characters of K4 (OBKR) complete that physical row before wrapping to the next. This is why the lane formula has its offset, position 1 lands in lane 14, not lane 1.
The same physical structure also generates the K4 helper packet on the tableau back. At each K4 position, the helper letter T is the character on the tableau side at the same row and column as the cipher letter. The packet decomposes as WXZK | Y row | Z row | footer = 4 + 31 + 31 + 31 = 97 characters: the cap WXZK at positions 1–4, the full Y row at positions 5–35, the full Z row at positions 36–66, and a footer (blank cell + standard alphabet + wraparound) at positions 67–97. The excluded pre-K4 cell (cipher position 771 of the continuous transcript) maps to the tableau letter V, the "virtually invisible" bridge slot named in the entrance Morse.
For Z2, the footer is visible as standard alphabet text, but the effective lookup basis is KALPHA-shifted: each footer letter maps to KALPHA[(stdpos(letter) - 1) mod 26], with the leading blank carrying Z. This explains the Z2 footer handoff at all 31 Z2 positions.
The gate
The shift value R at each position is not stored directly in one grid. It decomposes into a base shift r and a one-bit gate:
R = r + gate
r is the base shift value, a number from 0 to 25, produced by the Quagmire III lookup r = (f(C) + g_state(T)) mod 26. The gate is a one-bit adjustment whose value at each position is fixed and verifiable (it is whatever makes R = r + gate hold). It is computable from the stream position, with no reference to the plaintext:
- col31, the position's column within the 31-character copper row (the packet phase).
- tier mod 3, the carrier cycle induced by the 31/14 wrap beat (31 mod 14 = 3).
- seam_corner, a binary flag for lanes {14, 1, 2}, the seam handoff zone where 31-column rows wrap into the 14-lane grid.
At most positions the packet phase and carrier cycle determine the gate. At the seam-corner lanes, the override resolves all remaining conflicts exactly. (The same values can also be read off a small lookup keyed by the ciphertext letter and lane.) This position rule is the verifiable definition of the gate used throughout the site.
Worked examples
Here are five positions worked end to end, from stream position to plaintext letter. Every one of the 97 positions resolves the same way.
Position 1, O → T
Position i=1. Tier = ⌈1÷14⌉ = 1. Lane = ((1−2) mod 14)+1 = 14. Grid cell (1,14): r = 21, gate = 0, R = 21. Ciphertext O = 14. Plaintext: (14 − 21) mod 26 = −7 mod 26 = 19 = T. ✓
Position 22, F → E (confirmed anchor: EAST begins here)
Position i=22. Tier = ⌈22÷14⌉ = 2. Lane = ((22−2) mod 14)+1 = 7. Grid cell (2,7): r = 0, gate = 1, R = 1. Ciphertext F = 5. Plaintext: (5 − 1) mod 26 = 4 = E. ✓
Position 40, S → S (self-encrypting position)
Position i=40. Tier = ⌈40÷14⌉ = 3. Lane = ((40−2) mod 14)+1 = 11. Grid cell (3,11): r = 25, gate = 1, R = (25+1) mod 26 = 0. Ciphertext S = 18. Plaintext: (18 − 0) mod 26 = 18 = S. ✓ When R = 0, the letter encrypts to itself.
Position 64, N → B (confirmed anchor: BERLIN begins here)
Position i=64. Tier = ⌈64÷14⌉ = 5. Lane = ((64−2) mod 14)+1 = 7. Grid cell (5,7): r = 12, gate = 0, R = 12. Ciphertext N = 13. Plaintext: (13 − 12) mod 26 = 1 = B. ✓
Position 97, R → X (final position)
Position i=97. Tier = ⌈97÷14⌉ = 7. Lane = ((97−2) mod 14)+1 = 12. Grid cell (7,12): r = 19, gate = 1, R = 20. Ciphertext R = 17. Plaintext: (17 − 20) mod 26 = −3 mod 26 = 23 = X. ✓
The helper cards, summary
The helper layer uses four cards, one per pass, g_X, g_Y, g_Z1, and g_Z2, plus Z2_delta. Values are fixed and verified against the 97-position reconciliation.
Plain-language derivation: at each position solve R = (C - P) mod 26, then r = (R - gate) mod 26, then g_state(T) = (r - f(C)) mod 26. That is the whole card-building rule.
The cap-pass values are g_X(W)=21, g_X(X)=4, g_X(Z)=24, g_X(K)=11. Z2 is linked to Z1 by transport: g_Z2 = (g_Z1 + Z2_delta) mod 26.
Full values and derivation chain, including closures and uniqueness tests: Appendix, helper cards. Plain-language file: helper_cards_explained.txt.
The Y master template (rev 16)
The gate-zero structure on the Y pass is captured by one letter rule:
Let L = Y_ROW[p-1] for p in {1..31}
gate(p) = 0 iff
L in {A, F, G, N, Q, T, X}
OR (p in {1, 2, 28, 29, 30} AND L in {Y, X, Z, K})
Verification is exact at 31/31 positions, and 0 of 100,000 random-rule nulls pass the same test.
Full table, shadow-set decomposition, and Y -> Z1/Z2 transforms: Appendix, Y master template. Z2 footer basis handoff derivation: Appendix, Z2 footer basis handoff.
The R-grid (verified shift values)
The complete 7×14 grid of R values, the actual shift applied at each position. These are verified: R = (C − P) mod 26 holds at all 97 positions.
L14 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11 L12 L13 Tier 1: 21 20 6 15 6 2 8 14 14 15 3 23 9 14 Tier 2: 6 19 1 1 10 23 25 1 11 25 2 3 2 24 Tier 3: 24 6 2 10 0 25 21 12 14 1 8 0 11 2 Tier 4: 24 1 15 22 7 17 3 18 5 22 13 9 6 17 Tier 5: 22 18 4 16 5 17 14 12 20 24 10 11 6 10 Tier 6: 14 17 13 0 0 25 21 8 18 15 1 22 14 12 Tier 7: 15 25 6 20 15 1 12 15 23 6 11 22 · 20
The dot (·) marks the blank cell at Tier 7, Lane 13.
The r-grid (base shift values)
The r-grid is derived from the R-grid by subtracting the gate: r = R − gate. Where gate = 1, r is one less than R. Where gate = 0, r equals R.
L14 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11 L12 L13 Tier 1: 21 19 6 14 6 2 7 13 13 14 2 23 8 13 Tier 2: 6 18 0 0 9 23 25 0 10 24 1 2 2 24 Tier 3: 23 5 1 10 0 25 20 11 13 0 7 25 10 1 Tier 4: 23 0 14 21 6 16 2 17 4 21 12 9 5 16 Tier 5: 21 17 3 15 5 16 13 12 20 24 9 11 6 10 Tier 6: 13 16 12 0 25 25 21 7 17 14 0 21 14 11 Tier 7: 14 25 6 19 14 0 11 14 22 6 10 21 · 19
Each r value is produced by r = (f(C) + g_state(T)) mod 26, where f is the row-identity card applied to the cipher letter and g_state is the helper-card value for the back-side letter at that position. Combined with the gate, they produce the correct R at every position.
The one-bit gate map
Each grid cell carries a one-bit gate (0 or 1), fixed by the position and computable from col31, tier mod 3, and seam_corner, see The gate above. This map is fully solved and reproducible from the published rules.
L14 L1 L2 L3 L4 L5 L6 L7 L8 L9 L10 L11 L12 L13 Tier 1: 0 1 0 1 0 0 1 1 1 1 1 0 1 1 Tier 2: 0 1 1 1 1 0 0 1 1 1 1 1 0 0 Tier 3: 1 1 1 0 0 0 1 1 1 1 1 1 1 1 Tier 4: 1 1 1 1 1 1 1 1 1 1 1 0 1 1 Tier 5: 1 1 1 1 0 1 1 0 0 0 1 0 0 0 Tier 6: 1 1 1 0 1 0 0 1 1 1 1 1 0 1 Tier 7: 1 0 0 1 1 1 1 1 1 0 1 1 · 1
Of the 97 active cells: 69 have gate = 1 and 28 have gate = 0.
YAHR: family witness and directional safeguard
Four slightly raised letters on the cipher side, Y, A, H, R, serve a dual cryptographic function. Their primary role is as a family witness: they split the KRYPTOS alphabet into two groups that seed the row-identity card f.
Y and A belong to the 11-family (from compass bearing 247.5° ÷ 22.5° = 11). H and R belong to the 3-family (from 67.5° ÷ 22.5° = 3). These two families, combined with the +19 bridge rule from the misspellings and the tail formula from "T IS YOUR POSITION," produce the complete f table for all 26 letters. See the Field Guide for the full derivation.
Their secondary role is a directional safeguard. Read backward, YAHR contains RAY, a directional object with an origin and an orientation. In the 14-lane cylindrical model, a 180° orientation error shifts every lane by +7 (half the cylinder: 360° ÷ 14 = 25.714° per lane). This destroys the plaintext entirely: only 6 of 97 letters survive, and one position hits the blank cell at Tier 7, Lane 13. The directional cue teaches the solver that reading order matters and that a reversed reading is catastrophic, not a minor misalignment.
A related structural signature appears at the Berlin Clock's geographic referent: the substring ANDER (taken from ALEXANDERPLATZ, the city of the Berlin Clock) maps through (f + g_Y) / STD to KYARX, surfacing YAR at positions 2–4 of the output. The witness ties the geographic referent of the BERLIN CLOCK anchor to the raised K3-panel letters. The derivation is documented on the verification page.
K1–K4 as a pedagogical sequence
Taken together, the four Kryptos passages read as a deliberate progression. Each panel teaches a lesson that constrains the next:
K1, Concealment. A keyed Vigenère cipher with keyword PALIMPSEST. The plaintext ("Between subtle shading and the absence of light lies the nuance of iqlusion") establishes that meaning can be present yet unreadable. It destabilizes confidence in surface interpretation.
K2, Displacement. A keyed Vigenère with keyword ABSCISSA. The plaintext moves meaning off the surface and into space: coordinates, magnetic fields, buried information, and the suggestion that what you seek is "not where it appears to be." Sanborn's 2006 correction to the ending, replacing the slipped reading "ID BY ROWS" with "X LAYER TWO", explicitly names the second physical layer that K4 will require.
K3, Reconstruction. A double transposition cipher. Howard Carter's account of opening Tutankhamun's tomb: remove debris, make a breach, insert the candle, peer inside. It teaches that the wrong framework must be dismantled before clarity is possible.
K4, Orientation. A Quagmire III variant whose keystream is the back of the sculpture itself. The plaintext ("The compass rose is here... this is your position") makes position and reference frame the subject of the message itself. Every layer of the mechanism is now closed. The sequence culminates in self-reference: the cipher is about the act of reading it, and the answer was carved on the same copper screen all along.
Dependency chain (no circularity)
A common concern with cipher proposals is circular reasoning, using the answer to derive the answer. The K4 mechanism avoids this. The dependency chain is strictly one-directional:
T (helper letter, read from the back of the sculpture) → g_state(T) (helper-card value) → combined with f(C) (row-identity card from the cipher letter) → r = (f(C) + g_state(T)) mod 26 → combined with gate (a one-bit value fixed by position) → R = r + gate → applied to C (known ciphertext) → P = (C − R) mod 26 (plaintext).
No step in this chain depends on the plaintext output. The helper letter is physical (read off the copper). The gate is a locked per-position value, fully solved and position-derived. The f-table is fully forward-derivable from public clues. The ciphertext is known. The plaintext is produced, not assumed.
What remains
The cipher mechanism is fully closed. The plaintext, the Quagmire III decoder, the physical
helper keystream, the gate, and every helper-card value are known and verified at 97/97
positions. The formula r = (f(C) + g_state(T)) mod 26 produces every base shift
from the ciphertext letter, the helper letter read from the back of the sculpture, and the
helper card selected by which of the four 31-cell passes the position belongs to.
What remains is artist confirmation of the encryption method itself. Sanborn has confirmed four plaintext anchors and clarified several contextual references, but has not publicly released the complete coding procedure. The mechanism documented here is independently derived and produces the correct plaintext at every position, but it awaits formal confirmation from the artist or from the sealed Smithsonian records (embargoed until 2075).
Sanborn has also announced K5, a new 97-character coded message using a "similar but not identical" system to K4, to be released publicly when K4 is cryptographically solved.