Cicada 3301: The Internet Puzzle That Led to Real Streets

The phone recording wanted three prime numbers. One was 3301. The other two were hiding in something the caller already possessed: the dimensions of a JPEG.

The image was 509 pixels wide and 503 pixels high. Multiply those numbers by 3301, put “.com” after the result, and a new website appeared. It displayed a cicada and a countdown. An anonymous internet challenge now had a scheduled appointment. ²

That sequence captures what made Cicada 3301 compelling. A strange claim was followed by something that worked. Extract the right message, follow the right instruction, and another door opened.

Behind those doors, however, the central questions remained: who was setting the test, and what happened if you passed?

An invitation without a name

In early January 2012, an image circulated on imageboards, including 4chan. It announced a search for intelligent people, said a message was concealed inside the picture, and challenged readers to find it. Its signature was simply 3301.

Security researcher Joel Eriksson documented his investigation in a post originally published on January 13, while the puzzle was still unfolding. His account places the image’s appearance on January 4 and cautiously identifies 4chan’s /b/ board as a possible origin. That caution matters: a surviving copy establishes what an image contained more readily than it establishes the exact circumstances of its first upload. ¹

The opening Cicada 3301 invitation: white lettering on a black background. — The invitation circulated in January 2012. Original puzzle artwork, attributed to Cicada 3301; copy preserved by Joel Eriksson. ¹

The invitation offered a flattering proposition. Somewhere, someone had constructed a selection process, and anyone reading could try to qualify. There was no application form explaining the position. The application was figuring out where to go next.

The duck was a useful disappointment

Eriksson found readable characters appended to the image file. They invoked the Roman emperor Claudius and included an encoded address. Shifting the characters revealed a link to another picture: a duck.

It looked like a dead end. Its wording, however, hinted at OutGuess, a tool for hiding and recovering information inside images. Applying it to the original picture revealed another message and a book code. ¹

This was an effective lesson in how the challenge behaved. Seeing the picture was insufficient; participants had to examine the file containing it. Even an apparent failure could carry an instruction.

Encryption disguises a message’s meaning. Steganography conceals its presence. Cicada used both, making participants ask two separate questions: where is the information, and how should it be read?

When the puzzle acquired a street address

The route continued through Reddit, encoded text, and a telephone recording. The prime-number calculation eventually produced the countdown website. When the waiting ended, geographic coordinates appeared.

Participants reported finding paper notices at locations around the world. The notices carried a cicada image and a QR code. Scanning them returned the hunt to online material. Eriksson’s contemporary account records the coordinates and describes how people working through an IRC chat channel arranged local checks. ¹

A paper notice bearing a cicada and QR code attached to a pole in Warsaw. — A Cicada notice photographed in Warsaw, reproduced in NPR’s January 2014 report. Source: NPR / KPBS; photographer not identified in the accessible caption. ⁹

The change in scale was persuasive. A file could be uploaded by anyone with a few spare minutes. Physical notices required preparation, placement, and people willing to visit them.

Yet those notices could establish only so much. They demonstrated coordination. They could not identify an intelligence agency, prove a global organization, or reveal the organizers’ resources.

That distinction is easily lost in a good mystery. Evidence of effort becomes evidence of power; evidence of anonymity becomes evidence of a conspiracy. For participants, the immediate problem was more practical. If the next clue was on another continent, solving alone became difficult.

The crowd reached a narrow door

The physical clues encouraged cooperation. Someone could decode a message while someone else photographed a notice thousands of miles away.

Later stages led toward a service on Tor, the network used to access sites with .onion addresses. According to Eriksson’s interview with Fast Company, he reached a stage after its intake had closed. He had reconstructed the public route but missed the opportunity to proceed further. ²

This complicates the familiar claim that somebody “solved Cicada.” Solving a cipher, completing a public trail, receiving a private invitation, and identifying the organizers are different achievements. A headline can flatten them into one triumphant sentence. The evidence cannot.

It also exposes a tension in the design. Public collaboration helped the hunt advance, while the stated recruitment premise focused on individual ability. A crowd could discover a destination without every person in that crowd understanding the journey.

The invitation returned

In January 2013, another image announced that the search was continuing. The archived material preserves a hidden, signed message containing a book code and a literary riddle. ³

A third major public round followed in January 2014. Its opening again involved an image, concealed information, and signature verification. The repetition gave returning participants something recognizable: an established procedure for deciding where to begin. ⁴

By then, a reader could approach Cicada with expectations. Inspect the files. Look for a second layer. Check whether the message belonged to the established cryptographic identity.

But familiarity with the method did not guarantee a finish. The 2014 material led to Liber Primus, Latin for “First Book,” which became the enduring obstacle in the public record. ⁷

A book that resists a clean ending

Liber Primus contains pages written in runes, with illustrations and other visual features. The solver community distinguishes two sets: an initial 17 pages, known as LP1, and a later release of 58 pages, known as LP2.

CicadaSolvers currently lists all 17 LP1 pages as solved. Of LP2, it lists two solved pages and 56 unsolved. Those separate releases explain why accounts sometimes give apparently contradictory totals for the book’s progress. ⁶

A page of runic writing from Liber Primus. — The runic page known as “A Warning,” from the solved first set of Liber Primus. Original puzzle artwork, attributed to Cicada 3301; preserved in the scream314 community archive. ¹⁰

“The book remains unsolved” can suggest that nobody has understood any of it. “Parts have been decoded” can suggest that completion is close. Neither description, by itself, captures the scale of the remaining work.

In January 2016, an archived signed message directed attention back to Liber Primus. It presented the book’s words, meanings, and numbers as the route forward. The public challenge had become a sustained examination of an existing object. ⁵

Recognizing a message without recognizing its author

Cicada’s use of PGP signatures supplied a way to check continuity. Its early material announced that subsequent messages would be cryptographically signed. ¹

The important reference is the established public key, with the full fingerprint:

6D85 4CD7 9333 22A6 01C3 286D 181F 01E5 7A35 090F

The archived 2016 verification output records that fingerprint. A valid signature establishes a relationship between a message and the corresponding signing key. It does not disclose the civil identity, employer, or motives of whoever controls that key. ⁵

The April 2017 note generally treated as the last verified public communication reinforces signature checking and warns against misleading trails. ⁸

That warning creates a demanding standard for later claims. A cicada logo is easy to copy. An ominous paragraph is easy to write. Neither establishes continuity with the original puzzle.

What remains behind the curtain

The public artifacts support a substantial story: a functioning sequence of clues, international participation, recurring challenges, and an unfinished book.

They do not establish who commissioned the exercise or its ultimate purpose. Recruitment was the organizers’ stated premise; the identity and objectives of the group remain unverified. ⁷

The most interesting feature of Cicada is the imbalance between those two kinds of knowledge. Participants could prove that a particular decoding step worked while knowing almost nothing about the person who had prepared it.

That made trust unusually specific. You could trust an answer enough to follow the next clue without trusting—or even recognizing—the author.

The surviving pages give the story somewhere concrete to rest. They can be copied, inspected, compared, and challenged. Whatever happened beyond the private invitations, the public record still leaves readers facing the same task: determine what the material actually says before deciding what its mystery means.