D'Agapeyeff Cipher
A 1939 textbook 'cryptogram for the student' that the author himself later admitted he had forgotten how to solve.
Interactive Exhibit
The widget loads a 130-digit excerpt of the 395-digit ciphertext (or paste the full cryptogram yourself) and will tally adjacent digit pairs. A real Polybius-style fractionation will show a non-uniform distribution. Track B — analytic helper, not a solver.
Why This Matters
On the last page of the first edition of Codes and Ciphers (Oxford University Press, 1939), Alexander d'Agapeyeff appended a 395-digit numeric cryptogram as 'a cryptogram upon which the reader is invited to test his skill.' It has never been publicly cracked. By the second edition, d'Agapeyeff had quietly removed it, reportedly admitting he had forgotten the encryption method. It is one of the few unsolved ciphers whose author lost the key.
The cipher consists of 395 digits arranged in five-digit groups. The expected attack route assumes a fractionating system (Polybius square or similar) followed by a transposition — both common in the British cryptographic education tradition d'Agapeyeff was writing for. None of the proposed solutions has been independently confirmed, and several solutions are mutually contradictory.
Statistical work shows the digit distribution is not uniform — pairs and triples deviate from random — strongly implying a real cipher rather than gibberish. The most widely discussed reconstruction — set out in Nick Pelling's computational analysis — is a 5×5 Polybius substitution of plaintext letters into row-column digit pairs, followed by a transposition, which leaves an attacker having to solve both layers at once. The puzzle is that the corpus (~395 digits ≈ 200 plaintext characters) is just at the edge where multiple keys can fit equally well.
The cipher is a teaching favourite for explaining unicity distance — the corpus is short enough that more than one key produces grammatical English. Modern brute-force searches over candidate Polybius squares and transposition keys have produced several 'almost' solutions, but none with the unambiguous English readability that would settle the case. It remains an open problem and a regular target of cryptanalysis competitions.
| Hall | Hall XII · Unsolved |
| Region | London, England |
| Era | Pre-WWII Britain · 1939 |
| Discipline | Numeric fractionation (suspected) |
| Track | B (frequency analyzer) |
| Modern echo | Unicity distance · cryptanalysis competitions |