A 1542 papal cipher falls to simulated annealing and a character-level language model

A papal letter encrypted in 1542 as an unbroken stream of digits has been deciphered. According to a write-up published at simonklee.dk and surfaced on the Hacker News front page, the text was recovered by pairing simulated annealing with a character-level language model, closing a puzzle that had stood unsolved on a public challenge site for years.

A papal letter in digits

The letter left Rome in April 1542 bound for the court of Charles V in Spain. Its sender was Cardinal Alessandro Farnese, grandson of Pope Paul III and, at twenty-one, head of the papal secretariat; its recipient, Giovanni Poggio, bishop of Tropea and the Pope's ambassador to the Emperor. The framing pages are plain Italian, but the substance, touching the peace then in play between the Emperor and France, is carried by digits that begin partway down the first page and run, with one clear interlude, almost to the end. The document is held in the Archivio Apostolico Vaticano as Segr. Stato, Spagna 1A, with photographs available through DECODE record 92.

A public transcription made in January 2016 by a volunteer credited as EHum records 6,577 cipher digit positions, 44 of them unreadable, with no word division anywhere. In July 2019 George Lasry set the text as part of the Vatican Challenge on MysteryTwister. A 2020 study by Lasry, Beáta Megyesi and Nils Kopal still listed it as unsolved: they had tried to match a neighbouring item from the same volume against a Poggio key printed in Aloys Meister's 1906 survey of papal cryptography, failed, and concluded this letter used a different key. As of 16 September 2026, per the write-up, the challenge page showed zero solves.

What the counts showed

Simple statistics narrowed the cipher's design before any key was known. Digit 7 makes up 17.5 percent of the transcription while 1 accounts for only 3.1. A few pairs, among them 80, 57, 27, 03 and 73, occur hundreds of times each, far above chance. Doubled digits are nearly absent: 00 appears six times where independent digits would give roughly 117. The digits also alternate between two groups, 4-5-6-8 and 0-1-2-7-9, in a rhythm consistent with consonants and vowels taking turns; after 73, the next digit falls in the first group 93 percent of the time.

Several key designs circulated in the papal chancery of the 1540s, and the write-up reports that early attempts with them produced no readable Italian. The design that fit is the simplest one in Meister's collection: every letter has exactly one code, one or two digits long, alongside nulls that mean nothing, and the reader separates codes by context. The ambiguity is genuine. Under the recovered key, 73 is d, but the same digits read singly are n m.

Cracking key and boundaries together

The attack searched for the key and the code boundaries at the same time. An outer search, the simulated annealing named in the write-up's title, kept rearranging which codes were assigned to which letters. For each candidate key, an inner decoder walked the digits from left to right, holding several partial readings alive. Each state records a position, the last four symbols emitted and a running score; when two paths reach the same position with the same context, only the better-scoring one survives.

Readings were judged by a five-gram character model that estimates the probability of each letter from the four preceding it. It was trained on about 4.9 million letters, mostly Machiavelli, Castiglione and Vasari from Wikisource, plus some 720,000 from OCR of a printed collection of 1541-44 nuncio correspondence that includes the Farnese secretariat. Normalisation choices, folding v into u, deleting h and collapsing doubled letters, matched the clerk's habits: the plaintext writes tute, esendo and facia, and the key carries a single code for u and v and none for h. Counts were blended with shorter-context estimates so that unfamiliar names were penalised rather than ruled out.

The result reads as Italian. The first ten digits resolve to dopo la, after the, with the 9 in between standing for nothing at all: a null.

Why it matters

This is a compact demonstration that the standard toolkit of modern automated cryptanalysis, stochastic search over keys plus n-gram scoring of candidate decryptions, works even when a cipher offers no word divisions and variable-length codes, a harder decoding problem than fixed-length substitution. Archives hold large volumes of similarly sealed early modern diplomatic correspondence, and projects such as DECODE and MysteryTwister are turning that backlog into shared, tractable puzzles. Each solve converts dormant manuscript material into readable history, and this one also shows how much depends on public infrastructure: a volunteer's six-and-a-half-hour transcription and digitised photographs were the raw material the algorithm needed.