How Kryptos K4 Works

The cipher mechanism

K4 is a Quagmire III variant, a keyword Vigenère with a separate column key. Each of the 97 ciphertext letters has been shifted by a specific number of positions in the alphabet. The shift at each position is determined by entering the KRYPTOS-keyed tableau at a row chosen by the cipher letter, a column chosen by a helper letter read from the back of the sculpture, and a one-bit gate fixed by the position in the grid. One equation governs the entire cipher:

P = (C − R) mod 26

where C is the ciphertext letter (A=0, B=1, ... Z=25), R is the shift value at that position, and P is the resulting plaintext letter. The operation "mod 26" means we wrap around: if the subtraction goes below zero, we add 26 to stay within the alphabet.

Equivalently, if you know both the ciphertext and the plaintext, you can compute the shift: R = (C − P) mod 26. This is how every position is verified.

The shift value R decomposes into two parts: a base shift r from the Quagmire III lookup (cipher letter + helper letter), and a one-bit gate fixed by the position in the grid. R = r + gate. The helper letter is read off the sculpture and the gate follows a declared position rule; the lookup cards that turn those inputs into shifts are largely back-solved from the plaintext, see the forward decode and The gate below.

The method runs forward (June 2026)

The reconstructed method now runs forward as a decoder. With no plaintext input anywhere, only the ciphertext, the tableau transcript, the declared cards, and the gate, the machine outputs the 97-character reconstruction exactly, anchors included. Two independent implementations agree, and a standalone script you can run yourself, forward_decode.py, is in the downloads. This proves the written method is complete and executable. It does not prove every card value is publicly derivable: under our grading, 52 of 97 positions decode from derived or witness-claimed rules, and the remaining 45, mostly the Y-pass card, are explicitly isolated as the authored worksheet layer. The June and July 2026 anchor-frontier sweeps extend this: every artist-confirmed anchor whose cipher letter has derived f yields a single-unknown public equation, closing f(P)=11 and f(T)=13 outright and forcing six g_Y cells; the graded conditional ladder takes the back-solved count from 45 to 37.

The per-position grade map is on the verification page. The claim status summary in the downloads states the public scope of every claim on this page.

The Quagmire III structure with a physical keystream

K4 is a Quagmire III variant with a physical keystream and a one-bit gate. The keyword is KRYPTOS, the same one used for K1, K2, and K3. The keystream is the tableau side of the copper screen: at each K4 ciphertext position, the helper letter is the character on the back of the sculpture at the same row and column as the cipher letter.

r = ( f(C) + g_state(T) ) mod 26
R = r + gate

The computation r = f(C) + g_state(T) mod 26 is mathematically identical to the standard Quagmire III lookup: read the letter at row KALPHA[f(C)], column g_state(T) of the KRYPTOS-keyed tableau. Its kpos = r.

f (row-identity card), Applied to the ciphertext letter C. It identifies which row of the KRYPTOS-keyed tableau the cipher letter belongs to. The table is partly forward-derived and partly reconstruction. Confirmed forward: the tail rule f = (4·kpos + 1) mod 26 holds for every letter at kpos ≥ 19 (N, Q, U, V, W, X, Z, 7 of 7) and for none below it, a sharp boundary witnessed by "T IS YOUR POSITION"; f(O) = 0 comes from the UNDERGRUUND misspelling; and the K1–K3 misspelling signature (a constant +7) fixes f(L). The June 10 anchor-frontier sweep adds f(P) = 11, forced by the R-of-BERLIN anchor at position 66 with the gate and the derived Z1 scaffold, and cross-checked through position 73. That reaches 10 of 26 values forward-derived, before the July closure below. The remaining entries are back-solved from the plaintext. The compass-seed attribution (3 from 67.5° ÷ 22.5°, 11 from 247.5° ÷ 22.5°) is an interpretive reading pending a blind test against the unseen letters.

The July 1 transitive-closure sweep adds f(T) = 13: position 67 (L of BERLIN, cipher V) has a derived tail-rule f-value that forces the composite Z2 helper cell g_Z2(Z) = 24 from public data alone, and position 68 (I of BERLIN, cipher T) reads that same helper cell, closing f(T) = 13. The chain uses only artist-confirmed anchors, the derived f-tail rule, the gate map, and arithmetic, with no rose, bridge, or exception assumption. That brings the forward f-count to 11 of 26.

g_state (column offset), Applied to the helper letter T read from the back of the sculpture. There are four helper cards (g_X, g_Y, g_Z1, g_Z2), one per pass: X (positions 1–4, the cap), Y (5–35), Z1 (36–66), Z2 (67–97). The card values are back-solved from the plaintext (g_state(T) = (r − f(C)) mod 26), so they reproduce the reconstruction by construction. The same helper letter takes different values in different passes, so this is not a single standard Quagmire lookup.

gate (one-bit gate), A single binary adjustment (1 or 0) fixed by the position in the grid under a declared ray map (E cells add 1; NE and S cells add 0; 69 E, 18 NE, 10 S). It is plaintext-independent by construction and can equivalently be computed from the position (col31 packet phase + tier mod 3 carrier cycle + seam-corner override at lanes {14, 1, 2}). Its physical reading awaits a blind on-site audit, see The gate below.

The honest split: the keyword, the gate rule, and the helper letters come from the sculpture and public clues, while most f and g values are back-solved. The genuine forward exceptions are the 11-of-26 f-spine, the Z1 scaffold mask, and the rose-East rule at the three hard Z2 cells (see the rose-East rule). The on-site four-step procedure is documented in the On-Site Field Guide; the full helper-card values and their provenance are on the verification page.

The master constants

A small set of master constants recurs throughout the reconstruction, each tied to an on-site artifact or public clue. The compass-seed attributions are interpretive pending a blind test:

The Field Guide expands this to eight numbers by including O = 0 (the f anchor) and 1 (the gate), which are structurally implied by the six above.

The 7×14 grid

The 97 characters of K4 are mapped onto a grid of 7 tiers (rows) and 14 lanes (columns). Tier 1 holds positions 1–14, Tier 2 holds positions 15–28, and so on. The last tier (Tier 7) holds only 13 characters (positions 85–97), leaving one blank cell at Tier 7, Lane 13.

The grid coordinates are computed from the stream position i (1–97):

tier = ⌈ i ÷ 14 ⌉       (ceiling division)
lane = ((i − 2) mod 14) + 1

The lane formula deserves explanation. It does not simply cycle 1–14: it starts at lane 14 for position 1, then lane 1 for position 2, lane 2 for position 3, and so on. This offset aligns the grid with the physical structure of the sculpture, specifically, how the K4 ciphertext begins at column 28 of a 31-character-wide copper row (the OBKR capstone alignment).

Grid layout (positions 1–97)

        L14   L1   L2   L3   L4   L5   L6   L7   L8   L9  L10  L11  L12  L13
       ┌────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┬────┐
Tier 1 │  1 │  2 │  3 │  4 │  5 │  6 │  7 │  8 │  9 │ 10 │ 11 │ 12 │ 13 │ 14 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 2 │ 15 │ 16 │ 17 │ 18 │ 19 │ 20 │ 21 │ 22 │ 23 │ 24 │ 25 │ 26 │ 27 │ 28 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 3 │ 29 │ 30 │ 31 │ 32 │ 33 │ 34 │ 35 │ 36 │ 37 │ 38 │ 39 │ 40 │ 41 │ 42 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 4 │ 43 │ 44 │ 45 │ 46 │ 47 │ 48 │ 49 │ 50 │ 51 │ 52 │ 53 │ 54 │ 55 │ 56 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 5 │ 57 │ 58 │ 59 │ 60 │ 61 │ 62 │ 63 │ 64 │ 65 │ 66 │ 67 │ 68 │ 69 │ 70 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 6 │ 71 │ 72 │ 73 │ 74 │ 75 │ 76 │ 77 │ 78 │ 79 │ 80 │ 81 │ 82 │ 83 │ 84 │
       ├────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┼────┤
Tier 7 │ 85 │ 86 │ 87 │ 88 │ 89 │ 90 │ 91 │ 92 │ 93 │ 94 │ 95 │ 96 │ 97 │  · │
       └────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┴────┘

The dot (·) at Tier 7, Lane 13 is the single blank cell. This is a structural property of fitting 97 characters into a 98-cell grid, not an error.

The physical copper layout

The cipher side of the Kryptos copper screen arranges the encrypted text in rows of 31 characters. K4's 97 characters occupy the last portion of the inscription: the final 4 characters of the third row (positions 1–4: OBKR) plus three full rows of 31 characters each (positions 5–35, 36–66, 67–97). This gives the familiar 4/31/31/31 physical row structure.

The critical alignment: K4 begins at column 28 of the last K1–K3 row, meaning the first four characters of K4 (OBKR) complete that physical row before wrapping to the next. This is why the lane formula has its offset, position 1 lands in lane 14, not lane 1.

The same physical structure also generates the K4 helper packet on the tableau back. At each K4 position, the helper letter T is the character on the tableau side at the same row and column as the cipher letter. The packet decomposes as WXZK | Y row | Z row | footer = 4 + 31 + 31 + 31 = 97 characters: the cap WXZK at positions 1–4, the full Y row at positions 5–35, the full Z row at positions 36–66, and a footer (blank cell + standard alphabet + wraparound) at positions 67–97. The excluded pre-K4 cell (cipher position 771 of the continuous transcript) maps to the tableau letter V, the "virtually invisible" bridge slot named in the entrance Morse.

For Z2, the footer is visible as standard alphabet text, but the effective lookup basis is KALPHA-shifted: each footer letter maps to KALPHA[(stdpos(letter) - 1) mod 26], with the leading blank carrying Z. The Z2 key stream can therefore be stated two equivalent ways: read the Z row again, or convert the visible footer through this basis switch. The two are character-identical, verified, so they are one machine. We use the Z-row form as the specification and keep the footer form as the candidate for how the author produced it.

The reading geometry, validated by search

The same-row reading of the tableau is no longer just our choice. We enumerated 134 physically declared ways to read the lower tableau and the cipher side, rows, columns, diagonals, spirals, and strides, and scored each only on the artist-confirmed anchors and the positions they force. Every survivor is a row-read. Given the helper cards, the reading is pinned everywhere except three cells no public data reaches (positions 5, 35, and 36), and only the row-by-row reading reproduces the full reconstruction.

The honest scope: this result is conditional on the cards. It shows the geometry and the cards form one mutually consistent machine, not that either was recovered from scratch.

The gate

The shift value R at each position is not stored directly in one grid. It decomposes into a base shift r and a one-bit gate:

R = r + gate

r is the base shift value, a number from 0 to 25, produced by the Quagmire III lookup r = (f(C) + g_state(T)) mod 26. The gate is a one-bit adjustment fixed by the position. Its declared rule is computable from the stream position, with no reference to the plaintext:

• col31, the position's column within the 31-character copper row (the packet phase).
• tier mod 3, the carrier cycle induced by the 31/14 wrap beat (31 mod 14 = 3).
• seam_corner, a binary flag for lanes {14, 1, 2}, the seam handoff zone where 31-column rows wrap into the 14-lane grid.

At most positions the packet phase and carrier cycle determine the gate. At the seam-corner lanes, the override resolves all remaining conflicts exactly. (The same values can also be read off a small lookup keyed by the ciphertext letter and lane.) This position rule is the verifiable definition of the gate used throughout the site.

Worked examples

Here are five positions worked end to end, from stream position to plaintext letter. Every one of the 97 positions resolves the same way.

Position 1, O → T

Position i=1. Tier = ⌈1÷14⌉ = 1. Lane = ((1−2) mod 14)+1 = 14. Grid cell (1,14): r = 21, gate = 0, R = 21. Ciphertext O = 14. Plaintext: (14 − 21) mod 26 = −7 mod 26 = 19 = T. ✓

Position 22, F → E (confirmed anchor: EAST begins here)

Position i=22. Tier = ⌈22÷14⌉ = 2. Lane = ((22−2) mod 14)+1 = 7. Grid cell (2,7): r = 0, gate = 1, R = 1. Ciphertext F = 5. Plaintext: (5 − 1) mod 26 = 4 = E. ✓

Position 40, S → S (self-encrypting position)

Position i=40. Tier = ⌈40÷14⌉ = 3. Lane = ((40−2) mod 14)+1 = 11. Grid cell (3,11): r = 25, gate = 1, R = (25+1) mod 26 = 0. Ciphertext S = 18. Plaintext: (18 − 0) mod 26 = 18 = S. ✓ When R = 0, the letter encrypts to itself.

Position 64, N → B (confirmed anchor: BERLIN begins here)

Position i=64. Tier = ⌈64÷14⌉ = 5. Lane = ((64−2) mod 14)+1 = 7. Grid cell (5,7): r = 12, gate = 0, R = 12. Ciphertext N = 13. Plaintext: (13 − 12) mod 26 = 1 = B. ✓

Position 97, R → X (final position)

Position i=97. Tier = ⌈97÷14⌉ = 7. Lane = ((97−2) mod 14)+1 = 12. Grid cell (7,12): r = 19, gate = 1, R = 20. Ciphertext R = 17. Plaintext: (17 − 20) mod 26 = −3 mod 26 = 23 = X. ✓

The helper cards, summary

The helper layer uses four cards, one per pass, g_X, g_Y, g_Z1, and g_Z2, plus Z2_delta. The values are internally consistent with the 97-position reconciliation.

Plain-language derivation: at each position solve R = (C - P) mod 26, then r = (R - gate) mod 26, then g_state(T) = (r - f(C)) mod 26. That is the whole card-building rule, and it uses the known plaintext P, which is why we say the cards are back-solved: they reproduce the reconstruction by construction. The largest single underived object in the system is the Y-pass card, g_Y.

The cap-pass values are g_X(W)=21, g_X(X)=4, g_X(Z)=24, g_X(K)=11. Z2 is linked to Z1 by transport: g_Z2 = (g_Z1 + Z2_delta) mod 26.

Full values and derivation chain, including closures and uniqueness tests: Appendix, helper cards. Public status file: claim_status_summary.txt.

The Y master template (rev 16)

The gate-zero structure on the Y pass is captured by one letter rule:

Let L = Y_ROW[p-1] for p in {1..31}
gate(p) = 0 iff
   L in {A, F, G, N, Q, T, X}
OR (p in {1, 2, 28, 29, 30} AND L in {Y, X, Z, K})

Verification is exact at 31/31 positions, and 0 of 100,000 random-rule nulls pass the same test. One caveat carried with it: the seven-letter set is an authored choice rather than a derived necessity, and the gate values it predicts are entangled with the reconstructed plaintext, so this bounds the rule's fit, not the plaintext's correctness.

Full table, shadow-set decomposition, and Y -> Z1/Z2 transforms: Appendix, Y master template. Z2 footer basis handoff derivation: Appendix, Z2 footer basis handoff.

The R-grid (verified shift values)

The complete 7×14 grid of R values, the actual shift applied at each position. These are verified: R = (C − P) mod 26 holds at all 97 positions.

        L14  L1   L2   L3   L4   L5   L6   L7   L8   L9  L10  L11  L12  L13

Tier 1:  21  20    6   15    6    2    8   14   14   15    3   23    9   14
Tier 2:   6  19    1    1   10   23   25    1   11   25    2    3    2   24
Tier 3:  24   6    2   10    0   25   21   12   14    1    8    0   11    2
Tier 4:  24   1   15   22    7   17    3   18    5   22   13    9    6   17
Tier 5:  22  18    4   16    5   17   14   12   20   24   10   11    6   10
Tier 6:  14  17   13    0    0   25   21    8   18   15    1   22   14   12
Tier 7:  15  25    6   20   15    1   12   15   23    6   11   22   20    ·

The dot (·) marks the blank cell at Tier 7, Lane 13.

The r-grid (base shift values)

The r-grid is derived from the R-grid by subtracting the gate: r = R − gate. Where gate = 1, r is one less than R. Where gate = 0, r equals R.

        L14  L1   L2   L3   L4   L5   L6   L7   L8   L9  L10  L11  L12  L13

Tier 1:  21  19    6   14    6    2    7   13   13   14    2   23    8   13
Tier 2:   6  18    0    0    9   23   25    0   10   24    1    2    2   24
Tier 3:  23   5    1   10    0   25   20   11   13    0    7   25   10    1
Tier 4:  23   0   14   21    6   16    2   17    4   21   12    9    5   16
Tier 5:  21  17    3   15    5   16   13   12   20   24    9   11    6   10
Tier 6:  13  16   12    0   25   25   21    7   17   14    0   21   14   11
Tier 7:  14  25    6   19   14    0   11   14   22    6   10   21   19    ·

Each r value is produced by r = (f(C) + g_state(T)) mod 26, where f is the row-identity card applied to the cipher letter and g_state is the helper-card value for the back-side letter at that position. Combined with the gate, they produce the correct R at every position.

The one-bit gate map

Each grid cell carries a one-bit gate (0 or 1), fixed by the position and computable from col31, tier mod 3, and seam_corner, see The gate above. The map is reproduced by the declared position rules at all 97 cells; its ray reading is a physical conjecture awaiting the blind on-site audit.

        L14  L1   L2   L3   L4   L5   L6   L7   L8   L9  L10  L11  L12  L13

Tier 1:   0   1    0    1    0    0    1    1    1    1    1    0    1    1
Tier 2:   0   1    1    1    1    0    0    1    1    1    1    1    0    0
Tier 3:   1   1    1    0    0    0    1    1    1    1    1    1    1    1
Tier 4:   1   1    1    1    1    1    1    1    1    1    1    0    1    1
Tier 5:   1   1    1    1    0    1    1    0    0    0    1    0    0    0
Tier 6:   1   1    1    0    1    0    0    1    1    1    1    1    0    1
Tier 7:   1   0    0    1    1    1    1    1    1    0    1    1    1    ·

Of the 97 active cells: 69 have gate = 1 and 28 have gate = 0.

YAHR: family witness and directional safeguard

Four slightly raised letters on the cipher side, Y, A, H, R, serve a dual cryptographic function. Their primary role is as a family witness: they split the KRYPTOS alphabet into two groups that seed the row-identity card f.

Y and A belong to the 11-family (from compass bearing 247.5° ÷ 22.5° = 11). H and R belong to the 3-family (from 67.5° ÷ 22.5° = 3). In the reconstruction, these two families, combined with the misspelling rule and the tail formula from "T IS YOUR POSITION," organize the f table. Under our grading, 11 of 26 f values are forward-derived; the family reading of the rest is interpretive pending a blind test. See the Field Guide for the walkthrough.

Their secondary role is a directional safeguard. Read backward, YAHR contains RAY, a directional object with an origin and an orientation. In the 14-lane cylindrical model, a 180° orientation error shifts every lane by +7 (half the cylinder: 360° ÷ 14 = 25.714° per lane). This destroys the plaintext entirely: only 6 of 97 letters survive, and one position hits the blank cell at Tier 7, Lane 13. The directional cue teaches the solver that reading order matters and that a reversed reading is catastrophic, not a minor misalignment.

A related structural signature appears at the Berlin Clock's geographic referent: the substring ANDER (taken from ALEXANDERPLATZ, the city of the Berlin Clock) maps through (f + g_Y) / STD to KYARX, surfacing YAR at positions 2–4 of the output. The witness ties the geographic referent of the BERLIN CLOCK anchor to the raised K3-panel letters. The derivation is documented on the verification page.

K1–K4 as a pedagogical sequence

Taken together, the four Kryptos passages read as a deliberate progression. Each panel teaches a lesson that constrains the next:

K1, Concealment. A keyed Vigenère cipher with keyword PALIMPSEST. The plaintext ("Between subtle shading and the absence of light lies the nuance of iqlusion") establishes that meaning can be present yet unreadable. It destabilizes confidence in surface interpretation.

K2, Displacement. A keyed Vigenère with keyword ABSCISSA. The plaintext moves meaning off the surface and into space: coordinates, magnetic fields, buried information, and the suggestion that what you seek is "not where it appears to be." Sanborn's 2006 correction to the ending, replacing the slipped reading "ID BY ROWS" with "X LAYER TWO", explicitly names the second physical layer that K4 will require.

K3, Reconstruction. A double transposition cipher. Howard Carter's account of opening Tutankhamun's tomb: remove debris, make a breach, insert the candle, peer inside. It teaches that the wrong framework must be dismantled before clarity is possible.

K4, Orientation. A Quagmire III variant whose keystream is the back of the sculpture itself. The reconstructed plaintext ("The compass rose is here... this is your position") makes position and reference frame the subject of the message itself. The sequence culminates in self-reference: the cipher is about the act of reading it, and in this reconstruction much of the reading apparatus sits on the same copper screen.

Dependency chain (where the circularity is, and isn't)

A common concern with cipher proposals is circular reasoning, using the answer to derive the answer. The reconstruction is careful about this distinction. The run-time dependency chain is strictly one-directional:

T (helper letter, read from the back of the sculpture) → g_state(T) (helper-card value) → combined with f(C) (row-identity card from the cipher letter) → r = (f(C) + g_state(T)) mod 26 → combined with gate (a one-bit value fixed by position) → R = r + gate → applied to C (known ciphertext) → P = (C − R) mod 26 (plaintext).

At run time, no step in this chain references the plaintext: the helper letter is physical (read off the copper), the gate follows its declared position rule, and the decode runs forward end to end. The honest qualifier sits one level up: most of the f and g card values were built from the plaintext in the first place, so the chain's arithmetic is one-directional while the mechanism as a whole is back-solved. Running it forward proves the written method is complete and executable, which is internal consistency, not independent recovery.

What remains

The written method is complete and executable: the decoder, the physical helper keystream, the gate rule, and every card value are specified, and the machine reproduces the reconstruction at all 97 positions when run forward. That is the strongest internal claim we can make, and it is internal consistency, not independent recovery.

What remains is external. The largest open object is the Y-pass card (g_Y): 18 of the Y pass's 31 positions rest on values that exist only as an authored worksheet. After that come a witness for the rose rule's step of 16, confirmation of the wrap procedure, the blind gate/ray field read, and scoring the timestamped predictions against the archive and K5. The full register is on the appendix. Sanborn confirmed four plaintext anchors but never released the coding procedure; the sealed records are embargoed until 2075.

Sanborn has also announced K5, a new 97-character coded message using a "similar but not identical" system to K4, to be released publicly when K4 is cryptographically solved.

Continue