The Beale Ciphers: One Cracked, Two That Won't Break

Somewhere in the hills of Bedford County, Virginia, a few miles from a crossroads that once held a tavern called Buford's, the ground may be hiding close to four tons of gold and silver. We know this because a man wrote it down. We can read exactly what he buried, down to the pound. We know the metal sits in iron pots inside a stone-lined vault about six feet deep. What we cannot do, after more than a century of trying, is read the one page that tells us where.

The man was named Thomas J. Beale, or so a pamphlet published in 1885 claimed. He left behind three sheets covered in nothing but numbers. One sheet describes the treasure. A second names the people it belongs to. A third gives the location. Only the middle sheet has ever been read, and it was cracked open using a document every American can pull from a drawer: the United States Declaration of Independence.

The other two sheets have defeated amateur codebreakers, professional cryptographers, Sperry UNIVAC supercomputers, and, by its own quiet admission, the National Security Agency. The gold, if it exists, is still down there. And the deeper mystery is not where it lies but whether any of it was ever real.

This article contains affiliate links. If you buy through them we may earn a small commission at no extra cost to you.

What You'll Learn

• •A Stranger, an Iron Box, and a Promise
• •Three Pages of Numbers
• •The Cipher That Opened
• •What the Second Page Says Is Buried
• •The Two That Will Not Break
• •The Case for a Hoax
• •The Case That Will Not Die
• •The Supercomputers and the Agency
• •A Century of Digging
• •What the Beale Papers Still Will Not Tell Us
• •Frequently Asked Questions

A Stranger, an Iron Box, and a Promise

The story, as the 1885 pamphlet tells it, begins in the winter of 1820, when a stranger rode into Lynchburg, Virginia, and took a room at the Washington Hotel. His name was Thomas J. Beale. He was tall, dark, strikingly handsome, and he kept his own counsel. He stayed through the season, left in the spring, and returned two winters later.

The hotel was run by a man named Robert Morriss, and Beale seems to have decided Morriss was someone he could trust. In early 1822, before leaving town again, Beale handed Morriss a locked iron box. It held papers of great value, he said, and Morriss was to guard it. If Beale and his companions had not returned within ten years, Morriss was to open it. The instructions he would need to make sense of the contents, Beale promised, would arrive separately, in a letter sent by a friend from St. Louis.

The letter never came. Beale never came back. No companion ever appeared to claim the box. Morriss, by the account, waited far longer than the ten years he had been asked for. He did not open the box until 1845, twenty-three years after it was placed in his hands.

Inside were a few pages of explanation and three sheets covered entirely in numbers.

Three Pages of Numbers

Morriss could make nothing of them. The accompanying letters explained the broad shape of the thing: Beale and a party of around thirty men had traveled west, somewhere in the vicinity of Santa Fe, and had struck gold and silver in a ravine while hunting buffalo. Over the next two years they mined it, converted some of the silver to jewels in St. Louis to make it easier to carry, and hauled the whole fortune back east in wagons to bury it near Buford's tavern in Bedford County, where it would be safe.

The three numbered sheets, the letter said, encoded everything a rightful heir would need. One gave the precise location of the vault. One described the contents. One listed the names of the thirty owners and their next of kin, so the treasure could be divided if the men died. But the key to reading them, the master document that turned the numbers back into words, was in the letter that never arrived.

Morriss kept the papers for years and got nowhere. Late in his life, unable to crack them and unwilling to let the secret die with him, he passed everything to a younger friend. That friend became obsessed. He gave, by his own telling, close to twenty years of his life to the numbers. He solved exactly one of the three, then published the whole affair as an anonymous pamphlet called The Beale Papers in 1885, selling it for fifty cents, a steep price at the time. In its pages he all but begs the reader not to make his mistake, warning that the search had cost him his money, his career, and his peace of mind. Then he hands the reader the ciphers anyway.

The Cipher That Opened

The one sheet the anonymous author managed to read is now called the second cipher, or B2. The method he found is beautiful in its simplicity, and anyone can reproduce it tonight.

It is a book cipher. Each number in the sequence is a position: count that many words into a chosen text, and take the first letter of the word you land on. Number 115 points to the one hundred fifteenth word, and that word is "instituted," so 115 becomes the letter I. Do this for every number in B2 and a message assembles itself, letter by letter.

The chosen text, the author discovered, was the United States Declaration of Independence. There is something almost absurd about it. The founding document of the republic, read not for its meaning but as a numbered list of words, becomes the key to a frontiersman's buried gold.

It is not quite a clean fit, which is part of what makes it strange. To make the numbering line up, the Declaration has to be modified in several specific places: a word inserted after the one hundred fifty-fourth word, a run of ten words dropped after the four hundred sixty-sixth, a handful of other small deletions, with "self-evident" counted as two words and "inalienable" read as "unalienable." Whoever built this cipher was working from a particular, slightly garbled copy of the Declaration. Nobody has ever identified which edition carried those exact quirks, or why.

What the Second Page Says Is Buried

Decoded, B2 reads like an inventory. It describes two deposits made in the same vault.

The first, placed in November 1819, held one thousand fourteen pounds of gold and three thousand eight hundred twelve pounds of silver. The second, added in December 1821, held one thousand nine hundred seven pounds of gold, one thousand two hundred eighty-eight pounds of silver, and jewels that had been obtained in St. Louis in exchange for silver, to cut the weight they had to haul, valued at thirteen thousand dollars at the time.

Add it up and the vault is said to contain roughly two thousand nine hundred twenty-one pounds of gold and about five thousand one hundred pounds of silver. By modern metal prices the gold alone runs well into the tens of millions of dollars, and some estimates push the full hoard, jewels included, north of sixty million. The decoded text also notes that a third sheet, left with a friend, explains where to find the vault, and that the names of the owners are given on another.

The message closes by pointing the reader to the other two ciphers for the rest. And there the trail stops cold, because the other two have never opened.

The Two That Will Not Break

The first cipher, B1, is the one that matters most to a treasure hunter, because it is said to give the exact location of the vault. It is 520 numbers long. The third, B3, names the owners and their heirs.

Here is the maddening part. We know the key that unlocked B2. The obvious first move, the move every codebreaker made, is to point that same Declaration of Independence key at B1 and B3 and watch them fall. They do not fall. Run the Declaration against B1 and you get gibberish, with one unsettling exception that we will come back to.

So B1 and B3 use a different key, or a different method, or both. The author of the pamphlet never says what document unlocks them. He may not have known. The treasure's location, written out in plain numbers that have sat in print since 1885, free for anyone to buy and study, has simply refused to resolve into words for a hundred and forty years.

That refusal is the whole mystery, and it splits into two possibilities that could not be further apart.

The Case for a Hoax

Plenty of careful people have concluded that there is no gold because there was never a Thomas Beale, and that the pamphlet is a piece of nineteenth-century fiction built around a cipher trick.

The strongest single piece of evidence sits inside B1 itself. In 1980 the cryptographer James Gillogly published a short, pointed paper in the journal Cryptologia titled "The Beale Cipher: A Dissenting Opinion." When he ran the Declaration of Independence key against B1, the numbers did not produce random noise, which is what you would expect from a genuine cipher using a different key. Instead, buried in the output, a string of letters marched out in near-alphabetical order: a run reading something close to abcdefghiijklmmnohpp. Members of the American Cryptogram Association later put the odds of such an orderly sequence turning up by chance at less than one in a hundred million million.

That pattern is very hard to explain if B1 is an honest encryption of a real location. It is easy to explain if someone filled B1 with numbers chosen to look like a cipher while actually being keyed, loosely and lazily, to the same Declaration, leaving a fingerprint that a real codebreaker would never have left.

There is more. In 1982 the writer and investigator Joe Nickell published a linguistic study of the pamphlet in the Virginia Magazine of History and Biography, arguing that the Beale letters and the pamphlet narration were written by the same hand and read as a single author's invention, possibly even a Masonic allegory. He flagged word choices that sit oddly in a letter supposedly written in 1822. The word "stampede," for one, does not appear in English print until the 1830s. The same year, Louis Kruh published his own skeptical probe in Cryptologia, examining the text for signs of what he called bamboozlement.

Then there are the ordinary cracks in the story. Robert Morriss, the pamphlet says, was running the Washington Hotel in 1820, when Beale supposedly arrived. Local records suggest Morriss did not hold that position until at least 1823. No independent trace of Thomas J. Beale, or of thirty men vanishing on a return trip west, has ever been found. The pamphlet's own author stays anonymous, and the publisher, a man named James B. Ward, is nearly as much a cipher as the documents themselves.

The Case That Will Not Die

And yet. If the Beale Papers are a hoax, they are a hoax of a very peculiar and self-sabotaging kind, and the holes in the hoax theory are as real as the holes in the treasure theory.

Start with the solved cipher. B2 genuinely decrypts. This is not a matter of belief. Pull up the Declaration of Independence, apply the author's modifications, and the inventory of gold and silver assembles itself, exactly as described. A hoaxer who wanted to sell a fifty-cent pamphlet did not need to build a cipher that actually works. He could have printed any string of numbers and claimed it meant something. Instead, one of the three ciphers is a real, functioning, reproducible encryption. That is a strange amount of honest craftsmanship to pour into a lie.

Then there is the behavior of the two unsolved ciphers under a computer's gaze. In the late 1960s, Carl Hammer, a senior figure at Sperry UNIVAC, turned early supercomputers loose on B1 and B3. His finding cut against the hoax reading: the number sequences did not behave like random padding. They showed the kind of internal structure you would expect from text that has genuinely been encrypted, not from a prankster mashing a keyboard. If B1 is empty noise, it is noise that somehow carries the statistical shadow of a real message.

So the skeptic and the believer are each holding a piece of evidence that embarrasses the other. The alphabetical run in B1 says hoax. The structure Hammer found says not noise. The working B2 says a real cryptographer was here. The missing Beale, the hotel date, the anachronistic "stampede" say storyteller. Even the anachronism is contested, because "stampede" circulated in Spanish and French around New Orleans well before it reached English print, and a man who had ridden the southwestern trails might plausibly have picked it up.

There is one more detail that almost no retelling mentions, and it is a good one. The version of B2 printed in the 1885 pamphlet does not perfectly match what the Declaration key actually produces. Comparing the two turns up around nine discrepancies, small ones: the pamphlet prints "consistcd" where the key yields "consisted," and "itron" where it should read "in iron." Those look like transcription slips. But they mean the pamphlet's author was copying from an earlier worksheet by hand, a worksheet that has never surfaced. Somewhere, at some point, there was an original decipherment on paper, now lost. That is not how pure fiction usually leaves tracks.

The Supercomputers and the Agency

The Beale ciphers have quietly pulled in people who do not chase treasure legends for fun. Hammer's UNIVAC runs were one early example. They were not the last.

The National Security Agency, the most capable codebreaking body in the world, has a document in its historical files with the dry title "Historical and Analytical Studies in Relation to the Beale Ciphers." The agency that reads the planet's secret traffic has, at minimum, found the problem interesting enough to study and archive. Whatever the NSA concluded, B1 and B3 are still unread, which tells you something about either the difficulty of the ciphers or the limits of what can be done without the one thing nobody has: the key document.

That is the quiet frustration at the center of all of this. A book cipher is only as breakable as your ability to guess the book. B2 fell the moment someone thought to try the Declaration of Independence. B1 and B3 are keyed to something else, some text the author had on his shelf and never named. It could be a specific edition of a common book. It could be a document long out of print. Until someone guesses it, the numbers hold. They could be cracked tomorrow by a bored teenager with the right hunch, or they could outlast everyone now alive, exactly as the Voynich manuscript and the Phaistos Disc have outlasted every generation that swore it would be the one to read them.

A Century of Digging

While the cryptographers argued, other people took shovels into the Bedford County hills.

For well over a century, treasure hunters have walked the ground around Montvale and the old Buford's tavern site, metal detectors in hand, trying to find by brute search what B1 will not spell out. The county has logged a long string of trespassing arrests, including a group from Pennsylvania in the 1990s who were caught digging where they had no right to dig. In the late 1980s a sanctioned expedition excavated at Porter's Mountain, one of the recurring candidate sites, and came up with Civil War-era artifacts and nothing else. The dig roughly broke even.

No vault. No iron pots. No gold. In more than a hundred and forty years of searching, not one coin from the alleged two deposits has ever turned up, and no banking or mining record of such a hoard has ever been traced to Thomas Beale.

That absence is either the final proof that there was never anything to find, or simply proof that a fortune buried in iron pots, six feet down, in a spot described only by a cipher nobody can read, is extraordinarily good at staying hidden. The pamphlet, after all, promised that the location was written down precisely. It just never promised we would be able to read it.

What the Beale Papers Still Will Not Tell Us

The honest position on the Beale ciphers is that they put you in an uncomfortable spot no matter which way you lean.

If the treasure is real, then an ordinary adventurer in the 1820s devised three ciphers of such quality that one of them has resisted supercomputers and the NSA for over a century, buried a fortune that has eluded a hundred and forty years of searching, and left the location in plain sight, unreadable, in a pamphlet anyone can buy. If the treasure is a hoax, then an anonymous author in the 1880s built a fake so elaborate that one of its ciphers genuinely decrypts against the Declaration of Independence, the other two carry the statistical signature of real encrypted text, the whole scheme points to a lost original worksheet, and then the author wrote himself into ruin warning readers away from the very puzzle he was selling.

Neither version is comfortable. Both leave something no one has been able to fully account for. The numbers on those two pages are finite. They are printed, public, and have been studied by some of the best codebreaking minds of the last century. They should have fallen by now. They have not. Whatever is written on B1, the line that would send someone straight to the vault or prove once and for all that there is no vault, is still sitting there in a row of numbers, waiting for the right book to be opened against it.

Frequently Asked Questions

Has anyone ever solved all three Beale ciphers? No. Only the second cipher, B2, which describes the contents of the treasure, has ever been read, and it was cracked using the United States Declaration of Independence as a key. The first cipher, which supposedly gives the vault's location, and the third, which lists the owners, remain unread to this day despite well over a century of attempts by amateurs, professional cryptographers, and supercomputers.

Why can't the Declaration of Independence unlock the other two ciphers? Because they are keyed to something else. A book cipher works only if you use the exact text the author used, and the person who built B1 and B3 clearly chose a different document, one they never named. Run the Declaration against B1 and you get gibberish, apart from one eerie near-alphabetical string that skeptics read as a telltale sign of a hoax. Until someone guesses the correct key text, the numbers stay locked.

Is the Beale treasure real, or is the whole thing a hoax? That is exactly the question no one can close. Serious analysts have argued both sides with real evidence. The hoax case leans on the suspicious alphabetical run in cipher one, an unverifiable Thomas Beale, and a possibly anachronistic turn of phrase. The believer case leans on the fact that cipher two genuinely decrypts and that the two unsolved ciphers show the statistical structure of real encrypted text rather than random noise. Both sides are left holding something they cannot explain.

Where is the Beale treasure supposed to be buried? The decoded second cipher places it in Bedford County, Virginia, a few miles from the site of an old tavern once run by a man named Buford, near present-day Montvale, in a stone-lined vault about six feet deep, with the gold and silver stored in iron pots. The exact spot is encoded in the unsolved first cipher, which is why generations of searchers have dug across those hills without ever pinning it down.

Could the Beale ciphers be cracked tomorrow? In principle, yes. Unlike a truly random code, a book cipher has a definite answer waiting behind a definite key. The entire problem is identifying the book or document the author used. That could yield to a sudden insight, a newly digitized old text, or a pattern-matching program that finally guesses right. Or it could hold for another century, the way a handful of the world's most famous unsolved codes have.

Further Reading

For readers who want to sit with this one longer, a few genuinely useful books. The most thorough local history is Peter Viemeister's The Beale Treasure: A History of a Mystery, written by a Bedford County author with access to the regional records. Simon Singh's The Code Book devotes a memorable chapter to the Beale cryptograms and to why amateurs cannot stop chasing them. And David Kahn's The Codebreakers remains the standard history of secret writing and sets the Beale affair in the longer story of ciphers and the people who break them.

If the Bedford County hills are calling and you intend to search legally, with permission, the tool generations of hunters have carried into those woods is a metal detector. It has turned up Civil War relics on those slopes. The vault, so far, it has not.