Cryptosporidium in Drinking Water
The Short Answer
If you read the Giardia profile, this is the parasite we said was coming — and it’s the harder one. Cryptosporidium (“Crypto” for short) is a microscopic parasite, also spread by swallowing tough little capsules — here called oocysts — that get into water through feces, human or animal. It causes cryptosporidiosis: days to weeks of watery diarrhea, cramps, nausea, and fever. For a healthy adult it’s usually a miserable bout that clears on its own. For someone with a weakened immune system, it can be severe, prolonged, and occasionally fatal.
What makes Crypto the hardest of the common waterborne pathogens is a combination of two stubborn traits. It’s smaller than Giardia — around 4 to 6 micrometers — so it’s harder to filter. And it’s extraordinarily resistant to chlorine: where chlorine kills most germs in minutes, Crypto can survive for days in a properly chlorinated swimming pool. That second fact isn’t a footnote. It’s the reason “the water’s treated, so it’s fine” failed catastrophically in Milwaukee in 1993, when this parasite slipped through a city’s treatment plant and made an estimated 403,000 people sick — the largest waterborne disease outbreak in recorded US history.
The reassuring part is that Crypto is beatable — just not with the tool people reach for first. Boiling kills it. A filter genuinely rated for cysts removes it. And UV light, almost magically, inactivates it at low doses even though chlorine barely touches it. What does not work is a chlorine residual or a carbon pitcher. We’ll cover what it does, why it’s hard, and exactly what removes it.
The Full Picture
Milwaukee, 1993
In the spring of 1993, heavy rain and snowmelt washed a heavy load of Cryptosporidium into Lake Michigan and toward one of Milwaukee’s two water treatment plants. Something went wrong with the filtration, and the oocysts passed through into the treated supply. Chlorination, which would have stopped most pathogens cold, did nothing to Crypto. Over about two weeks, an estimated 403,000 of the 1.6 million people served got sick — roughly two-thirds of the city — with about 4,400 hospitalized and an estimated 69 deaths, mostly among people with weakened immune systems. It remains the largest documented waterborne disease outbreak in US history, and it rewrote the rules: the federal regulations that now govern Crypto in public water exist largely because of it.
The lesson stuck because it was so counterintuitive. The water was being treated. It was being chlorinated. And it still carried a parasite that a chlorine residual is helpless against. Everything else in this profile flows from that single, stubborn fact.
Why it’s the hard one
Crypto is difficult for two reasons at once, and it’s the combination that matters. First, size: at roughly 4 to 6 micrometers, the oocysts are about half the size of Giardia cysts, which pushes them right up against what a home filter can reliably catch. A true absolute 1-micron filter still stops them — but the margin is thinner, which makes the certification (below) matter even more than it did for Giardia. Second, that armor. The oocyst is a tough shell wrapped around four dormant parasites, and it’s built to shrug off chemical attack. It survives more than seven days in a pool held at normal chlorine levels. Most pathogens need to arrive in real numbers to make you sick; Crypto, like Giardia, needs only a tiny dose. Small, chlorine-proof, and infectious in small amounts — that’s the whole problem in three words.
What it does to you
Cryptosporidiosis is a gut illness. A week or so after you swallow the oocysts, it brings watery diarrhea that typically lasts one to three weeks, along with stomach cramps, nausea, vomiting, low fever, dehydration, and sometimes weight loss. In a healthy person it’s unpleasant but self-limiting — most clear it without specific treatment, and there’s one prescription antiparasitic that can shorten it for some people.
The honest and important exception is people with weakened immune systems — those with advanced HIV/AIDS, organ-transplant recipients, people on chemotherapy. For them Crypto can become chronic, severe, and life-threatening, because the body can’t clear it on its own and the available drug doesn’t reliably work when the immune system is compromised; the real fix is restoring immune function. That’s where the Milwaukee deaths came from, and it’s why a Crypto risk in a household with a vulnerable person should be taken more seriously than the “miserable for a week” version most healthy adults experience.
Can You DIY This?
Yes — with one big asterisk that’s the opposite of most people’s instinct: do not count on chlorine.
The home toolkit is otherwise the same as for Giardia. Boiling handles a one-off questionable source immediately. For ongoing use, a filter rated for cysts or a reverse-osmosis unit removes it, and for a well, a UV system is the clean, permanent answer — and against Crypto specifically, UV is the standout. As with bacteria and Giardia, if a well tests positive the detective work is to find where surface water is getting in — a bad well cap, a shallow or flooded well, runoff at the wellhead, a septic problem nearby — and seal it, disinfect, and re-test.
The boundary is firmer here than usual, for two reasons. One: the stakes jump if anyone in the home is immunocompromised — for a vulnerable person this is a “get it right, verify it, don’t improvise” situation, which usually means UV or RO and, reasonably, a professional. Two: chlorine, the cheap fallback people lean on for water problems, simply isn’t a Crypto solution at home doses, so bleach or a basic chlorinator alone gives a false sense of safety. If the source is surface water you can’t seal off, or there’s a vulnerable person relying on it, that’s the line where this stops being a casual DIY fix.
What Actually Removes It
The goal is to physically remove the oocysts or hit them with something they can’t resist — and the standout tool here is the one chlorine-proofness can’t defeat.
UV disinfection is the hero of the Crypto story. Ultraviolet light damages the DNA inside the oocyst so it can’t infect or reproduce, and — remarkably — it does this at low doses, even though the same oocyst laughs off chlorine. It’s a chemical-free permanent system, common on wells, and the single best answer for this parasite. The usual caveats apply: it only works on clear water (so it’s paired with a pre-filter), it protects only inside the unit, and it needs power.
Boiling is the universal emergency answer — a rolling boil for one minute (three minutes above about 6,500 feet) kills Crypto along with everything else. Reliable, no equipment, not a way to run a household.
Filtration with a cyst-rated filter works, but demands the right filter. Look for an absolute pore size of 1 micron or smaller, or certification to NSF/ANSI Standard 53 or 58 for “cyst reduction” or “cyst removal.” Because the oocysts are small, those exact words matter even more than they did for Giardia — a “taste and odor” filter or a vague nominal 1-micron rating can let oocysts through. Reverse osmosis removes them as a matter of course.
Chlorination is the one to be blunt about: at normal residential doses and contact times, it does not reliably kill Cryptosporidium. This is the exception that breaks the usual rule. Even disinfecting a contaminated pool requires a special, prolonged hyper-chlorination procedure — far beyond a normal residual. A chlorine smell at your tap tells you nothing about your Crypto risk.
And the constant: a plain carbon or sediment filter with no cyst certification does not stop Crypto, and clear water is not safe water. The dependable approach is multi-barrier — but notice the mix shifts for this parasite. The reliable pairing here is filtration plus UV, not filtration plus chlorine. Crypto is exactly the contaminant that taught the water world not to treat any single disinfectant as the answer.
What the Rules Say — and What They Don’t
The EPA sets Crypto’s health goal at zero, and — as with Giardia — regulates it through a treatment technique rather than a number in the finished water. After Milwaukee, the Interim Enhanced Surface Water Treatment Rule required filtering systems to achieve 99% — “2-log” — removal of Cryptosporidium. Then the Long Term 2 Enhanced Surface Water Treatment Rule (2006) went further: it makes public systems monitor their source water for Crypto, adds extra treatment for the systems that find the most, and requires systems that don’t filter to actively inactivate it — frequently with UV. The whole regulatory arc is the Milwaukee aftermath written into law: the country watched chlorine fail, and rebuilt the rules around physical removal plus non-chlorine disinfection.
If you’re on city water, that layered machinery is running for you, and it’s why a repeat of Milwaukee is far less likely now. The familiar honest thread closes the loop: none of it reaches a private well. No source-water monitoring, no required treatment, no notice if something gets in. On a well or surface source, you are the treatment plant — and for this parasite, being your own plant means knowing that the chlorine option the rules deliberately moved beyond isn’t going to save you either.
Around the World
Globally, Cryptosporidium is far more than a swimming-pool nuisance. It’s one of the leading causes of diarrheal disease — and of diarrheal death — in young children in low-income countries; by some major studies it ranks second only to rotavirus among the worst causes of severe childhood diarrhea, where unsafe water and limited treatment let it spread freely and where malnourished or immune-weakened children are hit hardest.
The same toolkit scales down anywhere — filtration plus boiling or UV — but Crypto carries a specific trap for travelers, backpackers, and preppers. The default field treatment for “bad” water is a chlorine or iodine tablet, and against most things that’s reasonable. Against Crypto it’s weak. If there’s any real chance of this parasite, chemical tablets alone aren’t enough; you want a cyst-rated filter or UV in the kit. It’s a small, underappreciated point that has made a lot of careful hikers sick anyway.
Beyond the Kitchen Tap
If Giardia’s signature route is the backcountry stream, Crypto’s is the swimming pool. It’s the leading cause of recreational-water illness outbreaks in the United States, precisely because it survives in chlorinated pools, splash pads, and water parks for days. One person with diarrhea in the water can seed an outbreak that infects dozens. The practical rules follow directly: don’t swim if you’ve had diarrhea (and stay out for two weeks after it stops), don’t swallow pool water, and rinse off before getting in. It also spreads readily in childcare settings and household-to-household through ordinary contact.
For homesteaders, the standout exposure is livestock. Cattle — especially young calves — are a major reservoir, and the strain they carry readily infects people, so anyone with animals, a barn runoff path toward a well, or a surface-influenced water source has a real and concrete reason to care. Add the usual whole-property concerns — washing produce in suspect water, and even the occasional food outbreak (unpasteurized apple cider pressed from contaminated apples is a documented one) — and Crypto becomes another argument that being your own water utility means watching the land, the animals, and the glass together.
The Deep End
The most interesting thing about Crypto is the discovery that beat it. For years the working assumption was that any organism tough enough to ignore chlorine would also need brutal, impractical doses of UV light. In the late 1990s, researchers found the opposite: Cryptosporidium is knocked out by surprisingly low UV doses. The reason is mechanistic. Chlorine works by chemically oxidizing a cell, and the oocyst’s shell is built to resist exactly that. UV doesn’t oxidize anything — it scrambles the parasite’s DNA directly, and the chlorine-proof shell offers no protection against light passing through it. That one finding reshaped the entire UV-treatment industry and made the post-Milwaukee rules technically achievable. It’s a rare case where the science arrived just when the regulation needed it.
And it closes the thread that runs through this whole microbial group. There is no universal disinfectant. Chlorine conquered bacterial disease and is still the backbone of safe city water — but it loses to Crypto. UV beats Crypto and the other cyst-formers — but does nothing the moment water leaves the lamp. Filtration removes the large pathogens — but the very smallest, the viruses we’ll look at next, push right at its limits. The answer modern water safety landed on was never a single better weapon. It’s layering barriers that fail in different ways, so whatever one misses, another catches. Cryptosporidium is the parasite that taught the United States that lesson — and it charged 403,000 people for the tuition.
On a well or surface source — or have someone immunocompromised in the house? Chlorine won’t stop Crypto, but UV, reverse osmosis, or a cyst-rated filter will — and a test tells you what you’re actually dealing with. → Test Your Water