Rose Greenhow’s letter on mourning paper, Washington 1861

01 The letter

The leaf survives in fragments laid down on a backing. NARA’s docket (image 4) reads “Written in Characters by Mrs G – on Mourning Paper. Fragments of a Letter”. It has no date, signature or address. The Library of Congress copy (World Digital Library 2706) and the Santa Clara University exhibit (item 3281) date it 23 August 1861, the day of the arrest and the seizure. The writer is presumed to be Greenhow, and the addressee her Confederate contacts at Beauregard’s headquarters, where Thomas Jordan received her reports; the letter names neither.

Side 2 (image 2) has two lines of ink at the top; the rest is show-through. Image 3 is a separate scrap of figures with a few clear words.

02 The 1864 key

When Greenhow drowned off Fort Fisher in October 1864, trying to land from the blockade runner Condor, a cipher table was found on her. A copy of it is in the Confederate Navy subject file, NARA M1091, “DC – Codes and cryptography – Miscellaneous”, image 0484, headed “Lamb Papers CXXIX. Copied A. H. L.” (the last initial is uncertain) and docketed “This paper was found on the person of Mrs Rose O. Greenhow”. Image 0485 is a photostat of the same sheet; image 0483, a white-on-black “Confederate cipher 1864”, is a different table and does not fit.

On side 1 the key works as written, with a few points checked on the signs: G (a plain 8) and U (a struck 8) are distinct, as are I (a crossed 4) and R (a looped 4). N has two forms: the hooked form of the key sheet (BEING, MORNING, FIND) and a looped l with a crossbar that is not on the sheet (LELAND, PANICK, the second N of MORNING); its value comes from context, and every word that contains it is otherwise keyed. Doubled letters are written twice (ATTACK, WILL, EFFORT, FERRY); the sheet’s inverted-second-letter rule is not used here.

Controls (decode.py): with the key, 17 of the 27 whole cipher words are in an English word list and the mean letter-pair score is −2.49; 2,000 random substitution keys average 0.5 words (best 5) and −4.72; the key shifted by one letter gives 4 words; the true key with the signs shuffled inside each word gives at most 6. The word count understates the fit, because her spellings (BUISY, PANICK, BELEIVE) and the words cut by losses do not count.

03 Side 1 deciphered

In her spelling, with words in clear on the leaf in italics; [x] marks letters supplied where the paper is lost or a sign is missing, [?x] a conjecture:

Al[?l] is acti[vi]ty. McLeland (McClellan) is buisy. Myste[…] a[…] […]but the panick is gr[?ea]t. A[…] […]y. Attack is hourly expected. They beleive this: the atta[ck] will [b]e simultaneou[s] fr[om] […]r[?d]s Ferr[y], […] [?Bal]timore. […]y eff[o]rt is being made to find out who g[?a]ve the alarm. A tro[?op o]f cavalry u[…] […]nt fr[o]m here [?th]is morning. L[…] Harpe[?r’s F]erry […]ont.

The letter belongs to the weeks between First Bull Run (21 July 1861) and the arrest. McClellan took command at Washington in late July; the panic in the city, the attack expected hourly, the hunt for whoever gave the alarm, cavalry leaving “this morning” and Harper’s Ferry fit that summer. A clear pencil draft in the same seized file, naId 1634043, headed “10 Aug. 1861”, says in similar words that “McClellan is very active and very discreet” and that “an attack is apprehended”. It is not a copy of this letter, but it supports the date.

Three signs on the leaf are not what the key predicts: an extra R-sign inside EXPEC-R-TED, no S-sign at the end of SIMULTANEOU (the word ends in U and a dot), and no O-sign in EFF|RT, where the line ends at the ruled border. These are her slips.

04 What remains open

• Side 1, paper losses: al[l], acti[vi]ty, atta[ck], [b]e, Ferr[y], eff[o]rt, tro[op o]f, [th]is, Harpe[r’s F]erry. Restorations from context, marked; the signs are lost with the paper.
• Side 1, clear words cut by losses (myste…, a…, u…, l…) and the heading “P 31”.
• “Edwards Ferry” and “Baltimore” are conjectures: only R, d, S, F, E, R, R and TIMORE are on the paper.
• Side 2: two lines give only fragments (gr…e, tim…, bo…, …ganiz…ing), 17 signs; not enough for sentences.
• The scrap of figures (image 3), tested against the key in review. The key writes numbers with letter-like signs (1 = a, 2 = d, 5 = m, 6 = b …; 10 = III), so these Arabic figures are not its numbers; read as the key’s digit-shaped letter signs (3 = C, 4 = I or R, 5 = O, 8 = G) they give no words, and 2 and 6 have no value at all. With “$5 dollers $25” at the top and figures from 5 to 104, the scrap looks like a money reckoning. Three key-like signs on its last line are too few to decipher.

Earlier work: applying the 1864 key to Greenhow’s 1861 material is not new; the Rosenbach did so in 2011 for another note, and the North Carolina State Archives hold a copy of the key. No decipherment of this letter was found: not on the NARA record, the Library of Congress or Santa Clara copies, nor in the Official Records, Series II, vol. 2 (the Greenhow case papers, pp. 561–577), Pinkerton’s Spy of the Rebellion (1883) or Greenhow’s My Imprisonment (1863). Fishel’s The Secret War for the Union (1996) and Blackman’s Wild Rose (2005) could only be searched through the web. A Union decipherment of the time cannot be excluded: the Official Records (II 2, p. 561) say the torn letters from her stove were “assorted and placed together so as to be read and copied”, and Jordan wrote on 29 October 1861 (pp. 564–565) that the War Department, holding one of her letters in this cipher, “ought to have worked out the key”.

Full texts

The transcription and the decryption of every document on this page, so that the reading can be used and checked. Short files are shown here; all are in the repository.

Greenhow, mourning-paper letter, side 1 (naId 1634036 image 1) read in part

From Washington in summer 1861: McClellan is busy and the panic is great; an attack is hourly expected and they believe it will be simultaneous from [...]rds Ferry (Edwards Ferry?) and [...]timore (Baltimore?); an effort is being made to find out who gave the alarm; a troop of cavalry [...]nt from here this morning; Harper's Ferry is named. Intelligence from the Greenhow ring before her arrest on 23 Aug 1861.

Builds coherent sentences, but under the read bar of 95% of words read as sense (60% here); the holes are marked in the reading.

# Greenhow, letter in cipher on mourning paper, side 1: sign transcription
# NARA RG 59, Seized Correspondence of Rose O'Neal Greenhow (entry A1-986), naId 1634036, image 1
# https://catalog.archives.gov/id/1634036
#
# Each sign is written as a neutral shape label, not as a letter (the labels and their key values are in
# key_1864.md and decode.py). Read on enlarged crops of image 1 by a second agent, independently of the first
# reading; the two agree except where noted in NOTES.md.
#   |   word gap or dot          ~   paper loss (one or more signs)
#   =x  word written in clear    +   word runs on to the next line
#   ?   after a label: uncertain sign
#
# Heading (not read): "P 31 ?" (a sign like the A-sign, then 31, then a lost or unclear sign)
#
# Shape labels: hk = + with small x (A), b7 = 7 (B), c3 = 3 (C), cx = + with second small cross (D), yf = Y (E),
# tr = triangle (F), e8 = plain 8 (G), cm = comb (H), f4 = crossed 4 (I), n9 = 9/P-like (K), ls = long s (L),
# dd = diamond with dot (M), qm = ?-form (N), lb = looped l with crossbar (N, not on the key sheet), f5 = 5 with
# top bar (O), cc = circle with cross (P), ph = looped 4 / phi (R), bx = box with X (S), dt = D with dot (T),
# e8s = struck 8 (U), zt = Z with tail (V), fl = flag/triangle with dot (W), ta = tau (X), ys = 7 over a stem (Y)
#
01 hk ls ~ | f4 bx | hk c3 dt f4 ~ dt ys
02 dd c3 | ls yf ls hk lb cx | =is | b7 e8s f4 bx ys | =myste~
03 =a~ ~ b7 e8s dt | =the | cc hk lb f4 c3 n9
04 f4 bx | e8 ph yf? hk? dt | =a~ ~ ys | hk dt dt hk +
05 c3 n9 | =is | cm f5 e8s ph ls ys | yf ta cc yf c3 ph dt +
06 yf cx | dt cm yf ys | b7 yf ls yf f4 zt yf | =this
07 =the | hk dt dt hk ~ fl f4 ls ls ~ yf | bx f4 +
08 dd e8s ls dt hk qm yf f5 e8s | =fr~
09 ph cx? bx | tr yf ph ph ~
10 dt f4 dd f5 ph yf | ~ ys | yf tr tr +
11 ph dt | =is | b7 yf f4 qm e8 | dd hk cx yf | dt f5 | tr f4 +
12 qm cx | f5 e8s dt | fl cm f5 | e8 hk? zt yf | =the
13 hk? ls hk ph dd | hk dt ph f5 ~ tr | c3 hk +
14 zt hk ls ph ys | =u~ ~ qm dt | tr ph +
15 ~ dd | cm yf ph yf ~ f4 bx
16 dd f5 ph qm f4 lb e8 | =l~ ~ cm hk ph cc yf ~
17 yf ph ph ys | ~ f5 qm dt
#
# The same lines with the key applied (decode.py prints this as one run):
# 01 A L _ | I S | A C T I _ T Y
# 02 M C | L E L A N D | (is) | B U I S Y | (myste~)
# 03 (a~) _ B U T | (the) | P A N I C K
# 04 I S | G R e a T | (a~) _ Y | A T T A +
# 05 C K | (is) | H O U R L Y | E X P E C R T +
# 06 E D | T H E Y | B E L E I V E | (this)
# 07 (the) | A T T A _ W I L L _ E | S I +
# 08 M U L T A N E O U | (fr~)
# 09 R d S | F E R R _
# 10 T I M O R E | _ Y | E F F +
# 11 R T | (is) | B E I N G | M A D E | T O | F I +
# 12 N D | O U T | W H O | G a V E | (the)
# 13 a L A R M | A T R O _ F | C A +
# 14 V A L R Y | (u~) _ N T | F R +
# 15 _ M | H E R E _ I S
# 16 M O R N I N G | (l~) _ H A R P E _
# 17 E R R Y | _ O N T
#
# Signs the key does not account for: the R-sign between C and T in EXPEC-R-TED (line 5); no S-sign after
# SIMULTANEOU (line 8, the word ends in U and a dot); no O-sign in EFF|RT (lines 10-11, line end at the ruled border).

# Greenhow, mourning-paper letter, side 1: decryption line by line against transcription_side1.txt
# Key: 1864 Greenhow key, NARA M1091 naId 62017285 image 0484 (key_1864.md). python decode.py reproduces the decode.
# Capitals = cipher signs with their key value; lower case in a cipher word = uncertain sign; (word) = written in clear;
# _ = paper loss. After "->": the line read as words, [x] supplied, [?x] conjecture.

hd  P 31 ?                                   -> heading, not read
01  AL_ | IS | ACTI_TY                        -> al[?l] is acti[vi]ty
02  MC | LELAND | (is) | BUISY | (myste~)     -> McLeland (= McClellan) is buisy. myste[...]
03  (a~) _BUT | (the) | PANICK                -> a[...] [...]but the panick
04  IS | GReaT | (a~) _Y | ATTA+              -> is gr[?ea]t. a[...] [...]y. Atta-
05  CK | (is) | HOURLY | EXPECRT+             -> -ck is hourly expec-   (an extra R-sign between C and T)
06  ED | THEY | BELEIVE | (this)              -> -ted. They beleive this:
07  (the) | ATTA_WILL_E | SI+                 -> the atta[ck] will [b]e si-
08  MULTANEOU | (fr~)                         -> -multaneou[s] fr[om]   (no S-sign: the word ends in U and a dot)
09  RdS | FERR_                               -> [...]r[?d]s Ferr[y]   ("Edwards Ferry" is a conjecture)
10  TIMORE | _Y | EFF+                        -> [?Bal]timore. [...]y eff-
11  RT | (is) | BEING | MADE | TO | FI+       -> -[o]rt is being made to fi-   (no O-sign at the line break)
12  ND | OUT | WHO | GaVE | (the)             -> -nd out who g[?a]ve the
13  aLARM | ATRO_F | CA+                      -> alarm. A tro[?op o]f ca-
14  VALRY | (u~) _NT | FR+                    -> -valry u[...] [...]nt fr-
15  _M | HERE_IS                              -> -[o]m here [?th]is
16  MORNING | (l~) _HARPE_                    -> morning. l[...] Harpe[?r's F]-
17  ERRY | _ONT                               -> -erry [...]ont

N: two sign forms. The ?-form (key sheet) in BEING, MORNING (first N), FIND; a looped l with a crossbar (not on the
key sheet, value from context) in LELAND, PANICK and the second N of MORNING. Every word with it is otherwise keyed.
G and U are distinct (plain 8 = G; struck 8 = U); I and R are distinct (crossed 4 = I; looped 4 = R), as on the key.

# Greenhow, letter in cipher on mourning paper, side 1: the reading as sentences

English, so no translation. Spelling as written (buisy, panick, beleive, McLeland). Words in clear on the leaf are in
italics. Marks: [...] = lost with the paper; [x] = letters supplied where the paper is lost or a sign is missing;
[?x] = a conjecture or an uncertain sign.

## Reading

Al[?l] is acti[vi]ty. McLeland (McClellan) is buisy. *Myste[...]* *a[...]* [...]but *the* panick is gr[?ea]t.
*A[...]* [...]y. Attack *is* hourly expected. They beleive *this*: *the* atta[ck] will [b]e simultaneou[s]
*fr[om]* [...]r[?d]s Ferr[y], [...] [?Bal]timore. [...]y eff[o]rt *is* being made to find out who g[?a]ve *the*
alarm. A tro[?op o]f cavalry *u[...]* [...]nt fr[o]m here [?th]is morning. *L[...]* Harpe[?r's F]erry [...]ont.

Greenhow, mourning-paper letter, side 2 (naId 1634036 image 2) decoded, not read

A mechanical decode with holes in most sentences: shown so that the transcription and the key can be checked and improved, not as a reading.

# Greenhow, letter in cipher on mourning paper, side 2 (NARA naId 1634036, image 2)
# https://catalog.archives.gov/id/1634036
# Only two ink lines at the top; the rest of the side is show-through from side 1.
# Read once, by the first agent only; NOT re-read independently. Signs given by their key value; [...] = loss,
# [?] = unread sign, [Z?] = uncertain.

1  G R [...] E . T I M [...] B O [...]
2  I [...] G A N I [Z?] [?] I N G .

# Greenhow, mourning-paper letter, side 2 (two ink lines): decoded, not read
# Key values as in transcription_side2.txt. Tentative; not re-read independently.

1  G R [...] E . T I M [...] B O [...]       -> gr[...]e. tim[...] bo[...]
2  I [...] G A N I [Z?] [?] I N G .          -> [?or]ganiz[?]ing   ("organizing"?, a guess)

Key: key_1864.md

05 Sources

• National Archives, RG 59, Seized Correspondence of Rose O’Neal Greenhow (entry A1-986), naId 1634036, “Letter Written in Cipher on Mourning Paper by Rose Greenhow”, images 1–4; naId 1634043, the clear draft of 10 August 1861.
• National Archives, RG 45, M1091 Subject File of the Confederate States Navy, “DC – Codes and cryptography – Miscellaneous”, naId 62017285, images 0483–0485 (the key is 0484).
• Official Records of the Union and Confederate Armies, Series II, vol. 2, pp. 561–577, the Greenhow case papers, archive.org.
• Rose O’Neal Greenhow, My Imprisonment and the First Year of Abolition Rule at Washington (London, 1863), archive.org; Allan Pinkerton, The Spy of the Rebellion (1883).
• The Rosenbach, “Code Breaker” (2011), on another Greenhow cipher note read with the same family of key.

Files: targets/greenhow1861/ (notes, shape-label transcription, key table, decode.py and its controls, the figure-scrap test). Contributed by WAINUT in pull request #100; reviewed for the site on 27 October 2026.