A cryptanalyst tests how well encrypted information is protected. The job can involve studying mathematical weaknesses, examining errors in software that uses encryption, and analyzing encrypted signals.
The goal is to understand whether protection could fail, under what conditions, and how confidently the evidence supports that conclusion.
Ad
cybersecurityguide.org is an advertising-supported site. Clicking in this box will show you programs related to your search from schools that compensate us. This compensation does not influence our school rankings, resource guides, or other information published on this site.
Featured Cybersecurity Training
| School Name | Program | More Info |
|---|---|---|
| Purdue Global | Online BS in Cybersecurity | website |
| UC Berkeley School of Information | Online Master’s in Cybersecurity | No GRE/GMAT Required | website |
| Arizona State University | Online BS in Information Technology - Cybersecurity | website |
| Southern New Hampshire University | Online BS in Cybersecurity or Online MS in Cybersecurity | website |
What does a cryptanalyst do?
Cryptanalysts test ideas using mathematics and software. They might compare encrypted samples, investigate how a protocol handles keys, or write a program that measures how much work a proposed attack requires.
Findings typically become a technical report that describes assumptions, tests, results, and limitations.
Cryptographers also design and study protective algorithms. A cryptanalyst’s emphasis is testing the weaknesses of those designs or their use. The specialties overlap, but the roles are not identical. See the cryptographer career guide.
| Work area | Example task |
|---|---|
| Algorithm analysis | Test whether a method has mathematical patterns that weaken security |
| Implementation review | Examine how software generates or uses secret keys |
| Intelligence cryptanalysis | Analyze encrypted data and signals, and test hypotheses with software |
The NSA’s Cryptanalysis Development Program provides an example of intelligence work. Its duties include analyzing cryptographic data and testing software, rather than simply decoding messages.
Skills and preparation
The most relevant preparation combines mathematical reasoning, programming, and clear technical writing. Topics include number theory, probability, algorithms, Python, and reading how real cryptographic systems work. The IACR research archive gives examples of published methods and experimental results.
For a useful personal project, reproduce a result from a public teaching exercise or research paper. Write down the hypothesis, code, measurements, and limits. This demonstrates more than a generic list of programming languages. Keep practice to public or authorized data.
Degree programs in mathematics, computer science, and related quantitative fields can help. The NSA’s CADP description specifically says it does not require one particular major.
Some advanced research roles expect graduate education, but applicants should assess the position rather than assume a PhD is necessary.
General cybersecurity certifications are not a substitute for mathematical and research ability. The sources reviewed did not identify one certification as a standard requirement for cryptanalysts.
Salary and job outlook
| Source | U.S. figure | Scope |
|---|---|---|
| NSA CADP notice | $87,362–$172,578/year | Advertised range for a closed Maryland posting spanning experience levels; reproduced by a USAJOBS-data job archive |
| BLS mathematicians | $126,710 median/year | Broad mathematician occupation, not exact-title cryptanalyst pay |
The NSA range comes from a closed 2026 federal job listing. The original application page did not expose full details during verification.
BLS projects 1% growth for mathematicians from 2025 to 2035, not for cryptanalysts. Read the BLS occupational data with that distinction in mind.
Where cryptanalysts work
Government intelligence organizations and research teams are clear examples. Search related titles such as cryptanalytic computer scientist, cryptologic mathematician, or cryptography security researcher, and read the actual responsibilities.
Classified government positions may require screening or clearance; academic and commercial roles differ. See NSA career information and the security clearance guide.
Frequently asked questions
Cryptanalysis investigates security weaknesses; cryptography also develops protective methods. Researchers sometimes do both.
Not necessarily. Many assignments involve data analysis, testing, software, and reporting, even without recovering a complete message.
It depends on the role. Research positions may favor advanced study, while NSA’s CADP says no single major is required.
Python is useful for experiments. Some work also uses C or C++ for performance and software analysis.
For some classified government positions, yes, subject to the posting’s specific requirements. Commercial and academic research work is different.
Use public cryptography challenges, published teaching examples, or systems you are authorized to test. Record both the result and what it does not prove.
References
- NSA | NSA development programs | Accessed November 2026
- IACR | Homepage | Accessed November 2026
- NIST | NIST post-quantum standards | Accessed November 2026
- IFCA | Homepage | Accessed November 2026
- BLS | Mathematicians and statisticians info | Accessed November 2026