The 2012 Cicada 3301 puzzle was solved collaboratively on 4chan and Reddit in about one month. Here is each step, from the steganography image to the physical posters and final message.
The first Cicada 3301 puzzle was posted to 4chan on January 4, 2012. It was solved by a loose collaboration of anonymous users on 4chan and Reddit over roughly one month. The puzzle moved from an image board to a phone call to physical locations across multiple continents, and it demonstrated that crowdsourced cryptographic problem-solving could work at scale.
This post walks through each step of the 2012 puzzle in order. If you want to follow along with the cipher techniques, our Frequency Analysis tool](/tools/frequency-analysis) and Caesar cipher tool cover the substitution methods involved. The [Wikipedia article on Cicada 3301 provides a higher-level overview, while this post focuses on the step-by-step mechanics.
On January 4, 2012, an image was posted to 4chan's /b/ board. The image was a simple white-on-black text message that read: "Hello. We are looking for highly intelligent individuals. To find them, we have devised a test. There is a message hidden in this image. Find it, and it will lead you on the road to finding us. We look forward to meeting the few that will make it all the way through. Good luck. 3301."
The message was not the puzzle. The puzzle was hidden inside the image file itself. Solvers ran the image through steganography analysis tools and discovered that data had been embedded in the least significant bits of the pixel values. This technique, called LSB steganography, modifies the lowest bit of each color channel to encode a binary message without visibly changing the image. The Wikipedia article on steganography covers the technique in detail.
The hidden data, when extracted and decoded, revealed a text string. This was the first layer of the puzzle, and it demonstrated 3301's approach: each step requires a different skill, and each step leads to the next.
The text extracted from the image contained a reference to a book and a URL. The URL pointed to a Reddit post by a user named "Cage" on the subreddit r/a2e7jz9. The subreddit name itself was a cipher, though solvers did not need to decode it to proceed.
The Reddit post contained an encrypted message and instructions that pointed solvers toward a book cipher. A book cipher is a system where the ciphertext consists of references to positions in a specific text, and the plaintext is derived by looking up those positions. The Wikipedia article on book ciphers explains the mechanism. The critical requirement is that both sender and receiver have access to the same edition of the same text, because page numbers, line numbers, and word positions vary between editions.
Solvers needed to identify which book 3301 had used. The clue pointed to a specific text, and after some searching and debate, the community identified it as "The Mabinogion," a collection of medieval Welsh tales compiled from earlier oral traditions. The Wikipedia article on The Mabinogion provides historical context. The choice of an obscure medieval Welsh text was characteristic of 3301: it required solvers to have broad literary knowledge or the persistence to research until they found the right source.
With "The Mabinogion" identified as the key text, solvers applied the book cipher. The ciphertext contained sequences of numbers that referenced locations within the text. Each sequence pointed to a specific word, and the first letter of each referenced word formed the plaintext message.
The decoded message revealed a phone number with a Texas area code. This was a significant moment in the puzzle because it moved the challenge from the digital space into the physical world. A phone number is a real-world object. Calling it requires committing to the puzzle in a way that clicking a URL does not.
The book cipher step is where crowdsourcing proved its value. No single solver had identified "The Mabinogion" immediately. Multiple people proposed candidate texts, and the community tested each one against the ciphertext until the correct book produced readable English. This collaborative testing process is how the 2012 puzzle was solved: not by one genius but by dozens of people trying different approaches in parallel.
Solvers called the phone number. A recorded message answered. The message read out three numbers: 503, 509, and 3301. All three are prime numbers. This was not arbitrary. 3301 is the signature number used throughout the puzzle, and 503 and 509 are consecutive primes in the sequence of primes beginning with 499.
Solvers multiplied the three primes together: 503 times 509 times 3301 equals 845145127. This number formed the URL 845145127.com. Visiting that site revealed the next stage of the puzzle. The use of prime multiplication is a signature 3301 technique. It combines mathematics with a practical output (a URL) in a way that requires solvers to recognize the mathematical pattern and apply it.
You can experiment with similar substitution and encoding patterns using our Vigenere cipher tool, which demonstrates how a key-based system transforms plaintext into ciphertext. The Cicada 3301 puzzles used a variety of cipher types, and understanding the mechanics of each one helps when approaching unknown ciphertext.
The site at 845145127.com displayed a countdown timer. When the timer reached zero, the site updated to show a list of GPS coordinates. These coordinates pointed to physical locations in cities around the world, including Paris, London, New York, Miami, Seattle, and others.
At each location, a poster had been placed. The posters bore the Cicada 3301 logo (a cicada) and a QR code. Scanning the QR code led to the next stage of the puzzle. The physical poster step is what set 3301 apart from other internet puzzles. It required the organization to have people on the ground in multiple cities, placing posters at specific coordinates within a specific time window. This demonstrated resources and coordination that most anonymous internet groups lack.
Solvers who lived near the coordinates went to the locations, photographed the posters, and shared the QR codes online. This extended the collaborative model into physical space. Someone in Seattle scanned a poster so that someone in Tokyo could continue working on the puzzle.
After the QR codes were scanned, the puzzle continued through several more cryptographic steps that have been less fully documented than the earlier stages. The final outcome was a message from 3301 stating that the puzzle was complete and that the selected individuals had been contacted. A PGP-signed message confirmed this.
The 2012 puzzle took approximately one month from start to finish. It involved steganography, a book cipher, prime number mathematics, physical world coordination, and multiple intermediate cryptographic challenges. The collaborative solving process happened primarily on 4chan and Reddit, with solvers sharing findings in real time.
The success of the 2012 round led directly to the 2013 and 2014 rounds. The 2013 round followed a similar structure and was also solved. The 2014 round produced the Liber Primus and remains largely unsolved. You can read more about the full scope of all three rounds in our Cicada 3301 overview, and you can practice the cipher techniques involved using our Morse code translator for signal-based encoding challenges.
The 2012 puzzle took approximately one month from the initial 4chan post on January 4, 2012, to the final message stating that selected individuals had been contacted. The puzzle was solved collaboratively by users on 4chan and Reddit working in real time.
LSB (least significant bit) steganography is a technique where data is hidden in the lowest bit of each pixel's color value in an image. The modification is invisible to the human eye but can be extracted with steganography analysis tools. Cicada 3301 used this technique in the first image posted to 4chan.
The 2012 puzzle used The Mabinogion, a collection of medieval Welsh tales. The book cipher referenced specific positions within the text, and the first letter of each referenced word formed the plaintext message, which revealed a phone number.
The phone message read out three prime numbers: 503, 509, and 3301. Multiplying them together produces 845145127, which formed the URL 845145127.com. That site contained the next stage of the puzzle.
Yes. After the countdown on 845145127.com expired, the site displayed GPS coordinates pointing to cities including Paris, London, New York, Miami, and Seattle. Posters bearing the Cicada 3301 logo and QR codes had been placed at these locations. Solvers visited the sites and scanned the QR codes to continue the puzzle.
Cicada 3301: Inside the Internet's Most Elaborate Cipher Puzzle
Cicada 3301 posted three rounds of cryptographic puzzles across 4chan, Twitter, and physical cities. The 2014 Liber Primus remains mostly unsolved in 2026. Here is what happened and why it matters.
Cicada 3301 vs. Video Game ARGs: What's the Difference?
Cicada 3301 and video game ARGs both use puzzles across real platforms, but they differ in purpose, fiction layer, and cryptography. Here is how they compare.
