France → Cecil, Elizabeth I and the Council · homophonic cipher with nomenclator · 1560–63

Sir Nicholas Throckmorton’s ciphered extracts from France, 1560–63

Nicholas Throckmorton
fromNicholas Throckmorton
William Cecil
toWilliam Cecil

BL Add MS 4136: twenty DECODE records of ciphered extracts, none with a decipherment on the record. Their plaintext has been in print since Forbes's edition and is calendared in the Calendar of State Papers, Foreign; Throckmorton's third cipher survives as a key sheet. Each record was matched to its printed counterpart, and two short passages were decrypted with the key and agree with the print. Tomokiyo had identified the printed texts and the keys before this work.

Daniel Bourdeau · posted · updated

Method: read from existing decipherment · Extent: complete

Summary. The target was a group of twenty DECODE records, R9220–R9234, R9242–R9245 and R9255. All 54 image references were obtained; they are 39 distinct photographs, because adjacent records share leaves. Four nearby key records add 17 photographs. With R9262, the archived “Third Cipher”, a complete numbered extract on R9220 decrypts to the text printed in Forbes I, p.355. A second, shorter check on R9230 matches Forbes II, p.12. A concordance matches all twenty records to their printed counterparts, most by date and addressee. 42 tokens were checked against the key; the twenty records were not decrypted in full. Tomokiyo had already identified the printed texts and surviving keys; this work confirms that route and corrects the target description.

01 A key test on the first leaf

R9220, f.110, begins in the middle of a letter. Its first complete numbered extract, (6), decrypts to:

all be it i be revoked or the warr breake

In modern English: “albeit I be recalled, or war break out.” Throckmorton is asking Cecil to obtain permission for Mr Jones to remain abroad and gain experience, even if the ambassador is recalled or war begins. Forbes prints the phrase in volume I (1740), p.355, within the 7 March 1559/60 despatch. The same leaf includes the 8 March continuation and the separate letter to the Queen of 9 March.

A signature above numbered lines of cipher signs, extracts (6) and (7)
R9220, f. 110: below Throckmorton’s signature, the numbered extracts (6) and (7) in his third cipher. Extract (6) decrypts to “all be it i be revoked or the warr breake”. Image: British Library, Add MS 4136 f. 110, via DECODE R9220.

The 27 transcribed cipher tokens include two nulls. The alphabet on R9262 image P1 supplies the letters: dotted 4, 5 and 6 all represent r; plain 4 represents o; colon-marked 6 represents u/v. P3 gives the marked A for all and marked b for be. P4 gives the suffix -ed, and P9 gives the curved T for the/to. The check therefore covers the alphabet, the word symbols, the suffixes and the nulls together. The word before breake is warr, written with two different r homophones; it is not wars.

R9230, f.133, offers a second check at the opening of extract (1):

orleans or burges

These fifteen alphabet tokens agree with Forbes II (1741), p.12. CSP Foreign V, no.425, paragraph 11 summarizes the surrounding warning: the apparent preparations against Orleans or Bourges may conceal an attack on Rouen, Newhaven (Le Havre), and Dieppe. No.426 describes a separate decipher of the ciphered passages. The rest of that sentence has not been transcribed token by token here.

Both checks have grade H: values taken from the archived key. Spacing and capitalization are editorial. The printed texts were at hand during the check, so these are known-plaintext checks rather than blind decryptions. The token labels and values are preserved in control.json and control_9230.json, with a replay script. The script checks the substitution of those labels; the identification of each glyph rests on inspection of the images.

02 Four nearby key records

RecordLeaf and contentsUse here
R9257f.172; Percy extracts above a separate alphabet and nomenclatorNot established as a Throckmorton key
R9260ff.177–178; a preceding fragment and Throckmorton's first/second keysEarlier systems, not the key tested here
R9261f.179; heading “Sr Thomas Smith's Cipher”A different alphabet, relevant to distinguishing Smith material
R9262ff.180–185; “Sr Nicholas Throckmorton's Third Cipher,” eleven photographsMatches both sampled passages

The third cipher is a nomenclator: homophonic letters, code symbols (marked initial letters) for words, names and places, symbols for word endings, and nulls. Dots distinguish values; these samples do not use two-digit superscripts. The key sheets in the volume are reconstructions, and their catalogue date does not show that they are the keys used at the time.

03 Record-to-edition concordance

Each row gives the printed counterpart; passages were checked against the cipher only where stated. CSP often abridges the full letters. Dates use January-start years: March 1559 becomes March 1560, and January 1562 becomes January 1563, without changing the day. R9234 remains 1 November 1563. Shared leaves must be separated at the letter headings before assigning their passages.

DECODEFoliosDateToPublished sourceEvidence and limits
R92201107–8 March 1560CecilCSP 2, 837; Forbes I, pp.352–356; control on p.355Key control verified; shared leaf also contains R9221.
R92211109 March 1560QueenCSP 2, 844; Forbes I, p.356Date/addressee match; same image as R9220.
R9222111–1129 March 1560CecilCSP 2, 845; Forbes I, p.358Date/addressee match.
R9223112–11615 March 1560QueenCSP 2, 859; Forbes I, p.360Date/addressee match.
R9224116–11815 March 1560CouncilCSP 2, 860; Forbes I, p.369Date/addressee match.
R9225118–12021 March 1560QueenCSP 2, footnote 1; Forbes I, p.376CSP prints this in a footnote because the State Paper Office original could not then be located.
R9226120–12221 March 1560CecilCSP 2, 882; Forbes I, p.384Date/addressee match.
R9227122–12321 March 1560CouncilCSP 2, 881; Forbes I, p.382Date/addressee match.
R9228123–12924 September 1562QueenCSP 5, 690; Forbes II, p.61Date/addressee match.
R9229129–13315 October 1562QueenCSP 5, 848; Forbes II, p.111Date/addressee match.
R92301335 August 1562QueenCSP 5, 425; Forbes II, p.12 (sampled passage); CSP no.426 is the separate decipherOrleans/Burges passage matched to CSP paragraph 11 and the corresponding Forbes letter.
R92311349 September 1562QueenCSP 5, 596; CSP V, no.596Date/addressee match.
R9232134–1359 September 1562CecilCSP 5, 597; CSP V, nos.597–600 (two same-day letters and copies)Opening refers to dispatching Francisco on the ninth. No.597 is the principal candidate; keep no.599 for comparison.
R9233135–13630 October 1562CecilCSP 5, 935; Forbes II, p.156Date/addressee match.
R9234136–1381 November 1563QueenCSP 6, 1356; CSP VI, no.1356Manuscript date agrees with 1563; do not change to 1562 just because preceding letters are earlier.
R9242149–1503 January 1563QueenCSP 6, 12; Forbes II, p.251DECODE uses old-style 1562.
R9243150–1516 January 1563QueenCSP 6, 35; Forbes II, p.270DECODE uses old-style 1562.
R9244151–15313 January 1563QueenCSP 6, 83; Forbes II, p.275DECODE uses old-style 1562.
R9245153–15520 September 1563CecilCSP 6, 1233; CSP VI, no.1233Date/addressee match; CSP explicitly says cipher deciphered.
R9255169–17122 November 1562 (Throckmorton portion)QueenCSP 5, 1099; Forbes II, p.208; CSP no.1100 is the deciphered copyComposite record: Smith, Throckmorton, Somer and Randolph. Throckmorton is on ff.169–170. The catalogue author Lomer is apparently Somer. Other writers require separate keys.

R9232 is a provisional match to CSP V no.597: the opening mentions dispatching Francisco on the ninth. Nos.599–600 are other same-day Cecil material and remain comparison candidates. R9255 is composite: the Throckmorton portion matches 22 November 1562, CSP V nos.1099–1100, but the Smith, Somer and Randolph material requires separate identification and keys.

04 Prior work and the target description

Satoshi Tomokiyo's Elizabethan cipher study already identifies the Add MS 4136 ciphertexts as largely extracts, cites Forbes, reconstructs three Throckmorton ciphers, and records the archive keys in a November 2024 note. Neither the key nor the plaintext is new here. DECODE's status for these records means only that no decipherment is attached to the record; the plaintext has been in print since the 1740s.

The remark about meaningful two-digit superscripts comes from the neighbouring Serno Gilino/Bishop of Worcester entry on Tomokiyo's Unsolved Historical Ciphers page. It was misattributed to Throckmorton in the target description. Tomokiyo's two specifically unresolved cases are the marginal ciphertext on R2988 and John Wod's 1568 material on R2989. Both lie outside these twenty records and remain unresolved here.

05 What is established, and what is not

All 71 referenced image files passed JPEG signature checks and have SHA-256 hashes in the research inventory. The 54 target references contain 39 distinct images, including a byte-identical R9220/R9221 pair. Two short passages, totalling 42 tokens, were checked against the third cipher. Their published counterparts agree.

No token count or percentage is claimed for the whole corpus. Most record-to-edition matches have not been checked glyph by glyph. A diplomatic edition would require transcribing the 39 unique leaves, separating all letter boundaries and other writers, and aligning every numbered extract with the printed text. The result answers the target's premise that the key was unknown. It is not a complete edition of the twenty records.

06 Sources

Research files, exact token labels, source inventory and published-text dossier: throckmorton/.