Cicada 3301 was a set of cryptography puzzles posted under the name “3301” in 2012, 2013, and 2014. The puzzles claimed to recruit “highly intelligent individuals.” No one has proven who ran them, whether any solver was hired, or whether recruitment was ever the real point.
Published: June 5, 2026. Last reviewed: June 5, 2026.
What Cicada 3301 was, in plain terms
Cicada 3301 posted three rounds of cryptographic puzzles, each beginning on January 4 in 2012, 2013, and 2014, under a single pseudonym, “3301,” and each round pulled thousands of would-be solvers worldwide [1][2]. The first image went up on 4chan with a plain white-on-black message: “Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image.” [1][7]
That framing, a test that “will lead you on the road to finding us,” is the whole reason the recruitment story exists. The number itself reads like a wink. 3301 is prime, and prime cicadas (the Magicicada genus) surface on 13-year and 17-year prime cycles, which fits a puzzle obsessed with primes from its first clue to its last [5]. The stated purpose every year was the same: find the few who make it through [1].
Two things get conflated here. The puzzle existing is a verified fact, documented in the public record on Cicada 3301 and in years of archived solver threads [1]. What the puzzle was FOR is not. Those are different claims, and most write-ups blur them.
How the first puzzle actually unfolded
The 2012 puzzle ran as a documented chain: each solved layer handed solvers the next, moving from a 4chan image to a Caesar cipher, to steganography, to a Reddit board, to a book cipher, to real-world coordinates, and finally to a Tor hidden service [4]. I work chains like this backward, and this one is unusually well preserved because solvers screenshotted and mirrored every stage as it happened.
Hidden text in the first image read “TIBERIVS CLAVDIVS CAESAR,” a tell for a Caesar cipher; shifting the letters produced an Imgur link to a decoy duck image whose caption leaned on the words “guess” and “out” [4]. That pointed to OutGuess, a steganography tool, which extracted a message routing solvers to a Reddit board and a book cipher built from Thomas Bulfinch’s “Mythology,” specifically a Mabinogion tale [4][1]. The decoded text gave a phone number and, eventually, fourteen sets of GPS coordinates across five countries [4][7].
| Stage | Technique | What it revealed |
|---|---|---|
| 4chan image | Appended text + Caesar cipher | An Imgur decoy link |
| Decoy image | OutGuess steganography | A Reddit board and a book-cipher key |
| Reddit board | Book cipher (Bulfinch / Mabinogion) | A phone number, then 14 coordinates |
| Physical sites | QR-code posters in 5 countries | A Tor (.onion) hidden service |
Posters taped to poles in cities from Warsaw to Seattle carried QR codes and a cicada drawing; one warning read, “You’ve shared too much to this point. We want the best, not the followers.” [4] The chain ended at an onion address where the fastest solvers submitted an email and dropped out of public view [4].
The case for recruitment
On February 5, 2012, “3301” posted a PGP-signed message reading “We have now found the individuals we sought,” and described the group as a kind of think tank advocating liberty, privacy, and security [1][2]. Solvers who finished were sorted into a private forum, screened on their views about censorship and privacy, and assigned project work [2].
Marcus Wanner, who solved the 2013 entry and gave his real name to David Kushner’s Rolling Stone feature, the most detailed first-person account, described being placed in a small cell building cryptographic software, including a tool framed as a “dead man’s switch” for whistleblowers [2]. Swedish security researcher Joel Eriksson reached a Tor hidden service that displayed “We want the best, not the followers” before it went dark, and told Fast Company in 2014 he expected a brainteaser and got something stranger [6][2].
The recruitment read has one strong external data point. The US Navy publicly said it copied Cicada 3301’s puzzle style to find cryptologic warfare officers, and a CIA officer reportedly said the agency discussed building its own version while denying it ran the original [3][1]. The popular telling vs the actual record: no verified case exists of any Cicada solver being hired by NSA, CIA, MI6, or anyone else [1][3].
The case for an experiment
Strip away the spy-recruitment frame and Cicada 3301 also fits the shape of a self-running experiment: a structure that filters people by skill, speed, and ideology, then watches what they build, with no confirmed payroll on the other end [1][3]. Wanner’s own account supports this read. As the novelty wore off, his cell realized they were effectively unpaid developers, members drifted away, and the darknet project site eventually went offline unfinished [2].
The structure rewards specific traits. It selects for cryptography skill, for speed (latecomers were turned away at the QR stage), and for a privacy-and-anti-censorship worldview baked into the screening questions [2][4]. That is closer to a recruiting funnel or a sociological study than a one-time game, which is why cryptographers writing in The Conversation called it a mystery that genuinely keeps specialists up at night [3].
| Theory | Core claim | Strongest point against |
|---|---|---|
| Intelligence recruitment | NSA/CIA/MI6 talent funnel | No confirmed agency hire on record [1] |
| Private secret society | Crypto-privacy collective | No public output ever shipped [2] |
| Social experiment / ARG | A study of how solvers behave | No one monetized or claimed it [1] |
| Self-promotion / hoax | Mythmaking for its own sake | Cryptographic quality was real [3] |
Liber Primus, the part nobody has finished
Liber Primus, Latin for “first book,” is the central unsolved artifact from the 2014 material: a manuscript written in runes that the solver community has only partly decoded after more than a decade [4][5]. It is written in Gematria Primus, an alphabet of 29 runes where each rune carries an English value and a prime number, the values running as consecutive primes in ascending order [5][1].
On the math: the cipher rewards people who think in primes. One embedded poem, “The Instar Emergence,” hides a parable whose rune values multiply to 1,595,277,641, a number whose reverse is itself prime [5]. Solver trackers split the book into sections; by common community counts, 17 pages of the first section are solved while most of a second 58-page section remains open [4][5].
As of June 2026, the bulk of Liber Primus is still undeciphered, and the runes have outlasted nearly every other thread of the mystery [4][5]. The last move Cicada made in public was a warning, not a reveal.
After 2014, the name got hijacked
In April 2017, an OpenPGP-signed message from “3301” told solvers to beware false paths and to trust only messages verified against key ID 7A35090F, which is the cryptographic line that separates real Cicada from impostors [1][4]. That signature matters because the name had already been pulled into other fights.
What the screenshot actually captures here is provenance, not authorship. After 2017, figures including Thomas Schoenberger and Manuel Chavez (known online as Defango) publicly feuded over who controlled the Cicada 3301 name, and the symbol drifted toward QAnon-adjacent circles that the original group, by its signed statements, never endorsed [1]. Cicada 3301 had earlier disowned unrelated actors using its “name, number, or symbolism,” and the only reliable test of a genuine message stayed the PGP signature [1].
This is the part that gets lost. Virality is not authenticity. A logo and a number travel freely; a valid signature does not, and conflating the two is how a cryptography puzzle becomes a conspiracy mascot. Jonathan Nolan even confirmed Cicada inspired part of “Person of Interest,” which is how deep the lore reached pop culture without anyone ever verifying who 3301 was [1].
So, recruiting or experimenting?
The honest answer is that the evidence supports the recruitment framing and the experiment framing about equally, and neither has ever been confirmed by a named, accountable source [1][3]. What the record actually shows is a chain of real cryptography, real screening, real project work, and a complete absence of any proven employer at the end of it.
My read, after working the chain backward through archived threads and signed messages, is that “recruiting or experimenting” may be a false binary. A group can run a sincere talent funnel AND treat the whole thing as a live study of who shows up. Both can be true, and Cicada 3301 was careful enough to leave neither one disprovable. The runes are still there. The signature still verifies. The recruiter never sent a paycheck anyone has produced. You can keep more from esovitae’s contemporary mysteries and theories collection, follow the broader mysteries and anomalies reporting, and read more from Riley Tanaka.
Frequently asked questions
Is Cicada 3301 real?
Yes. The puzzles verifiably existed and ran in 2012, 2013, and 2014, documented across 4chan, Reddit, Twitter, and physical posters in five countries [1][4]. What stays unproven is who created them and why.
Who is behind Cicada 3301?
No one knows for certain. Speculation has named the NSA, CIA, MI6, a secret society, and a private cryptography collective, but no claim has been confirmed and no organization has taken credit [1][3].
Did Cicada 3301 actually recruit anyone?
Solvers were screened and given project work, but no verified case exists of a solver being hired by any agency. Marcus Wanner’s cell built software that was never publicly released [2].
What is the Liber Primus?
Liber Primus is a runic manuscript written in the 29-rune Gematria Primus alphabet. It is the puzzle’s central unsolved artifact; most of it remains undeciphered as of June 2026 [4][5].
Has Cicada 3301 been solved?
The 2012 puzzle was solved to its endpoint, but the larger mystery and most of Liber Primus are not. The 2014 round and the bulk of the runes remain open [4][5].
Why the name Cicada and the number 3301?
3301 is a prime number, echoing prime cicadas that emerge on 13- and 17-year prime cycles. Primes recur throughout the clues, from file lengths to rune values [5].
Is Cicada 3301 connected to QAnon?
Not at its origin. After 2017, people fighting over the name pulled the symbol into QAnon-adjacent circles, but the original group only authenticated messages with PGP key 7A35090F [1].
When did Cicada 3301 last post?
The last widely accepted, PGP-signed message appeared in April 2017, warning solvers to verify any message against key 7A35090F and to ignore unsigned impostors [1][4].
