Learn about what it means to be a professional codebreaker and how to get started in this cybersecurity role.
Cryptanalysts are code breakers. The term “cryptanalysis” comes from the Greek words kryptós (“hidden”) and analýein (“to analyze”). As a cryptanalyst, you’re responsible for analyzing hidden messages by decoding or decrypting data, even without the encryption key.
In this article, we’ll discuss what it’s like to work as a cryptanalyst. Learn more about the skills and experience you’ll need to get the job, as well as tips on how to build that experience.
The Oxford Languages defines cryptanalysis as “the art or process of deciphering coded messages without being told the key.” If you enjoy the thrill of solving a tough puzzle, a career in cryptanalysis may be worth considering.
Companies might use cryptanalysis to look for security weaknesses or potential data leaks. Government organizations might use it to decipher encrypted communications, and law enforcement might use it to gain access to potential evidence stored in encrypted files.
The earliest form of encryption dates back to ancient Egypt, where unusual hieroglyphs replaced the usual ones in the tomb of Khnumhotep II. Many civilizations have used some form of secret code throughout history, particularly in times of war to hide communications from the enemy.
As a cryptanalyst, you’ll study ciphers, codes, and encryption systems to learn how they work and gain access to information that would otherwise be impossible to interpret.
The specific tasks you perform as a cryptanalyst will vary depending on the industry you work in and the organization you work for. Here are some cryptanalyst tasks and responsibilities pulled from real job listings:
Collect, process, and analyze intelligence information
Analyze garbled intercepts
Exploit encrypted materials
Debug software programs
Diagnose weaknesses in cryptographic algorithms
Develop new cryptanalysis tools
Develop methods for exploiting computer network vulnerabilities
A few different cybersecurity roles fall within the field of cryptology—the study of coded messages. Since many of these job titles sound the same, they’re often used interchangeably, but there are differences. If cryptanalysts are the code breakers, cryptographers are the code makers. Cryptographers create the encryption methods that help protect everything from top secret intelligence to our email messages and credit card numbers. Since cryptology refers to the art and science of both making and breaking codes, cryptologists might do both.
Cryptanalysts can work in a variety of settings, but they’re most often associated with government agencies and law enforcement. The work you perform in this role will vary by the type of organization you work for. Here’s a look at what you might expect:
Government: Working for the government might mean deciphering sensitive data transmitted by criminal organizations around the world to gather useful intelligence.
Law enforcement: As a cryptanalyst in law enforcement, you may be tasked with gathering evidence of crime by breaking codes and cyphers in digital and written letters, notes, ledgers, and other documents. You may also testify as an expert in legal proceedings.
Finance: Banks and credit card companies may hire cryptanalysts to analyze and diagnose security weaknesses in ATMs, online banking systems, and digital communications.
Academics: Working at a university will often mean researching ciphers, codes, and cryptographic techniques. You may also teach cryptology to university students.
Private sector: At a private company, you may assist product developers by reviewing code for vulnerabilities or offering security guidance.
If you enjoy working with numbers and love a good puzzle, working in cryptanalysis could offer an exciting and challenging career option. Developing the technical skills to work in the field can often yield other rewards in the form of a higher salary and a range of career opportunities.
In 2018, cryptanalysts employed by the US federal government earned an average salary of $125,324, according to FederalPay.org . Salary surveys conducted by the Economic Research Institute report an average annual salary of $77,006 across all industries .
According to the US Bureau of Labor Statistics, information security occupations should see job growth of 31 percent between 2019 and 2029, much faster than the average rate across all occupations .
Many other roles within cybersecurity use cryptanalysis and cryptographic techniques. With the right cryptanalysis skills, you could consider working as a penetration tester, ethical hacker, or digital forensic investigator, for example. Some cryptanalysts work as security consultants.
Working in cryptanalysis often means building a solid foundation in cybersecurity first. But there’s more than one path toward this career. Here are some steps you can take to work toward a job as a cryptanalyst.
Most cryptanalysis jobs require at least a bachelor’s degree in computer science or cybersecurity. Some roles may request a master’s degree or even a PhD. If you plan to work in cryptanalytic research, you’ll likely need a doctoral degree in a related field.
While a bachelor’s degree in a technical or math-related field can help you develop a strong foundation for cryptanalysis, it’s also possible to get started with a non-technical degree with the right skills (more on that later).
The National Security Agency, for example, offers a full-time, paid Cryptanalysis Development Program designed for entry-level employees looking to enhance their skills in security. No particular major is required.
Cryptanalysts are typically considered a more advanced role in cybersecurity. This means that you might start out as a cybersecurity analyst. Mid-level roles like penetration tester or digital forensic analyst can help you further develop your cryptography skills. With the right degree and skill set, you could also get a job directly out of university.
Working in cryptanalysis involves several technical skills. Focusing on these skills while you’re in school or as you prepare to switch careers can help enhance your resume (and make you more effective on the job).
Advanced mathematics: Cryptanalysts use linear algebra, number theory, algorithms, and discrete mathematics to break ciphers.
Programming languages: Coding languages like Java, Python, C, or C++ help cryptanalysts write complex algorithms.
Encryption: It’s helpful to have an understanding of the various methods of encryption, including symmetric and asymmetric encryption.
Data structures: Knowing how data is structured plays a key role in decoding encrypted data.
You don’t have to enroll in a university to start developing these skills. Websites like The Cryptopals Crypto Challenges give you problems to solve based on real-world weaknesses. As a bonus, completing the challenges doubles as a great way to practice a new programming language.
If there’s a specific skill you’d like to improve, consider enrolling in an online class or completing a short guided project. Here are some options to get you started:
While cryptography has been around for thousands of years, there are few certifications specific to the field. Earning a cybersecurity certification that covers cryptanalysis topics can still help you develop new skills and validate those skills to future employers. Here are a few with relevance to cryptanalysts:
EC-Council Certified Encryption Specialist (ECES)
GIAC Penetration Tester (GPEN)
EC-Council Certified Ethical Hacker (CEH)
Certified Information Systems Security Professional (CISSP)
If you're just starting out in the world of cybersecurity, consider an entry-level credential, like the IBM Cybersecurity Analyst Professional Certificate. You can build job-ready skills in less than six months while earning a shareable certificate from an industry leader.
Yes, cryptography and cryptanalysis are both math-centric fields. If you’re interested in a career in cryptology, consider taking courses in linear algebra, number theory, and discrete mathematics.
An ethical hacker stages planned, legal attacks on computer systems and networks to find vulnerabilities before malicious hackers can. Cryptanalysts focus more specifically on deciphering encrypted messages without the key. Some ethical hackers might use cryptanalysis in their practice.
A brute force attack is a cryptanalytic technique that involves trying all possibilities for a password or encryption key, one by one. As a cryptanalyst, you’ll use other techniques to decipher encrypted data to help narrow down the possible keys, therefore making brute force attacks potentially quicker and more effective.
1. FederalPay.org. "Cryptanalyst - Federal Salaries of 2018, https://www.federalpay.org/employees/occupations/cryptanalysis." Accessed August 17, 2021.
2. Economic Research Institute. "Cryptanalyst Salary, https://www.erieri.com/salary/job/cryptanalyst/united-states." Accessed August 17, 2021.
3. US Bureau of Labor Statistics. "Information Security Analysts, https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm." Accessed August 17, 2021.
This content has been made available for informational purposes only. Learners are advised to conduct additional research to ensure that courses and other credentials pursued meet their personal, professional, and financial goals.