Cicada 3301: The Internet's Most Mysterious Puzzle
Who is Cicada 3301? Explore the cryptographic puzzles that stumped the internet from 2012 to 2014, the Liber Primus, and the theories about who's behind it all.
On January 4, 2012, an image appeared on 4chan's /b/ board. White text on a black background. The message was simple:
"Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301"
That's how Cicada 3301 began. What followed was the most elaborate, multi-layered, and bewildering series of cryptographic puzzles the internet has ever seen. The puzzles spanned steganography, prime number theory, classical literature, original music, physical posters in cities across the globe, dark web pages, bootable Linux CDs, and an entire book written in Anglo-Saxon runes that, over a decade later, still hasn't been fully decrypted.
Nobody knows who created these puzzles. Nobody knows what Cicada 3301 actually is. The few people who solved the early rounds say they were invited to a private forum and asked to work on projects related to privacy, cryptography, and information freedom. Then everything went quiet.
What You'll Learn
- •The First Puzzle (2012)
- •How Did the Cicada 3301 Puzzles Work?
- •The Second and Third Puzzles (2013 and 2014)
- •What Is the Liber Primus?
- •What Happened to People Who Solved It?
- •Who Is Behind Cicada 3301?
- •Is Cicada 3301 a Government Operation?
- •Why Did Cicada 3301 Stop?
- •Frequently Asked Questions
The First Puzzle (2012)
The image posted on 4chan looked like nothing special. But hidden inside it, using a technique called steganography (embedding data inside an image file), was a message. Extracting it required specific software and a basic understanding of how digital images store hidden information.
That hidden message led to another clue. That clue led to another. And another. Each step required a different skill: cryptography, number theory, knowledge of classical literature, familiarity with Tor and the dark web, and eventually, the ability to find physical objects in the real world.
The first puzzle took solvers through roughly this sequence:
- •Steganography: Hidden text in the original 4chan image, extractable with OutGuess software
- •A URL leading to an image of a duck with another hidden message
- •A phone number that played a recorded message containing a clue referencing a book by Agrippa
- •A series of prime numbers that, when multiplied (509 × 503 × 3301), produced 845145127
- •The website 845145127.com, which displayed a cicada image and a countdown timer
- •When the countdown ended, GPS coordinates appeared, pointing to physical locations in cities worldwide: Warsaw, Paris, Seoul, Sydney, Hawaii, Miami, and others
- •At each location, physical posters had been placed bearing QR codes and the cicada logo
- •The QR codes led to Tor hidden services (dark web pages) with further instructions
The puzzle ran for nearly a month. It required collaboration among hundreds of people across time zones. The solvers organized on IRC channels and shared progress in real time, gradually piecing together a path that no single person could have navigated alone.
How Did the Cicada 3301 Puzzles Work?
What made Cicada 3301 unique wasn't any single technique. It was the sheer range of knowledge and skills required across the entire chain. The puzzles combined:
- •Steganography: Hiding data in images, audio files, and other media
- •Cryptography: Caesar ciphers, Vigenère ciphers, RSA encryption, and PGP signatures
- •Number theory: Prime numbers, modular arithmetic, and mathematical patterns
- •Literature and philosophy: References to works by William Blake, Aleister Crowley's The Book of the Law, the Welsh Mabinogion, and others
- •Original music: Two tracks, "The Instar Emergence" and "Interconnectedness," with hidden data embedded in the audio
- •Physical operations: Posters placed in at least 14 cities across five continents
- •Dark web navigation: Tor hidden services requiring specific access methods
Every clue was verified with the same OpenPGP private key, confirming that each step came from the same source. This was important because, as the puzzles gained fame, imitators and hoaxes appeared. The PGP signature was the only way to confirm authenticity, and Cicada 3301 was meticulous about it. In April 2017, they issued a signed statement denying the validity of any unsigned puzzle.
The physical posters were perhaps the most striking element. Whoever created these puzzles had the resources and organization to simultaneously place posters in Warsaw, Paris, Seoul, Sydney, Miami, and other cities. That's not something a bored programmer does from their bedroom.
The Second and Third Puzzles (2013 and 2014)
Cicada 3301 returned on January 4, 2013, posting a new puzzle with similar structure but significantly increased complexity. The cryptographic tasks went deeper, requiring more advanced knowledge of mathematics, programming, and historical references.
The 2013 puzzle was solved by Marcus Wanner, who documented his experience. Those who reached the final stage were asked questions about their views on information freedom, online privacy, and censorship. People who answered satisfactorily were invited to a private forum.
But there was a twist. Cicada 3301 expressed disappointment that most solvers had reached the final stages by working in groups rather than individually. Swedish solver Joel Eriksson, who'd made significant progress, was among those effectively shut out because his progress relied partly on collaborative work.
On January 4, 2014, a third puzzle appeared, announced via Twitter from the same account used the previous year. This round introduced something entirely new: the Liber Primus.
What Is the Liber Primus?
The Liber Primus (Latin for "First Book") is an entire book written in Anglo-Saxon runes. It was released as part of the 2014 puzzle and represents the deepest, most complex layer of Cicada 3301. It contains multiple pages of runic text, along with imagery and embedded data.
Only a handful of pages have been successfully decrypted. The decrypted portions contain philosophical statements about privacy, consciousness, and the nature of information. One passage reads:
"An anonymous movement. We are everywhere. We are everyone. We are nobody."
Other decrypted sections reference concepts from information theory, discuss the importance of privacy as a fundamental right, and contain what appear to be instructions or guiding principles.
The bulk of the Liber Primus remains undeciphered. Communities of solvers have worked on it for over a decade. The encryption appears to use multiple layers, with different techniques applied to different sections. Some pages may require a key derived from solving earlier pages, creating a sequential dependency that makes brute-force approaches impractical.
The Liber Primus is, in effect, the final puzzle. It's been sitting in the open since 2014, waiting for someone to crack it.
What Happened to People Who Solved It?
The few confirmed winners of the 2012 and 2013 puzzles have shared fragments of their experience, though most remain guarded about specifics.
According to Marcus Wanner and other verified winners, those who completed the puzzles were:
- •Vetted through questions about their views on privacy, information freedom, and censorship
- •Invited to a private online forum
- •Assigned projects intended to further the group's ideals, specifically around cryptography, privacy tools, and anonymity
One notable project was CAKES: Cicada Anonymous Key Escrow System. This software was designed to trigger the automatic publication of sensitive data if a whistleblower (like someone in Edward Snowden's position) was murdered or incarcerated. It was essentially a dead man's switch for leaked information.
"Nox Populi," a 2013 winner, has publicly documented her experience on YouTube, describing the solving process and offering a "more realistic, fact-based view of the organization." She now facilitates community efforts around Cicada 3301 on a Discord server.
Winners consistently describe the organization as small, serious about privacy and cryptography, and philosophical in orientation. Nobody has described it as a scam, a cult, or a joke. Whatever Cicada 3301 is, the people who made it through genuinely believe in its mission.
Who Is Behind Cicada 3301?
This is the central mystery, and after more than a decade, the answer is still: we don't know. Several theories have emerged.
A Privacy Advocacy Group
The most consistent evidence points to Cicada 3301 being a small, loosely organized group of cryptographers and privacy advocates. The decrypted portions of the Liber Primus emphasize information freedom, anti-censorship, and the right to privacy. The projects assigned to winners (like CAKES) align with this mission. The group's philosophical references, drawing on William Blake, Aleister Crowley, and other thinkers who challenged institutional authority, reinforce this reading.
A Government Intelligence Agency
Many people have speculated that Cicada 3301 is a recruitment tool for the NSA, CIA, MI6, or Mossad. The reasoning: the puzzles require exactly the skill set intelligence agencies need (cryptography, computer security, analytical thinking), and the physical poster placement across multiple countries suggests resources beyond a typical civilian group.
Against this theory: intelligence agencies have their own recruitment pipelines. Posting puzzles on 4chan would be an extraordinarily unorthodox approach. And the philosophical content of the Liber Primus, with its emphasis on anti-censorship and information freedom, runs directly counter to the missions of most intelligence agencies.
That said, the US Navy released its own cryptographic challenge in 2014 called Project Architeuthis, explicitly based on the Cicada 3301 model. So at minimum, government agencies found the format interesting enough to imitate.
A Secret Society or Cult
The references to Aleister Crowley's The Book of the Law, the ritualistic structure of the puzzles (repeating on the same date each year), and the use of the cicada as a symbol (representing rebirth and emergence) have led some to speculate about occult or secret society connections. Some observers have noted parallels with Freemasonry and other fraternal organizations that use progressive testing to identify worthy initiates.
The winners who've spoken publicly don't describe anything cult-like. But they also don't describe anything that would rule it out entirely. The secrecy is thorough enough that most theories remain plausible.
A University Research Project
One theory ties specific elements of the puzzles, including the terms "Cicada" and "3301," to a cryptography or cybersecurity program at a major university. The methodical structure, the academic references, and the focus on recruiting people with specific technical skills could fit an academic context. No university has claimed responsibility.
Is Cicada 3301 a Government Operation?
The short answer: probably not, but nobody can completely rule it out.
The longer answer involves weighing the evidence. The physical poster operation across 14+ cities suggests significant resources. But it doesn't necessarily require government-level resources. A small, internationally distributed group of dedicated individuals could coordinate poster placements in their respective cities. The entire operation might require fewer than 20 people in the right locations.
The philosophical content doesn't match government messaging. The emphasis on privacy, anti-censorship, and whistleblower protection is more consistent with cypherpunk ideology than any national security agenda.
Chilean authorities once claimed Cicada 3301 was a "hacker group" engaged in illegal activities. Cicada 3301 responded with a PGP-signed statement denying any involvement in illegal activity. When a separate group calling themselves "3301" hacked Planned Parenthood's database in 2015, Cicada 3301 issued another signed statement disavowing them.
These responses suggest an organization that cares about its reputation and has clear ethical boundaries, not exactly the profile of a shadow government operation.
Why Did Cicada 3301 Stop?
New puzzles appeared on January 4 in 2012, 2013, and 2014. No new puzzle arrived on January 4, 2015. A brief clue appeared on Twitter on January 5, 2016. Then, in April 2017, Cicada 3301 posted what appears to be their final verified PGP-signed message, stating that any unsigned puzzle should be considered invalid.
Since then, silence.
Several explanations have been proposed:
The Liber Primus is the final test. The third puzzle was never fully solved. Perhaps Cicada 3301 is waiting for someone to crack the remaining pages before issuing new challenges.
The organization achieved its goals. If the puzzles were meant to recruit a specific number of people with specific skills, that mission may have been completed.
Internal dissolution. Small, secretive organizations can fragment or dissolve without public explanation. Key members may have moved on.
Security concerns. The intense public scrutiny of Cicada 3301 may have made continued public operations risky for members who value anonymity above all else.
Whatever the reason, the Liber Primus sits open, waiting. Communities of solvers continue working on it. The PGP key could authenticate a new message at any time. And the mystery of who built the most elaborate puzzle the internet has ever seen remains unanswered.
For more mysteries that involve hidden messages and unsolved codes, explore the Voynich Manuscript, a 15th-century book written in an unknown script that codebreakers have been trying to crack for centuries. The Zodiac Killer sent cryptographic ciphers to newspapers, and one of them wasn't decoded until 2020. And for another case where someone vanished into anonymity, D.B. Cooper pulled off a hijacking in 1971 and was never identified.
Frequently Asked Questions
Has Cicada 3301 been solved?
The 2012 and 2013 puzzles were solved by several individuals. The 2014 puzzle introduced the Liber Primus, a book written in runes, which has only been partially decrypted. The full Liber Primus remains unsolved as of 2026.
Who created Cicada 3301?
Nobody knows. Theories range from a privacy advocacy group to a government intelligence agency to a secret society. Winners of the early puzzles describe an organization focused on cryptography, privacy, and information freedom, but the group's identity has never been resolved.
What happened to people who solved Cicada 3301?
Winners were invited to a private forum and asked to work on projects related to privacy and cryptography, including a dead man's switch for whistleblowers called CAKES. Several winners have shared fragments of their experience publicly but remain careful about specific details.
Is the Liber Primus still unsolved?
Most of it, yes. Only a handful of pages have been decrypted. The decrypted content contains philosophical statements about privacy, consciousness, and information freedom. Solver communities continue working on the remaining pages.
Is Cicada 3301 still active?
The last verified PGP-signed message was in April 2017. No new puzzles have appeared since the 2014 round. The organization could theoretically reappear at any time using its PGP key to verify authenticity, but there's been no confirmed activity for years.
Want to explore more mysteries?
We've got plenty more rabbit holes to go down.