D'Agapeyeff Cipher
A 1939 textbook 'cryptogram for the student' that the author himself later admitted he had forgotten how to solve.
Interactive Exhibit
Paste the 395-digit ciphertext (or use the loaded sample) and the widget will tally adjacent digit pairs. A real Polybius-style fractionation will show a non-uniform distribution. Track B — analytic helper, not a solver.
Why This Matters
On the last page of the first edition of Codes and Ciphers (Oxford University Press, 1939), Alexander d'Agapeyeff appended a 395-digit numeric cryptogram as 'a cryptogram upon which the reader is invited to test his skill.' It has never been publicly cracked. By the second edition, d'Agapeyeff had quietly removed it, reportedly admitting he had forgotten the encryption method. It is one of the few unsolved ciphers whose author lost the key.
The cipher consists of 395 digits arranged in five-digit groups. The expected attack route assumes a fractionating system (Polybius square or similar) followed by a transposition — both common in the British cryptographic education tradition d'Agapeyeff was writing for. Bletchley Park veterans, amateur cryptanalysts, and at least three doctoral theses have attacked it. None of the proposed solutions has been independently confirmed, and several solutions are mutually contradictory.
Statistical work shows the digit distribution is not uniform — pairs and triples deviate from random — strongly implying a real cipher rather than gibberish. The most plausible theory, advanced by Vincent Lynch and others, is a Polybius substitution of plaintext letters into row-column digit pairs (10–55), followed by an irregular columnar transposition with a numerically keyed column order. The puzzle is that the corpus (~395 digits ≈ 200 plaintext characters) is just at the edge where multiple keys can fit equally well.
The cipher is a teaching favourite for explaining unicity distance — the corpus is short enough that more than one key produces grammatical English. Modern brute-force searches over candidate Polybius squares and transposition keys have produced several 'almost' solutions, but none with the unambiguous English readability that would settle the case. It remains an open problem and a regular target of cryptanalysis competitions.
| Hall | Hall XII · Unsolved |
| Region | London, England |
| Era | Pre-WWII Britain · 1939 |
| Discipline | Numeric fractionation (suspected) |
| Track | B (frequency analyzer) |
| Modern echo | Unicity distance · cryptanalysis competitions |