In the United States
The American Cryptogram Association has run since 1930 and publishes a bimonthly magazine of ciphers made by members for members to solve, by pencil and paper. It has a division for young solvers called the Young Tyros, with a newsletter for under twelves, free code and cipher books for new young members, and no age limit at all. Members pick a nom de plume instead of using their name.
It is the closest thing to a cipher club that a child anywhere in the world can join by post.
cryptogram.org Free beginner guides and tutorials
The National Cryptologic Museum
Just outside Washington, next to the National Security Agency at Fort Meade in Maryland, and free to walk into. Enigma machines you are allowed to touch, a Jefferson cylinder, the Navajo code talkers, and a crypto treasure hunt for children: solve the puzzles around the museum, hand in the sheet, get a prize.
Opening days have changed more than once, so check before you drive.
Bebras, in the USA
Not cryptography, but the right kind of thinking and the right age: a forty five minute challenge of logic puzzles, run through schools each November, with a category for ages six to eight and another for eight to ten.
The National Cipher Challenge
Run by the University of Southampton every autumn for more than twenty years, and the closest thing in the world to what this site is about. A story unfolds over eight to ten rounds, each with a message to break, getting harder as it goes. The early rounds are practice, with a certificate for finishing any one of them.
The ciphers it uses are the ones on this site: Playfair, ADFGVX, book ciphers, Jefferson disks, transpositions. A child who has worked through the pages here has met most of them already.
Registration usually opens in mid to late September and the competition starts in early October. It is aimed at Year 7 to 13, which is a little older than this site, so for a nine year old it is something to grow into — or to do alongside a grown-up.
picoCTF
Carnegie Mellon University runs the largest capture the flag competition for school students, free, online, usually over about ten days in March. Cryptography is one category among several: there is also forensics, web, and reverse engineering.
You must be at least thirteen to have an account, and under eighteens need a parent or guardian's consent, so this one is for later or for an older sibling.
The best part is not the competition. It is picoGym, where past challenges stay available all year round, so there is no waiting for a date.
Everywhere else
Bebras runs in more than ninety countries, and the international site lists the organiser for each one. In the United Kingdom it is run by the Raspberry Pi Foundation.
The National Cipher Challenge and picoCTF are both open to entrants from anywhere, though the prizes usually are not.
Two more things worth doing
Go to Bletchley Park, if you are in Britain. If you are anywhere near it, the huts are still there, the machines are still there, and the story of the ten thousand people who worked there is told properly. Several of the pages on this site are about things that happened in those rooms.
bletchleypark.org.uk tnmoc.org
The National Museum of Computing sits on the same estate and is a separate charity with its own ticket. Colossus is there, rebuilt and running.
Start a club. Two people and a cipher is a club. The schools page has a six week outline, and everything on this site is free to print and copy.
Dates change every year. The ones above are the usual pattern, not a promise: check each competition's own site before planning anything around them.
Our challenges For schools