Skip to main content

About the Challenge

Welcome to the National Cipher Challenge, a nationwide, online codebreaking competition, which will run from October 5th 2017 to January 4th 2018. We will open for online registration on September 15th.

The competition is a great extension activity (or a fantastic maths club project) that can be tackled by students in teams or on their own. There is no charge to register or take part, and all you need to get involved is a reasonably modern web browser.

The competition has been running since 2002, and regularly attracts entries from teams at over 700 UK schools and colleges. Long time competitor, Julian Bhardwaj, said of the Challenge

If I were to name one thing which has undoubtedly influenced my academic drive, interests and overall career to date, it would be the National Cipher Challenge. Since being introduced to cryptography and the challenge in Year 8, it has been my one passion and driving force in pursuing further education in maths.

Julian went on to study Discrete Mathematics and made it to the Grand Final of the UK National Cyber Security Championship in 2013, following in the footsteps of the 2008 National Cipher Challenge winner, Jonathan Millican, who was crowned winner of the UK National Cyber Security Championship the previous year.

Our competition has attracted support from a number of people over the years, who have encouraged us by giving up their time to launch the competition, to meet with competitors and to attend the annual prize giving at Bletchley Park. These include the media scientists Adam Hart-Davis and Simon Singh; Newsnight editor Mark Urban who has a passion for military history;  comedy writer James Cary who wrote Bluestone 42 and the Radio 4 comedy Hut 33, and the star of that show (and many others),  Robert Bathurst  whose aunt worked at Bletchley in the war. We have also had the pleasure of introducing the Cipher Challenge team from Saint Anne’s School in Southampton to the Duke of Edinburgh.

Two Foreign Secretaries, Boris Johnson and William Hague have supported the competition (though Boris was London Mayor at the time), and we are also grateful to our sponsors who give time as well as money to support the competition. It is not unknown for our winners to meet members of the secret world of GCHQ at the awards dinner despite their busy schedules.

The competition is structured as a series of encrypted messages which tell a story. This year the competitors will be trying to unravel the mystery of Rome’s Lost Legion, which vanished in Northern Britain in 108 AD. The reason for their disappearance and the nature of the treasure they guarded has been lost for centuries. Now it is their job, alongside Harry, Jodie and Maryam, to uncover the truth.

You can download lessons and notes on codebreaking from the resources page on the competition website. This is the competition library and, alongside the materials we have produced you will find links to books,  online videos and help guides that contain everything you need to be a successful code-breaker. You can even build your own cipher machines, including the simple cipher wheel and the more complicated Pringle Can Enigma Machine.

Entrants can take part alone or in teams of any size. To take part you will need to register for an account  the website, and we will ask you for a Nickname (which we will use to identify you on the forum, where you can discuss a whole range of things connected to the competition, and quite a few that are totally unrelated). You will then be asked to create or join a team which you will use to submit your entires. If you ask to join an existing team then we will email your request to the team captain and let you know the outcome. If your request is turned down, don’t worry, you can request to join another team, or set up your own.

If you want others to join your team let them know and they can submit a request through their account page which is linked at the top right of the menu bar.  The names of everyone on a team will be on the certificate and we will publish the team name on the leaderboards so you can see how everyone is getting on.

When setting up the team we ask you to say whether or not you are eligible for a prize. The rules are below. If you are eligible we will ask you for some information about your school, including the name and email address of a teacher contact. We need this in case you win a prize, but please do ask them first. If you are home educated then state that in the School name box and give the name and email address of an adult we can contact if we need to. We will not publish your name or the contact information of your teacher without your (or their) permission, but of course if you win a prize we will want to tell the world about your success!

Competition schedule

Registration will open online on 15th September and the first challenge is published at 3pm on Thursday October 5th. Challenges will be set periodically on the web-site in the Challenges section, following this schedule:


Challenge Publication date 15:00 on Solution deadline 23:59 on
1 5/10/2017 11/10/2017
2 12/10/2017 18/10/2017
3 19/10/2017 01/11/2017
4 02/11/2017 08/11/2017
5 09/11/2017 15/11/2017
6 16/11/2017 29/11/2017
7 30/11/2017 13/12/2017
8 14/12/2017 04/01/2018


Points are awarded for speed and accuracy (with accuracy more important) but you do not have to rush to download the first challenges immediately as you have a day or two in which you can still get top marks. In later challenges speed will become important, and the full schedule of marks is published on the Challenge pages so you can see how quickly you will need to get started in each round.

The first two challenges should be thought of as a “warm-up” exercise and will not count in the final leader board rankings or for the award of main prizes, however it is still worth tackling rounds one and two as they give excellent practice and they do develop the storyline. You will be able to download certificates recording your team’s performance at each stage.

As usual we apologise in advance if your school holidays clash with the schedule. It is impossible to set the schedule to avoid them all, but there is nothing to stop you doing the challenge during the break, you only need a web browser and your brain!


To take part you will need to register for the competition on our registration page:

This will be open from September 15th, and you will need to provide the following information:

Nickname: This will be the name we use to identify you in public. Choose something memorable. It will appear whenever you post something in the forum so don’t include anything in your username that identifies you. You are, after all, working with an undercover organisation.

Name: We will  keep this private, but need it for our records. We will only publish it if you win and accept a prize.

Password: This is for logging on. Choose it carefully, make it strong and keep it secret. The system will discourage you from using a password that is too easy to crack.

Email address: This will be used to confirm your registration so it must be an active account you can check to authorise the account. If we need to contact you this is how we will do it, so add the account [email protected] to your email account address book to avoid sending our emails to your junk mail bin. Make sure the account is not too full, and check it regularly.

Gender: You don’t have to tell us this (there are options for neither or prefer not to say) but we do have some gendered prizes this year so it will help us enormously if you do.

Teacher contact: Give the name and email address of a teacher (or Parent/Guardian)  we can write to if we need to check anything. You should get their permission first! We don’t usually do this unless you win a prize. If you are home educated give us a parent or carer’s name here and write home educated in the school name field.

School: Tell us which school you are at so we can include that on your certificate and the leaderboard. We have tied this into a Google Search to simplify the data entry, so do try that by typing in your school name and selecting from the list. If you really can’t find your school there then enter the details of your city/town/village etc,  as you would be surprised how many schools share a name across the UK.

The “Ineligible for a prize” box on the registration form

If you are a teacher who is registering in order to keep an eye on the forum, or a Cipher Challenge alumnus who is now too old to take part but just can’t keep away, or ineligible for some other reason, then please tick this box so that the computer doesn’t award you a prize by mistake! It is embarrassing for us to have to ask for it back. Thanks.

Teams and solo entries

If you are taking part on your own you need to register which in effect will create a team that will have just you in it. The team name can be set on this page:

If you want to enter as a group the Team Captain should register first and create a new team. The Team Captain can then send the team members a link to their team from this page: Team members can then register for accounts on the team’s page – the team member must then request to join the team. The Team Captain will receive an email on each request and they can then accept or decline invitations. The team name can be set by the Team Captain editing the name on the Team page under your account.

Please note the following important information:
  1. Only Team Captains can submit solutions for the team. If someone else needs to do that then the Captain will need to delegate their captaincy by going to the team page in their account and selecting another member to become the Captain. Please be careful if choosing this option as once someone has been delegated they are in control of the team (there is no ‘undo’). If a Team Captain can’t delegate then they can share their login details. Beware that once those login details are shared with someone, they can post on the Forum as you. You can always change your password if you have had to temporarily share it. It would be better to create a “Captain’s account” for all the team to share if you want to all be able to post entries for the team, and keep your personal accounts private for the forums.
  2. If you wish to join a team after you have already registered then you will need to change your team. Do this by using the “Change Team” form on this page: Your new Team Captain will need to accept the invitation.
  3. If you create another account having already joined a team, that new account will not be linked to the team unless you request to join a team using the “Search Team” function on this page:
  4. Team members who are not Team Captains will not see the answer submission form when logged in as themselves, but will see a message on the Challenge page reminding them that the Team Captain has to submit answers.
  5. You can leave a team at any point, but you cannot keep the score the team has gained. If you are a Team Captain and wish to leave a team with other members in it, you will need to delegate your captaincy to another team member.
  6. Points are recorded against Teams only (not individual team members). If you join a team after you have gained points those points will stay with the team that you were on at the time. Team Captains forming a team for the first time during the competition will be sharing any points they have gained up to that stage with the team. Think VERY carefully about changing teams!
  7. While you can choose to leave a team, once you have requested and been accepted to join one you cannot be thrown out by the Team.
  8. For the purpose of awarding prizes an individual entry means an entry by a team consisting of one individual, and a team entry refers to a team with at least two members.
  9. Team membership will be frozen at the start of Challenge 8 so that no further requests will be issued or can be accepted after that point.
  10. You do not have to all be at the same school to form a team, we will use the Captain’s school and email address for any communications with the team. The names of all the members of the team will appear on the certificates. You can also all read the feedback and download individual certificates from your account page.

The structure of the competition

You will find the Challenges on the Challenge page. Each round of the competition will come in two parts, Part A and Part B. Think of them as the “easy” and the “hard” challenges (or the “hard” and “much harder” challenges if you prefer). Part A challenges will consist of communications between Harry and his friends and you can expect these messages to be fairly lightly encrypted, at least at first, although in the latter stages of the competition security will be tightened and you will find the Part A ciphers harder to crack. Part B consists of the mysterious texts that tell the story of the Lost Legion. At the start of the challenge the encryption is not too hard to crack, but as you get deeper into the mystery you will find that the encryption gets much tougher and you may find that learning to use a spreadsheet or even to programme will be of particular value in tackling the later challenges. We do provide a brief guide to programming, written for us by a cipher Challenge alumnus, Julian Bhardwaj, and you will find it, together with other helpful materials in the resources section.

Submitting your solutions

The Team Captain (or anyone in the team using the Team Captain account) can submit solutions to either part A or part B at any time during a round by typing them into the submissions page. If you need to resubmit (because you found a mistake, or because we pointed one out to you) you can use the same form. Just paste your entry as text in the appropriate box on the form. It doesn’t matter how you format your answer – with or without punctuation and spaces and whether or not you use capital letters, however you must only type or paste in the exact text of a decrypt of the message. It is a good idea to use a simple text editor to type up your solution (rather than something like Word) as the spell checker sometimes tries to change what you are typing and any “mistake” in the text might be deliberate. Don’t try to correct any errors you think we have made, always type in an exact decryption of the text. Don’t try to tell us what cipher we used, or to ask us a question, or to say how you solved the cipher in the entry form, we don’t read it and it will be marked as an error in the solution. If you need to get hold of us you can post a message on the forum or send us an email at [email protected].

Getting help 

We offer online feedback on submissions during each round to help you if you make mistakes. The feedback is delayed so you will lose points if you rely on it rather than trying to correct your own errors quickly, but it can be useful if you are on the right track (and speed doesn’t matter for part A challenges which are only scored for accuracy). The feedback consists of a score for accuracy, together with a copy of your submission with the first error highlighted. The feedback also contains a link to your certificate for the round. At the end of each round we will publish the official decrypts of part A and part B on the challenge page.

Participants often get stuck on a challenge but, as in real life, sometimes a good night’s rest is all you need. Other times you might need more practical help and can turn to the website for clues, either hidden in earlier rounds of the competition, revealed by Harry in part A, or posted (by us) as comments on the forum. We ask you not to post hints of your own without checking them with us first as this will spoil the Challenge for others. Anyone posting solutions or links to solutions on our site or elsewhere may be barred from the site and disqualified from the competition – we do search for them and do find them!


Each of the two challenges in a round (part A and part B) are scored for accuracy in the same way. We strip out all the non-ascii characters, spaces and punctuation from your solution, convert it to lower case and compare that string of letters with our solution, which we have treated the same way. The more similar they are the higher the score you will get, and if they are identical you will score 100% for that challenge. If you spot a mistake in your answer you can submit again – we only ever take your most accurate answer into account and accuracy beats speed in every case, though speed is also important in the part B competition. In part B we look at all your submissions for the round and find those with the highest mark. We then take the first one of those that you submitted and award you points depending on how quickly you submitted it, according to a schedule that is published with each challenge. There are no speed points for part A, only for part B. You can find  your scores for each round in the feedback section of the site, and we will publish a leader board for each round. The first two rounds are a warm-up so the points will not count for the overall leader boards but from round 3 we will publish a Championship leader board based on your total points from then in each of the competitions.


The prizes for the best individual code breakers this year will be funded by GCHQ and BCS. There is one prize each for the best male and female codebreaker, each worth £1,000. The IBM prize of £1,000 will be awarded to the best team entry (where for the purpose of the prizes teams are deemed to have more than one member and those members must have joined the team before the start of  Challenge 8). The Trinity College prize of £800 will be awarded to the best runner up in the individual category, and the University of Southampton will award £800 to the runner up in the team category.  Winners will be asked to provide information about how they cracked Challenge 8 in order to verify that their solution is their own work.

The Prizegiving

We will be hosting a prize giving ceremony in the Spring. Date and location will be announded as soon as possible and we anticipate that alongside winners and their families we will be able to offer some tickets to schools and individual competitors. These tickets will be available by lottery and you will be able apply for them online at

How many can enter?

Teams of any size and composition may enter, and a school can enter as many teams as it wishes. Inter-school teams are also allowed, indeed, encouraged. We have even had trans-national teams taking part, though prizes are strictly limited to UK competitors.

Cookies on the site

We use cookies to anonymously track usage of the website through Google Analytics. No personally identifiable information is recorded by Google Analytics’ cookies.

We also use cookies to keep track of users’ activities when they login in order to facilitate the core functions of the site. We don’t request more information from you when registering for an account than is necessary to administer the competition. If you have any questions or concerns about this or any aspect of data security on this site then please do contact us at [email protected].

We believe our cookie usage falls under the ‘implied consent’ part of the EU cookie legislation so we haven’t cluttered the site with a warning bar. If you are interested you can read more about the legislation on the Information Commissioner’s website here: