What Is Cicada 3301?
Cicada 3301 is the name given to an anonymous group that posted three rounds of cryptographic puzzles on the open internet between 2012 and 2014, recruiting “highly intelligent individuals” through layered ciphers, steganography, GPS coordinates, and physical posters in cities around the world. The organization’s identity, funding, and end goal remain unknown.
Most write-ups about Cicada 3301 are reconstructions of reconstructions. The screenshots are dated. The IRC logs are partial. The original Tor hidden services have all gone dark. Working the chain backward to the actual posts means stitching together imageboard archives, the GitHub repos solvers maintained, and the small handful of named participants who agreed to talk on the record. The puzzle was real. So was the community that formed around it. The question of who 3301 actually was, and what the recruitment was for, is genuinely still open.
This piece traces the timeline as it actually unfolded, names the figures who worked through it, and reads Cicada as the early-2010s phenomenon it was: a stress test of how online communities form around guided mystery, what hacker culture and ARG culture share, and how a well-designed JPEG can recruit a thousand strangers into a single shared chase. For the wider field of strange artifacts the modern web keeps surfacing, see contemporary mysteries and theories.
The Original Post: 4 January 2012
The first Cicada 3301 image surfaced on 4chan on 4 January 2012. The image was 509 by 503 pixels, both prime numbers, and showed white sans-serif text on a black background reading: “Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck.”
Provenance is worth being precise about. Multiple primary accounts cite 4chan’s /x/ paranormal board as the surface where the puzzle gained traction; Joel Eriksson, who solved most of the first round solo, has said the image circulated on multiple boards and “possibly originated at the infamous /b/ board.” Marcus Wanner, the most-named teenage solver, found it on 4chan’s science and math area. The honest answer is that the image cross-posted across at least three of 4chan’s boards within hours, and the cleanest summary is “imageboard culture, January 2012,” not a single thread.
Caesar, OutGuess, and a Wooden Duck
The first cipher was hidden in plain text. Opening the JPEG in a text editor revealed the line “TIBERIVS CLAVDIVS CAESAR says ‘lxxt>33m2mqkyv2gsq3q=w]O2ntk'”, a Caesar shift-4 referencing the fourth Roman emperor. Decoded, it pointed to an Imgur link of a wooden rubber duck on a striped towel. The duck looked like a dead end. The filename and the words “out” and “guess” pointed solvers toward OutGuess, a steganography tool by Niels Provos that hides data in JPEG coefficients. Running it pulled out a book code keyed to Thomas Bulfinch’s Mythology and the Welsh Mabinogion, which produced a phone number: (214) 390-9608. According to the Boxentriq technical walkthrough, the recorded message announced that 3301 was one of three primes associated with the original image. The other two were 509 and 503, the dimensions.
Coordinates and Physical Posters
The chain kept going. Subsequent stages produced a domain (845145127.com), a Reddit dead-drop (r/a2e7j6ic78h0j), a Vigenere cipher, MIDI files with embedded data, and finally a list of GPS coordinates in fourteen cities across five countries. Cicada had taped posters bearing a cicada glyph and a QR code to telegraph poles in Warsaw, Seoul, Paris, Sydney, Miami, Moscow, Hawaii, and elsewhere. People physically went and photographed them. The puzzle had crossed from a 2-D image board into the geolocated world.
Who Solved It (and Who Almost Did)
The named solver community is small. The verified-on-the-record subset is even smaller. The elite players who reached the late stages did so partly through individual chops and partly through trust networks formed in IRC.
Joel Eriksson (Sweden)
Joel Eriksson is a Swedish vulnerability researcher and exploit developer at Kryptera who worked the 2012 round mostly solo. His public write-up at clevcode.org is one of the most detailed public records of the puzzle’s mechanics. Eriksson reached a Tor hidden service at sq6wmgv2zcsrix6t.onion that asked first arrivals to submit an email address. He missed the window. The recruitment phase, by his account, was throttled by raw timing.
Marcus Wanner (Virginia, US)
Marcus Wanner was a 15-year-old home-schooled student in Copper Hill, Virginia when he saw the image in early January 2012. He worked with a small team that named itself #decipher in IRC, made the late-stage cut, and was eventually invited to a private forum maintained by 3301. As David Kushner reported for Rolling Stone in 2015, Wanner and the other 2013 finalists were asked questions about information freedom, online privacy, and censorship, then assigned to develop a “dead-man switch” software project intended for whistleblowers. The work fizzled. The project never shipped.
The IRC Channel and the Reddit Hive
Most public coordination happened in two venues: r/cicada on Reddit and the IRC channel #cicadasolvers on freenode (later moved). The Reddit thread acted as a working surface: people posted partial decryptions, hex dumps, and screenshots in close to real time. IRC was where the elite-tier solvers built reputation and trust, and where invitations into private channels happened. The gatekeeping was visible. Newcomers asking basic questions in IRC during peak hours were routinely brushed off; the social cost of looking unprepared was high.
The Second and Third Rounds
A second round opened on 4 January 2013, exactly one year after the first, with a new image and a PGP signature attached to all official communications. Marcus Wanner solved this round. The puzzles were harder. Solvers worked through Aleister Crowley (1875-1947) and his Liber AL vel Legis, a sound file with hidden bytes, and a network of telephone numbers in multiple countries. The Wikipedia archive of Cicada 3301 communications still tracks every PGP-signed message attributed to the group.
A third round opened on 4 January 2014, again at the same hour, this time with a Twitter clue. The 2014 round produced the artifact that has kept the community working ever since.
Liber Primus (2014)
Liber Primus, “First Book” in Latin, is a runic codex distributed in pieces during 2014. Most archives count it at 58 to 74 pages, depending on how unreleased material is treated. The text is written almost entirely in Anglo-Saxon futhorc runes and uses a rotating set of cipher schemes, including Vigenere, Atbash, totient-based shifts, and what appear to be one-time-pad fragments. As of 2026, only a small portion has been authoritatively decrypted. Large sections remain opaque, and no community-wide consensus exists on whether the unsolved pages encode a continuous message or whether the keys themselves were intentionally withheld. Held: undeciphered, with active work continuing in the cicadasolvers GitHub archive and on Discord.
What 3301 Actually Was: Three Honest Theories
No verified attribution exists. Self-described 3301 communications, signed by the OpenPGP key fingerprint 7A35090F, repeatedly described the group as a privacy-focused “think tank” unaffiliated with any government. The last verified PGP-signed message dropped on 4 April 2017 and warned solvers to “beware false paths” and verify all signatures. There has been no confirmed Cicada 3301 communication since. The three serious hypotheses cluster like this.
Intelligence-Agency Recruitment
The NSA, CIA, MI6, and Mossad all run public puzzle channels, and GCHQ in particular publishes annual cipher Christmas cards. The breadth of skills tested by Cicada (steganography, classical cryptography, network forensics, OSINT, real-world geolocation) maps cleanly onto signals-intelligence tradecraft. The objection: state agencies that recruit through open channels typically claim the work, because the recruitment is the point. Cicada never did. Keith Martin, the Royal Holloway cryptographer interviewed by The Conversation, suspected recruitment but stopped short of attribution.
Alternate Reality Game
Many of the design choices read like a mature ARG: the prime-number motif, the multi-platform staging, the physical posters, the patient pacing across calendar years. The objection: most ARGs are commercial. They want to be found. Cicada produced no product, no marketing tail, no eventual reveal. If it was a game, the playmaker either lost interest or considered the playing itself the deliverable.
Cryptoanarchist or Privacy Collective
The third hypothesis, favored by several solvers including Wanner, is that 3301 was an informal collective using puzzles as a filter for a small private project network. The dead-man switch tool Wanner’s team was assigned would fit the cryptoanarchist tradition that runs from the Cypherpunks list through Tor and modern leak-publication tooling. This explains the privacy focus, the post-recruit silence, and the disappearance of the org once the early projects either shipped quietly or stalled.
How Cicada Reveals Late-2010s Internet Culture
Read as a phenomenon rather than a puzzle, Cicada 3301 is one of the cleanest case studies of how online communities formed in the years between Anonymous’s 2008-2012 peak and the platform-mass-migration of the late 2010s.
Imageboard-to-Reddit-to-IRC Pipeline
The path the community took (4chan for first contact, Reddit for collaborative working memory, IRC for high-trust coordination) was the standard 2012-2014 stack for any subculture that wanted both reach and gatekeeping. Discord did not exist yet in any meaningful form. Slack was still primarily for workplaces. The IRC trust-network model handled what Discord servers later commoditized.
Hackers, ARG-Players, and Crypto-Enthusiasts in One Room
Cicada attracted three populations that rarely worked the same problem in 2012: security researchers who knew steganography and OutGuess by reflex, ARG veterans from The Beast (2001) and I Love Bees (2004) who recognized the multi-platform staging, and the early Bitcoin and cypherpunk crowd that read the privacy framing as an ideological signal. The mix is now common in any Web3 community. In 2012 it was novel. Cicada arguably accelerated the convergence.
The Appeal of Guided Mystery
Whitney Phillips (Syracuse University, then University of Oregon) and Ryan M. Milner (College of Charleston), in their 2021 book You Are Here, frame the appeal directly: communities form fastest around content that resists single readings. Cicada offered exactly that. Each clue had a verifiable solution but the meta-puzzle, who is doing this and why, never resolved. The structure rewarded participation indefinitely. The Liber Primus continued the pattern after the originators went silent: a partial text whose ambiguity is the engagement engine.
What Hasn’t Happened
Twelve years after the first image, no verified former member of 3301 has come forward. No corporate, governmental, or academic affiliation has been confirmed. No leaked internal documents have surfaced. The OpenPGP key 7A35090F has not been compromised or revoked. The cicadasolvers community on GitHub and Discord continues to chip away at Liber Primus pages. Posts claiming to be new Cicada communications appear regularly; almost none verify against the canonical key.
In a media environment where almost every digital mystery eventually resolves into a marketing campaign or a doxxed individual, that consistent silence is itself a finding. Either the originators are still committed to the privacy posture they performed in 2012, or the operation was always small enough that the operational security held by default. Either reading is interesting. Neither is conclusive.
Frequently Asked Questions
What is Cicada 3301?
Cicada 3301 is an anonymous organization that posted three sets of cryptographic puzzles on the open internet between 2012 and 2014, ostensibly to recruit “highly intelligent individuals.” The group’s identity, funding source, and ultimate purpose remain unknown despite more than a decade of investigation by the wider solver community.
Where was the first Cicada 3301 puzzle posted?
The first Cicada image was posted on 4chan on 4 January 2012. It cross-posted across multiple boards within hours, with primary accounts citing both /x/ (paranormal) and /b/ (random), and at least one named solver finding it on a science-and-math board. The cleanest summary is that it propagated through 4chan culture in the early hours of 4 January 2012, not from a single thread.
What is OutGuess and why does it matter?
OutGuess is a steganography tool created by Niels Provos that hides data inside JPEG coefficients. The first Cicada puzzle required running OutGuess on the wooden-duck Imgur image to extract a book code keyed to The Mabinogion. Steganography of this kind was a recurring Cicada technique, embedding clues invisibly in image and audio files.
Who actually solved Cicada 3301?
Joel Eriksson, a Swedish security researcher, reached the late stages of the 2012 round but missed the registration window. Marcus Wanner, then a 15-year-old in Virginia, completed the 2013 round with his IRC team #decipher and was invited to a private 3301 forum. A handful of other solvers, including Nox Populi, completed late stages but most have not gone fully on the record.
Has Liber Primus been solved?
No. Liber Primus is a runic text of approximately 58 to 74 pages, distributed during the 2014 round. As of 2026, only a small portion has been authoritatively decrypted. Active community work continues, primarily on the cicadasolvers GitHub archive and Discord, but no consensus on a complete solution exists.
Was Cicada 3301 the NSA?
There is no verified evidence connecting Cicada 3301 to the NSA, CIA, MI6, Mossad, or any other intelligence agency. Several professional cryptographers, including Keith Martin of Royal Holloway, have noted that the skill profile maps cleanly onto signals intelligence work, but the operation never claimed agency affiliation. State recruitment programs that use puzzles, like GCHQ’s annual Christmas card, generally identify themselves.
What was the dead-man switch project?
According to Marcus Wanner’s account in David Kushner’s 2015 Rolling Stone reporting, the small group of 2013 finalists invited to the private 3301 forum was assigned to design a “dead-man switch” software tool intended for whistleblowers. The application would automatically release encrypted information if the user failed to check in. The project was never shipped publicly.
When was the last verified Cicada 3301 communication?
The last authentically OpenPGP-signed message from key fingerprint 7A35090F appeared on Pastebin on or around 4 April 2017. It warned solvers to “beware false paths” and to verify all signatures. No verified communication from 3301 has been confirmed since that date. Many unsigned posts have since claimed Cicada origin; almost none have verified against the canonical key.
Is Cicada 3301 still active in 2026?
No verified Cicada 3301 communication has occurred since April 2017. The original organization, by any signed evidence, has been silent for nearly a decade. The community of solvers, archivists, and runic decryption hobbyists remains active and continues to work on Liber Primus, but they are studying the artifact, not communicating with its originators.
Why does the number 3301 matter?
The number 3301 is prime and was the signing identifier of all official Cicada communications. The original 2012 image dimensions, 509 by 503, were also prime, and the recorded phone-message clue confirmed that “three prime numbers associated with the image” were part of the design. Prime numbers, with their associations to fundamental cryptography (RSA, Diffie-Hellman), function as the symbolic backbone of the entire puzzle structure.
