The image that appeared on 4chan on January 4, 2012, promised a test. Anyone could read the invitation. The next person to hear from its author would have to work out where the message continued. At the bottom of the image was the number by which the puzzle came to be known: 3301.
Listen to “Cicada 3301” on Spreaker.A copy of the picture preserved its appearance. A copy of the file preserved something else as well. Extra characters had been attached to it. That distinction became important almost immediately to Joel Eriksson, a computer security researcher who documented the route he took through the clues.
The clue behind the picture
A shift of letters in the appended string gave Eriksson an address. At the other end was a picture of a duck and what looked like the end of the trail. Read another way, the wording suggested the name of a program called OutGuess. When he applied it to the original image, the program recovered hidden text.
It is possible to follow this part of the hunt without knowing who set it. The instructions led to a book cipher and a page on Reddit. The puzzles required different operations at different points. Sometimes the important thing was a word. Sometimes it was a property of the file that no one looking at the picture alone would think to record.
When a phone call sent readers outdoors
A telephone recording asked for three prime numbers associated with the original picture. One was 3301. Its width and height, 509 and 503 pixels, supplied the others. Multiplication yielded the number used in a web address. Eventually a list of geographical coordinates appeared. Paper notices bearing a cicada and a QR code were found at locations on that list.
An image that had started on one message board could now direct people to a physical place. A solver did not need to be near every poster. Someone who reached one could share what it contained, allowing people elsewhere to keep working. Sharing also changed the race once the path led to a destination that stopped admitting newcomers.
Eriksson told Fast Company how a literary clue involving William Gibson’s Agrippa led to a Tor address. By the time he arrived, admissions had closed. His account stops at an unusually useful boundary. He could show other people how to reach the door. He had no firsthand account of what went on behind it.
Someone did reach the end
Marcus Wanner was fifteen when he completed the first round. In a Virginia Tech Magazine profile he described contact with other successful participants and a group interested in privacy. They worked on a software project that did not last. A named participant’s account answers a question that often gets lost in retellings. At least some people got through. It does not identify the organizers or establish the experience of every person contacted.
A timeline of the public puzzles
2012. The original image led solvers from hidden text to a phone recording, physical posters and an invitation with limited admission. 2013. A second public round followed. Being able to recognize the recurring name and imagery was useful to an audience, but anyone could copy them. 2014. A third round produced material associated with Liber Primus, a book written in runes. Reading the symbols and recovering an intelligible passage were separate problems. Knowing the alphabet did not give a reader all the instructions needed to decipher a page. 2017. An archived signed message cautioned readers about false trails and told them to verify signatures. A cryptographic signature gives a reader a way to test a message against a known public key. It does not supply a name or street address for whoever controls the matching private key.Frequently asked questions
How much of Liber Primus has been solved?
The Cicada Solvers community distinguishes two sets. It lists solutions to the seventeen pages of the first and to two of the fifty-eight pages of the second. In that accounting, fifty-six pages in the second set remain undeciphered. The fact that the book still has unread pages says nothing about whether anyone finished the earlier 2012 challenge.
Was it a recruitment test?
The initial invitation sought people with particular abilities, and Wanner described being invited into a group. There is evidence for selection and subsequent collaboration. Publicly available accounts do not establish a government sponsor or identify the organization that arranged all three rounds.
How can anyone tell whether a new puzzle is genuine?
A cicada drawn on a poster was once enough to make people stop and look. For people assessing later claims, the more revealing thing is whether a message carries a verifiable signature associated with the original project. The symbol can be copied in seconds. Verifying the signature asks a question the image alone cannot answer.
Research Sources
The following resources were consulted to verify and update this article.
- Joel Eriksson, “Solving Cicada 3301” — Firsthand 2012 walkthrough, including file extraction, the telephone clue and coordinates.
- Fast Company: interview with Joel Eriksson — His later account of the literary clue, Tor destination and missed admission.
- Virginia Tech Magazine, “Coder, creator” — 2015 profile and interview with Marcus Wanner; reported privacy collaboration.
- Cicada community archive: April 2017 message — Reproduction of the signature-verification warning; an archive, not an identified organizer.
- Cicada Solvers: Liber Primus briefing — Community assessment of solved pages and the outstanding hash destination.
- Cicada Solvers: complete archive overview — Chronology and the community record of verified communications.
The Internet’s Creepiest Unsolved Mysteries — Codes, Videos, and Messages Nobody Can Explain
🔎 Related Investigation:
If this case pulled you deeper into the mystery, continue into:
🔎 If this story stayed with you, the author suggests these internet mysteries next:Explore more internet mysteries here: View all internet mystery stories →
- The cryptic internet mystery nobody could fully decode
- The Reddit account that sparked theories about secret operations online
- The Webdriver Torso videos and Google’s explanation
Watch This Story on YouTube
Prefer to watch? See the full story on our YouTube channel.
